joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403410
Capabilities:
Enumerate processes
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x41f560
push 0x40ed80
mov eax, dword fs:[0]
push eax
sub esp, 0x364
mov eax, dword [0x4213c0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x370], eax
mov dword [ebp - 0x360], 2
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x368], esi
mov dword [ebp - 0x364], ebx
mov byte [ebp - 0x12c], bl
push 0x103
push ebx
lea ecx, [ebp - 0x12b]
push ecx
call fcn.0040c100
mov byte [ebp - 0x234], bl
push 0x103
push ebx
lea edx, [ebp - 0x233]
push edx
call fcn.0040c100
mov dword [ebp - 0x35c], ebx
push 0x124
push ebx
lea eax, [ebp - 0x358]
push eax
call fcn.0040c100
add esp, 0x24
mov dword [ebp - 4], ebx
push 0x104
lea ecx, [ebp - 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x12c]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4034d0
mov edx, dword [str.explorer.exe]
mov dword [eax], edx
mov ecx, dword [0x41e7b8]
mov dword [eax + 4], ecx
mov edx, dword [0x41e7bc]
mov dword [eax + 8], edx
mov cx, word [0x41e7c0]
mov word [eax + 0xc], cx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x364], eax
cmp eax, 0xffffffff
je 0x403563
mov dword [ebp - 0x35c], 0x128
lea edx, [ebp - 0x35c]
push edx
push eax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x403563
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [ebp - 0x354]
push eax
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x368], esi
cmp esi, ebx
je 0x4035e6
push str.PSAPI
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
jne 0x403574
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x360], eax
jmp 0x403601
push str.GetModuleFileNameExA
push eax
call edi
push 0x104
lea ecx, [ebp - 0x234]
push ecx
push ebx
push esi
call eax
test eax, eax
je 0x4035d7
lea edx, [ebp - 0x12c]
push edx
lea eax, [ebp - 0x234]
push eax
call fcn.0040a950
add esp, 8
test eax, eax
jne 0x4035d7
lea ecx, [ebp - 0x36c]
push ecx
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x403601
mov edx, dword [ebp - 0x36c]
mov eax, dword [ebp - 0x370]
mov dword [eax], edx
mov dword [ebp - 0x360], ebx
jmp 0x403601
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov dword [ebp - 0x368], esi
lea ecx, [ebp - 0x35c]
push ecx
mov edx, dword [ebp - 0x364]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x403531
mov dword [ebp - 4], 0xfffffffe
call fcn.00403639
mov eax, dword [ebp - 0x360]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0040a5bc
mov esp, ebp
pop ebp
ret 4
Function at 0x403660
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x60
push esi
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0
call fcn.00403410
push 0x40
lea ecx, [esp + 0x20]
push 0
push ecx
call fcn.0040c100
add esp, 0xc
xor edx, edx
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
push edx
push 0x30
push edx
push edx
push edx
push edx
mov word [esp + 0x6c], dx
mov edx, dword [esp + 0x28]
push 0x4230b8
push edx
mov dword [esp + 0x44], 0x44
mov dword [esp + 0x70], 1
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x4036d8
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov eax, 1
pop esi
add esp, 0x60
ret

Function at 0x4036f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x410
mov eax, dword [0x4213c0]
xor eax, esp
mov dword [esp + 0x40c], eax
push ebx
push esi
push edi
mov ebx, ecx
mov ecx, 8
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebx + 4]
movsb byte es:[edi], byte [esi]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403721
lea edi, [esp + 0x18]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403731
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x18]
rep movsb byte es:[edi], byte [esi]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x403750
mov ecx, dword [str.Parameters]
mov edx, dword [0x41e820]
mov dword [eax], ecx
mov ecx, dword [0x41e824]
mov dword [eax + 4], edx
lea edx, [esp + 0xc]
push edx
push 1
mov dword [eax + 8], ecx
push 0
lea eax, [esp + 0x24]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4037e9
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [ebx + 0x78]
push edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 0
push str.Start
mov edi, 4
push ecx
mov dword [esp + 0x28], edi
call esi
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [ebx + 0x7c]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0x41e830
push edx
mov dword [esp + 0x28], edi
call esi
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebx + 0x78]
pop edi
mov dword [ebx + 0x80], ecx
mov ecx, dword [esp + 0x414]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0040a5bc
add esp, 0x410
ret
Function at 0x403810
Capabilities:
Copy file
Delete file
Move file

Disassembly:
sub esp, 0x358
mov eax, dword [0x4213c0]
xor eax, esp
mov dword [esp + 0x354], eax
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
lea eax, [esp]
push eax
call fcn.004042b0
add esp, 4
push 0x104
lea ecx, [esp + 0x254]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x250]
push 0x5c
push edx
call fcn.0040b870
add esp, 8
test eax, eax
je 0x403926
mov byte [eax], 0
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x250]
mov byte [esp + eax + 0x14c], cl
inc eax
test cl, cl
jne 0x403880
xor eax, eax
jmp 0x4038a0
mov cl, byte [esp + eax + 0x250]
mov byte [esp + eax + 0x48], cl
inc eax
test cl, cl
jne 0x4038a0
lea eax, [esp + 0x14c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4038b8
mov ecx, dword [str._reminder.dll]
mov edx, dword [0x41e840]
mov dword [eax], ecx
mov ecx, dword [0x41e844]
mov dword [eax + 4], edx
mov dx, word [0x41e848]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
lea eax, [esp + 0x48]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4038f0
mov ecx, dword [str._remindernew.dll]
mov edx, dword [0x41e850]
mov dword [eax], ecx
mov ecx, dword [0x41e854]
mov dword [eax + 4], edx
mov edx, dword [0x41e858]
mov dword [eax + 8], ecx
mov cl, byte [0x41e85c]
mov dword [eax + 0xc], edx
mov byte [eax + 0x10], cl
jmp 0x40397f
mov edx, dword [str.reminder.dll]
mov eax, dword [0x41e864]
mov ecx, dword [0x41e868]
mov dword [esp + 0x14c], edx
mov dl, byte [0x41e86c]
mov dword [esp + 0x150], eax
mov eax, dword [str.remindernew.dll]
mov dword [esp + 0x154], ecx
mov ecx, dword [0x41e874]
mov byte [esp + 0x158], dl
mov edx, dword [0x41e878]
mov dword [esp + 0x48], eax
mov eax, dword [0x41e87c]
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], eax
push esi
lea ecx, [esp + 0x4c]
push 0
push ecx
call fcn.0040b819
add esp, 8
cmp eax, 0xffffffff
je 0x4039d6
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x150]
push edx
call esi
lea eax, [esp + 0x150]
push eax
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x4039d6
push eax
lea edx, [esp + 0x154]
push edx
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x4c]
push ecx
call esi
lea edx, [esp + 0x150]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x403a1d
push str.ExTB
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x403a1d
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x1c]
push str._sp__s
push ecx
call fcn.0040a9a2
add esp, 0xc
push 0x1e5214
lea edx, [esp + 0x1c]
push edx
call esi
mov ecx, dword [esp + 0x358]
pop esi
xor ecx, esp
call fcn.0040a5bc
add esp, 0x358
ret
Function at 0x403e10
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x40c
mov eax, dword [0x4213c0]
xor eax, esp
mov dword [esp + 0x408], eax
push esi
push edi
push str.Saving_current_status
mov ecx, ebx
call fcn.004026c0
mov ecx, 8
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebx + 4]
movsb byte es:[edi], byte [esi]
add esp, 4
mov dword [esp + 8], 0
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403e55
lea edi, [esp + 0x10]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403e63
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x403e80
mov ecx, dword [str.Status]
mov edx, dword [0x41ea28]
mov dword [eax], ecx
mov dword [eax + 4], edx
lea eax, [esp + 0x10]
push eax
push str.Creating_key:__s
mov ecx, ebx
call fcn.004026c0
add esp, 8
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push 0
push 0x20006
push 0
push 0x41e19e
push 0
lea eax, [esp + 0x2c]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x403f02
push eax
push str.Failed_to_create_Status_key___lu_
mov ecx, ebx
call fcn.004026c0
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.0040a5bc
add esp, 0x40c
ret
mov ecx, dword [ebx + 0x80]
lea esi, [ebx + 0x80]
push ecx
push str.Saving_Current_as__ld
mov ecx, ebx
call fcn.004026c0
mov edx, dword [esp + 0x10]
add esp, 8
push 4
push esi
push 4
push 0
push str.Current
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x410]
pop edi
pop esi
xor ecx, esp
call fcn.0040a5bc
add esp, 0x40c
ret
Function at 0x403f70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84
mov eax, dword [0x4213c0]
xor eax, esp
mov dword [esp + 0x80], eax
push esi
call fcn.004045c0
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x403030
push 0
push 0
mov dword [esp + 0x1c], 0
call esi
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 8]
movzx eax, word [esp + 0xa]
imul edx, edx, 0x16d
mov ecx, eax
shl ecx, 4
sub ecx, eax
movzx eax, word [esp + 0xe]
lea edx, [edx + ecx*2]
add edx, eax
cmp edx, 0xb38f8
jb 0x404089
lea ecx, [esp + 0x18]
push ecx
call fcn.004042b0
add esp, 4
lea edx, [esp + 0x18]
push str.fcbs
push edx
call fcn.0040a630
add esp, 8
test eax, eax
je 0x404019
mov dword [0x4220c8], 1
jmp 0x404044
lea eax, [esp + 0x18]
push str.mcsl
push eax
call fcn.0040a630
add esp, 8
test eax, eax
je 0x40403b
mov dword [0x4220c8], 2
jmp 0x404044
cmp dword [0x4220c8], 0
jle 0x404089
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0x403ab0
push 0
push 0
call esi
cmp dword [0x4220c8], 1
jne 0x404089
lea edx, [esp + 4]
push edx
push 0
push 0
push 0x403a40
push 0
push 0
call esi
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x402d30
push 0
push 0
call esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0x927c0
call esi
jmp 0x404090

Function at 0x4042b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
push eax
push str.SOFTWAREMiniReminder
push closesocket
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x404311
mov edx, dword [esp + 0x14]
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push edx
lea eax, [esp + 0x14]
push eax
push esi
push str.ccode
push ecx
mov dword [esp + 0x20], 0x32
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404306
lea esi, [eax + 1]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x404320
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [edi]
push esi
push 4
lea eax, [esp + 0xc]
push eax
push 4
xor esi, esi
push esi
push str.miniver
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x404342
lea esi, [eax + 1]
mov edx, dword [edi]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
ret

Function at 0x4045c0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x19c
mov eax, dword [0x4213c0]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x404616
cmp byte [esp], 2
jne 0x404610
mov ecx, dword [esp + 2]
shr ecx, 8
cmp cl, 2
jne 0x404610
mov al, 1
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.0040a5bc
add esp, 0x19c
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x194]
xor ecx, esp
xor al, al
call fcn.0040a5bc
add esp, 0x19c
ret
Function at 0x4046d0
Capabilities:
Connect socket
Resolve dns

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4213c0]
xor eax, esp
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov eax, 2
push str.note.sharetool.net
mov word [esp + 8], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x404728
push str.note.sharetool.net
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x404781
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [esp + 8], eax
push 0x50
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 8]
mov word [esp + 6], ax
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
mov dword [esi + 0x18], ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x1c], edx
push 0x10
mov dword [esi + 0x20], eax
mov eax, dword [esi + 4]
lea edx, [esp + 8]
push edx
push eax
mov dword [esi + 0x24], ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4047a6
mov edx, dword [esi]
mov eax, dword [edx + 0x20]
mov ecx, esi
call eax
xor eax, eax
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0040a5bc
add esp, 0x1c
ret
mov edx, dword [esi]
mov eax, dword [edx + 0x20]
mov ecx, esi
call eax
push 0x2726
call dword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0040a5bc
add esp, 0x1c
ret
mov ecx, dword [esp + 0x14]
xor ecx, esp
mov eax, 1
call fcn.0040a5bc
add esp, 0x1c
ret

Function at 0x404800
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebp, ecx
xor esi, esi
mov ecx, dword [ebp + 4]
push 0
mov eax, ebx
sub eax, esi
push eax
push edi
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x40483c
test eax, eax
jle 0x404833
add esi, eax
add edi, eax
cmp esi, ebx
jne 0x404810
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8

Function at 0x404850
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
xor esi, esi
mov ebp, ecx
test ebx, ebx
jle 0x40489d
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [ebp + 4]
push 0
push 1
push edi
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x40489c
add esi, eax
cmp esi, ebx
je 0x404898
mov cl, byte [edi]
cmp cl, 0xd
je 0x404898
cmp cl, 0xa
je 0x404898
add edi, eax
cmp esi, ebx
jl 0x404864
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
mov byte [edi], 0
dec esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x4048b0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x110
push ebp
xor ebp, ebp
cmp dword [esp + 0x11c], ebp
push edi
mov edi, ecx
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ebp
jle 0x4049d6
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_recv]
push esi
mov esi, dword [esp + 0x124]
jmp 0x4048f0
cmp dword [esp + 0x10], 3
je 0x4049b8
mov eax, dword [edi + 4]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
lea edx, [esp + 0x28]
push edx
push 0
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x40492a
inc dword [esp + 0x10]
jmp 0x404994
cmp eax, 0xffffffff
je 0x404965
mov ecx, dword [edi + 4]
lea eax, [esp + 0x1c]
push eax
push ecx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x404994
mov edx, dword [edi + 4]
push 0
push 1
push esi
push edx
call ebx
cmp eax, 0xffffffff
jne 0x40496a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
je 0x404994
cmp eax, 0x2738
je 0x404994
or ebp, 0xffffffff
jmp 0x4049b1
test eax, eax
je 0x4049a3
add ebp, eax
cmp ebp, dword [esp + 0x128]
je 0x4049a7
cmp byte [esi], 0xa
jne 0x404992
cmp dword [esi - 3], 0xa0d0a0d
je 0x4049ad
cmp byte [esi - 1], 0xa
jne 0x404992
cmp byte [esi], 0xa
je 0x4049ad
add esi, eax
cmp ebp, dword [esp + 0x128]
jl 0x4048f0
jmp 0x4049b1
xor ebp, ebp
jmp 0x4049b1
mov byte [esi], 0
dec ebp
jmp 0x4049b1
mov byte [esi + 1], 0
cmp dword [esp + 0x10], 3
jne 0x4049c7
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x110
ret 8
pop esi
pop ebx
pop edi
mov eax, ebp
pop ebp
add esp, 0x110
ret 8
pop edi
mov eax, ebp
pop ebp
add esp, 0x110
ret 8

Function at 0x4049f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
push esi
push ebx
mov ebp, ecx
mov eax, dword [ebp + 4]
push edi
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x404a31
add esi, eax
add edi, eax
cmp esi, ebx
je 0x404a3b
mov edx, dword [ebp + 4]
push 0
mov ecx, ebx
sub ecx, esi
push ecx
push edi
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x404a12
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x404a80
Capabilities:
Access peb ldr_data
Create tcp socket
Create udp socket

Disassembly:
push 0xffffffffffffffff
push 0x417ff8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4213c0]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
mov eax, dword [0x4213c0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0xc], vtable.CSocketImpl.0
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
push eax
push 1
push 2
mov dword [esp + 0x4c], eax
call dword [sym.imp.WS2_32.dll_socket]
lea esi, [esp + 0xc]
mov dword [esp + 0x10], eax
call fcn.004046d0
test eax, eax
je 0x404b1e
push 0x234
call fcn.0040a756
add esp, 4
test eax, eax
je 0x404b1e
mov ebx, esi
mov esi, eax
call fcn.00404370
jmp 0x404b20
xor eax, eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0040a5bc
add esp, 0x38
ret
Function at 0x40a3cc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x40a3f1
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x40a409
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x40a438
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x40a47a
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x40a54e
sub edx, 0x10000
js 0x40a54e
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x40a460
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x40a460
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x40a4d1
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x40a4ce
add edx, 8
jne 0x40a4b5
jmp 0x40a53f
add edx, 4
test eax, 0xffff
jne 0x40a4de
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x40a53f
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x40a512
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x40a460
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x40a54e
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x40a460
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x40a55f
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40a5bc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4213c0]
jne 0x40a5c6
repz ret
jmp fcn.0040c261