joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10027ce
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004014]
jne 0x10027d7
ret
jmp 0x10027dc
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x1004014]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x1004058]
test eax, eax
je 0x1002800
call eax
cmp dword [0x100405c], 0
je 0x1002847
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x100405c]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.010027ce
add ebp, 0x2a8
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x3e763d90
nop
nop
nop
nop
test eax, eax
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x42f3f8
mov ecx, 0x183222d5
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x59e204db
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..text_1
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7c587dc7
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401e40
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x75
or dword [ebx - 0x72a9f38b], ecx
inc ebp
mov byte [edx + 0x78], ch
inc ebx
push esi
call fcn.004086e0
mov edi, dword [ebx]
or byte [ebx + 0x22c0c815], cl
add byte [eax + 0x51], dl
add edx, 0x40
push str._s:__s___d__n
push edx
call [eax + eax*4]
rol dword [eax], 0x12
lodsb al, byte [esi]
fadd qword [ecx]
add esp, 0x14
test eax, eax
mov ebx, 0x3668500f
rol byte [eax], cl
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
push esi
call dword [sym.imp.WSOCK32.dll_setsockopt]
pop esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
iretd

Function at 0x40ae0d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add byte [eax], al
add byte [ecx], dh
idiv ebx
add al, 0x30
mov byte [edi], al
adc byte [eax + 0x4726ef1], cl
cmp al, 9
jbe 0x40ae38
mov eax, eax
scasb al, byte es:[edi]
mov ebx, 0xa
and eax, 0xff
inc edi
idiv ebx
add al, 0xe0
mov byte [ecx], al
push es
mov al, dl
add al, 0x30
mov es, word [ecx]
invalid
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040cffb
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040cffb
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040cffb
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040cffb
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040cffb
mov dword [0x41203c], eax
call fcn.0040cffb
test eax, eax
jge 0x402550
push 8
call fcn.0040cffb
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040cffb
pop ecx
push 1
call fcn.0040cffb
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040cffb
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040cffb
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040cffb
jmp 0x402495

Function at 0x40cffb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40d00a
pop dword [ebp - 0x14]
mov eax, 0x9a2d6449
add eax, 0x66136bc1
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3c9b6
push 0
mov eax, 0x83620adb
sub eax, 0x83212a03
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0xeb4b696e
sub ecx, 0xeb4b13ed
xor esi, esi
add esi, eax
mov edi, 0x89e702b2
sub edi, 0x89a5c6ee
add edi, dword [ebp - 0x14]
mov edx, 0x405c21fb
xor dword [ebp - 4], 0x22a151da
mov ebx, dword [edi]
add dword [ebp - 0xc], 0x7601dd5e
add ebx, edx
sub dword [ebp - 8], ebx
mov dword [esi], ebx
xor dword [ebp - 8], 0x9c15391d
add esi, 0x91de3254
add esi, 0x6e21cdb0
add edi, 4
loop 0x40d065
add eax, 0x15b52820
add eax, 0xea4c20b7
xor ebx, ebx
add ebx, eax
add eax, 0xf2d3d785
add eax, 0xd2c2880
mov ecx, 0x79dfb72a
sub ecx, 0x799fb72a
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00401434
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00401434
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00401434
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc

Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x731243f9
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
mov ecx, 0x78dc3c5f
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x405867
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x254
mov eax, dword [ebp + 8]
mov dword [0x438048], eax
lea edx, [ebp - 0x20c]
mov eax, 0
mov ecx, pe_nt_image_headers32
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov ecx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
mov dword [esp + 0x14], 0xff
lea edx, [ebp - 0x20c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call eax
sub esp, 0x18
mov eax, dword [0x438044]
mov edx, dword [eax]
mov eax, dword [0x438044]
mov eax, dword [eax + 0x4c]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0xda
mov dword [esp + 0x18], 0x14b
mov dword [esp + 0x14], 0x80000000
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], 0x80000
lea eax, [ebp - 0x20c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.ew::editAccount
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_CreateWindowExW]
call eax
sub esp, 0x30
mov dword [ebp - 0xc], eax
mov eax, dword [0x438044]
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_EnableWindow]
call eax
sub esp, 8
mov eax, dword [0x438044]
mov eax, dword [eax + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
jmp 0x4059ab
lea eax, [ebp - 0x228]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_TranslateMessage]
call eax
sub esp, 4
lea eax, [ebp - 0x228]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_DispatchMessageW]
call eax
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x228]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetMessageW]
call eax
sub esp, 0x10
test eax, eax
jne 0x405985
mov eax, dword [0x438044]
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_EnableWindow]
call eax
sub esp, 8
nop
mov edi, dword [ebp - 4]
leave
ret
Function at 0x40a09e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x54
cmp dword [ebp + 8], 0
jne 0x40a0b5
mov eax, 0
jmp 0x40a22e
mov eax, dword [ebp + 8]
movzx eax, word [eax + 0x12]
test ax, ax
jne 0x40a1b9
mov eax, dword [0x438044]
mov eax, dword [eax + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_IsWindowVisible]
call eax
sub esp, 4
test eax, eax
jne 0x40a0fb
mov eax, dword [0x438044]
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], 6
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov eax, dword [0x438044]
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov eax, dword [0x438044]
mov eax, dword [eax + 0x2c]
lea edx, [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetWindowRect]
call eax
sub esp, 8
mov eax, dword [0x438044]
mov eax, dword [eax + 0x2c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
sub ecx, edx
lea ebx, [ecx - 0x7d]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
sub ecx, edx
sub ecx, 0x82
mov edx, dword [ebp + 8]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], 0x7d
mov dword [esp + 0x10], 0x82
mov dword [esp + 0xc], 0x40800000
mov dword [esp + 8], 0
mov dword [esp + 4], str.ew::orderView
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_CreateWindowExW]
call eax
sub esp, 0x30
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
jmp 0x40a22e
mov dword [esp], str.Creating_completed_order_view__n
call fcn.004068e0
mov eax, dword [ebp + 8]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x50800000
mov dword [esp + 8], 0
mov dword [esp + 4], str.ew::orderView
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_CreateWindowExW]
call eax
sub esp, 0x30
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4121b1
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
cmp dword [ebp + 8], 0
je 0x4121c6
cmp dword [ebp + 0xc], 0
jne 0x4121d0
mov eax, 0xffffffff
jmp 0x4122af
mov eax, dword [0x43813c]
test eax, eax
jne 0x41220c
lea eax, [ebp - 0x1b0]
mov dword [esp + 4], eax
mov dword [esp], 0x202
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
test eax, eax
je 0x412202
mov eax, 0xffffffff
jmp 0x4122af
mov dword [0x43813c], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x41223d
mov eax, 0xffffffff
jmp 0x4122af
mov word [ebp - 0x20], 2
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
call eax
sub esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [ebp - 0x1e], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4122ac
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, 0xffffffff
jmp 0x4122af
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x4122b1
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
leave
ret
Function at 0x412310
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [ebp - 0x2a], 0
mov dword [ebp - 0x26], 0
mov word [ebp - 0x22], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 9
lea edx, [ebp - 0x2a]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x412367
mov eax, 0
jmp 0x4124c4
movzx eax, byte [ebp - 0x2a]
cmp al, 0x45
je 0x412379
mov eax, 0
jmp 0x4124c4
mov dword [ebp - 0xc], 1
jmp 0x4123a2
lea edx, [ebp - 0x2a]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x20
jne 0x41239e
lea edx, [ebp - 0x2a]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0
jmp 0x4123a8
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 8
jle 0x412382
lea eax, [ebp - 0x2a]
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x4123c9
mov eax, 0
jmp 0x4124c4
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_calloc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0xc], 8
jg 0x412467
mov eax, dword [ebp - 0xc]
lea edx, [eax + 1]
lea eax, [ebp - 0x2a]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x412467
mov eax, dword [ebp - 0xc]
lea edx, [eax + 1]
lea eax, [ebp - 0x2a]
add eax, edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov eax, 8
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
jmp 0x412467
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x10]
mov edx, eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add ecx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x412473
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x10]
test eax, eax
jg 0x412428
jmp 0x412474
nop
lea eax, [ebp - 0x128]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.00415b00
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4124a9
cmp dword [ebp - 0x20], 0
je 0x4124a9
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
test eax, eax
je 0x4124c1
cmp dword [ebp - 0x20], 0
je 0x4124ba
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call fcn.00412171
mov eax, 0
jmp 0x4124c4
mov eax, dword [ebp - 0x20]
leave
ret
Function at 0x4124c6
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x26], 0
mov dword [ebp - 0x22], 0
mov word [ebp - 0x1e], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 9
lea edx, [ebp - 0x26]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x41251a
mov eax, 0
jmp 0x412632
movzx eax, byte [ebp - 0x26]
cmp al, 0x45
je 0x41252c
mov eax, 0
jmp 0x412632
mov dword [ebp - 0xc], 1
jmp 0x412555
lea edx, [ebp - 0x26]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x20
jne 0x412551
lea edx, [ebp - 0x26]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0
jmp 0x41255b
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 8
jle 0x412535
lea eax, [ebp - 0x26]
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x41257c
mov eax, 0
jmp 0x412632
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_calloc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0xc], 8
jg 0x41261a
mov eax, dword [ebp - 0xc]
lea edx, [eax + 1]
lea eax, [ebp - 0x26]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x41261a
mov eax, dword [ebp - 0xc]
lea edx, [eax + 1]
lea eax, [ebp - 0x26]
add eax, edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov eax, 8
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
jmp 0x41261a
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x10]
mov edx, eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add ecx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x412626
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x10]
test eax, eax
jg 0x4125db
jmp 0x412627
nop
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [ebp - 0x1c]
leave
ret