joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a29b0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f3ec9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x101480b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
call fcn.10002710
mov edi, eax
test edi, edi
je 0x100a2afe
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100f9528]
mov ecx, edi
call esi
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp - 0x14], 1
push dword [ebp + 0xc]
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100a2ae8
mov esi, dword [ebp - 0x10]
cmp esi, 0xa00000
ja 0x100a2b08
shr esi, 1
sub esi, 1
js 0x100a2b23
mov eax, dword [edi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or ecx, eax
jge 0x100a2a80
push esi
mov ecx, edi
call fcn.100b0090
mov ecx, dword [edi]
cmp esi, dword [ecx - 8]
jg 0x100a2b23
mov dword [ecx - 0xc], esi
xor edx, edx
mov eax, dword [edi]
push edx
mov word [eax + esi*2], dx
lea eax, [ebp - 0x10]
push eax
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov ecx, dword [edi]
mov esi, eax
test ecx, ecx
je 0x100a2ac5
push dword [ecx - 8]
push ecx
call fcn.100b0090
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x100a2b23
mov eax, dword [edi]
cmp ecx, dword [eax - 8]
jg 0x100a2b23
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [edi]
mov word [eax + ecx*2], dx
test esi, esi
jne 0x100a2ae8
push esi
push 0x100fb314
mov ecx, edi
call fcn.100b0090
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.100b0090
push 0xcaa10024
lea ecx, [ebp - 0x20]
call fcn.100b0090
push 0x10134a50
lea eax, [ebp - 0x20]
push eax
call fcn.100b0090
push 0x80070057
call fcn.100b0090
int3
Function at 0x100a2b30
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f3ef8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x101480b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebx + 0x18]
lea esi, [ebx + 0x14]
sub edi, dword [esi]
mov eax, dword [ebp + 8]
add eax, edi
cmp eax, 0xa00000
jg 0x100a2bca
lea ecx, [ebp - 0xd]
mov byte [ebp - 0xd], 0
push ecx
push esi
push eax
mov ecx, esi
call fcn.100b0090
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp + 8]
add eax, edi
mov dword [ebp - 0x14], 0
push eax
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x100a2be5
mov eax, dword [ebp - 0x14]
mov ecx, esi
push esi
add eax, edi
push eax
call fcn.100b0090
push 0xa
mov ecx, ebx
call fcn.100b0090
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xcaa10024
lea ecx, [ebp - 0x24]
call fcn.100b0090
push 0x10134a50
lea eax, [ebp - 0x24]
push eax
call fcn.100b0090
push 0x100fb314
lea ecx, [ebp - 0x18]
call fcn.100b0090
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x38]
call fcn.100b0090
push 0x101358ac
lea eax, [ebp - 0x38]
push eax
call fcn.100b0090
int3
Function at 0x100a3050
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f3f88
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x101480b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebx + 0x30]
mov dword [ebx + 4], ebx
call fcn.1004a500
test eax, eax
jne 0x100a308d
xor edi, edi
jmp 0x100a3097
lea ecx, [ebx + 0x30]
call fcn.1004a500
mov edi, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x30]
call fcn.100b0090
mov esi, dword [eax]
mov ecx, 0x1015146c
movzx eax, byte [ebx + 0x3d]
push eax
mov dword [ebp - 4], 0
call fcn.100b0090
push 0
push 0
push 3
push 0
push 0
push edi
push esi
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x48], eax
add ecx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x100a30ff
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100f9528]
mov ecx, edi
call esi
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x100a3132
push 0x100a38e0
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
cmp eax, 0xffffffff
je 0x100a3166
push 2
mov ecx, ebx
call fcn.100b0090
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100fb314
lea ecx, [ebp - 0x10]
call fcn.100b0090
mov esi, eax
mov dword [ebp - 4], 1
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.100b0090
push 0x101358ac
lea eax, [ebp - 0x28]
push eax
call fcn.100b0090
push 0x100fb314
lea ecx, [ebp - 0x14]
call fcn.100b0090
mov esi, eax
mov dword [ebp - 4], 2
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x3c]
call fcn.100b0090
push 0x101358ac
lea eax, [ebp - 0x3c]
push eax
call fcn.100b0090
int3
Function at 0x100a3480
Capabilities:
Query remote server for available data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f3e88
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x101480b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [esi + 0x4c]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x100a34d1
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x100a3501
mov edx, dword [esi + 0x18]
sub edx, dword [esi + 0x14]
mov eax, dword [ebp - 0x10]
lea ecx, [edx + eax]
cmp ecx, eax
jb 0x100a3550
cmp ecx, edx
jb 0x100a3550
test eax, eax
je 0x100a34f1
cmp ecx, 0xa00000
ja 0x100a3535
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x100fb314
lea ecx, [ebp - 0x14]
call fcn.100b0090
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x34]
call fcn.100b0090
push 0x101358ac
lea eax, [ebp - 0x34]
push eax
call fcn.100b0090
push 0xcaa10024
lea ecx, [ebp - 0x20]
call fcn.100b0090
push 0x10134a50
lea eax, [ebp - 0x20]
push eax
call fcn.100b0090
push 0xcaa82f9b
lea ecx, [ebp - 0x2c]
call fcn.100b0090
push 0x10134a50
lea eax, [ebp - 0x2c]
push eax
call fcn.100b0090
int3

Function at 0x100a36f0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f3fe8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x101480b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebx + 0x18]
lea esi, [ebx + 0x14]
sub edi, dword [esi]
mov ecx, dword [ebp + 8]
lea eax, [edi + ecx]
cmp eax, edi
jl 0x100a3791
cmp eax, ecx
jl 0x100a3791
cmp eax, 0xa00000
jg 0x100a3798
push esi
push eax
mov ecx, esi
call fcn.100b0090
mov eax, dword [esi]
lea ecx, [ebx + 0x40]
push ecx
push dword [ebp + 8]
add eax, edi
push eax
push dword [ebx + 0x4c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x100a3766
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x100a37b3
mov eax, dword [ebx + 0x40]
mov ecx, esi
push esi
add eax, edi
push eax
call fcn.100b0090
push 0xa
mov ecx, ebx
call fcn.100b0090
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xcaa82f9c
jmp 0x100a379d
push 0xcaa10024
lea ecx, [ebp - 0x1c]
call fcn.100b0090
push 0x10134a50
lea eax, [ebp - 0x1c]
push eax
call fcn.100b0090
push 0x100fb314
lea ecx, [ebp - 0x10]
call fcn.100b0090
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x30]
call fcn.100b0090
push 0x101358ac
lea eax, [ebp - 0x30]
push eax
call fcn.100b0090
int3
Function at 0x100b0090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x100b009f
pop dword [ebp - 0xc]
mov eax, 0x98fa13c7
sub eax, 0x88ef1328
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x81043
push 0
mov eax, 0x6a6f6a83
add eax, 0xa5a0274d
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0xe8e1605e
sub ecx, 0xe8e1159b
mov edx, eax
mov ebx, 0xf76290b1
add ebx, 0x18b4914f
add ebx, dword [ebp - 0xc]
mov edi, 0xdc3e9ca1
sub edi, 0x47f39c33
add dword [ebp - 4], esi
mov esi, dword [ebx]
xor dword [ebp - 8], 0x74eacb6f
sub esi, edi
add dword [ebp - 4], edi
mov dword [edx], esi
add dword [ebp - 8], 0x61c04b80
add edx, 4
add ebx, 0xb2298808
add ebx, 0x4dd677fc
loop 0x100b00fe
add eax, 0xbba1e84a
sub eax, 0xbba0ca6b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x95b0b2f1
add ecx, 0x7a4f4d0f
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x10019832
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10019854
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10019904
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10019877
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10019879
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x100198f5
jg 0x1001988c
test esi, esi
je 0x100198f5
test eax, eax
jl 0x100198cc
jg 0x10019896
test ebp, ebp
je 0x100198cc
cmp edi, eax
jg 0x100198a6
jl 0x100198a0
cmp esi, ebp
jae 0x100198a6
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov eax, dword [ebx + 0x30]
add ecx, ebp
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
jmp 0x100198d0
mov ecx, dword [esp + 0x1c]
test edi, edi
jl 0x100198f5
jg 0x100198da
test esi, esi
je 0x100198f5
cmp dword [ebx + 0x4c], 0
je 0x100198f5
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc

Function at 0x1001ba36
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1001ba45
pop dword [ebp - 0x30]
mov eax, 0x1001ba45
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x37218
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x3ff2
xor ebx, ebx
add ebx, eax
mov edx, 0x2a8defb2
add edx, 0xe5764e4e
add edx, dword [ebp - 0x30]
mov edi, 0x53d4759d
sub dword [ebp - 0x2c], 0x125ac13
mov esi, dword [edx]
add esi, edi
sub dword [ebp - 0x14], edi
mov dword [ebx], esi
xor dword [ebp - 0xc], 0x39e2cc03
add ebx, 4
add edx, 4
loop 0x1001ba90
add eax, 0x4408bdee
sub eax, 0x4407cb53
mov ebx, eax
add eax, 0xf5c151b8
sub eax, 0xf5c151b3
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x401c66
pop dword [ebp - 0x10]
mov eax, 0x401c66
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x1c331176
sub dword [ebp - 0x20], 0xcde0cc2b
mov dword [ebp - 0x1c], 0xad943a3a
add dword [ebp - 0x1c], 0x849f120b
mov dword [ebp - 0x18], 0x4753750f
sub dword [ebp - 0x18], 0xfb0730e1
mov dword [ebp - 0x14], 0xb263aa85
add dword [ebp - 0x14], 0x4d9c557b
lea eax, [ebp - 0x20]
push eax
mov eax, 0x7048b317
sub eax, 0x700882c3
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xa29c771a
add dword [ebp - 0x20], 0xd1d5f23c
mov dword [ebp - 0x1c], 0x2297de54
sub dword [ebp - 0x1c], 0xe12b7cdf
mov dword [ebp - 0x18], 0xc6c919c9
sub dword [ebp - 0x18], 0x6359ad5d
mov dword [ebp - 0x14], 0x288fa8a9
sub dword [ebp - 0x14], 0x288fa8a9
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x4d6bd6f0
sub eax, 0x4d2ba6c4
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x35026
push 0
call eax
mov ecx, 0x6dfc6d5a
sub ecx, 0x6dfc2b3d
mov ebx, eax
mov esi, 0x407000
add esi, dword [ebp - 0x10]
mov edi, 0xae16b83d
add edi, 0xb43af704
xor dword [ebp - 8], eax
mov edx, dword [esi]
add dword [ebp - 8], edi
xor edx, edi
mov dword [ebx], edx
mov dword [ebp - 4], 0xe0645ad3
add ebx, 0x39ca2068
sub ebx, 0x39ca2064
add esi, 0x337684d6
sub esi, 0x337684d2
loop 0x401d7d
add eax, 0xaa8f0f8a
sub eax, 0xaa8e1443
mov ebx, eax
add eax, 5
mov ecx, 0x5cf7ba38
add ecx, 0xa34845c8
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x8731a1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add ecx, edx
stc
mov dword [esp], esp
cmc
pushal
mov dword [ebp - 0x10], ecx
rol ch, cl
mov ecx, dword [ebp + 0xc]
clc
mov word [esp + 0x18], si
stc
bt ecx, 0x18
cmp ecx, 0xffff
mov byte [esp + 4], bh
lea esp, [esp + 0x24]
jbe 0x75ad9a
neg di
shrd bx, cx, cl
mov edi, dword [edx + 0x24]
btr ebx, 0xc
and bx, 0xb3d3
add edi, eax
sar ecx, cl
bsf bx, bx
rcr ch, cl
ror bx, cl
mov ebx, dword [edx + 0x20]
pushal
shl cl, cl
call fcn.0086edba
invalid
stc
pushal
jmp 0x872bf6
push dword [esp]
lea esp, [esp + 0x24]
je 0x873b71
lea edx, [esi - 0x5fd660b4]
test dh, bl
test di, bp
adc esi, ebp
mov esi, dword [eax + 0x3c]
movsx dx, cl
stc
add esi, eax
shrd dx, sp, 1
shr dh, cl
mov edx, dword [esi + 0x78]
bt cx, sp
pushal
bt ebx, eax
test edx, edx
mov dword [esp + 0x10], 0x498ae491
jmp 0x87547d
test eax, eax
mov byte [esp], 0x81
lea esp, [esp + 8]
je 0x764f60
je 0x873b71
sal dl, 7
mov esi, dword [eax + 0x3c]
not dh
dec dx
cmc
add esi, eax
not edx
push 0x97f797a8
rcr dl, 7
bsr dx, bp
mov edx, dword [esi + 0x78]
clc
test edx, edx
pushfd
lea esp, [esp + 8]
je 0x873b71
ror ch, cl
bt esp, 8
btr cx, 7
add edx, eax
sar cx, cl
mov ecx, dword [esi + 0x7c]
cmc
push 0x3a621c46
jmp 0x757a92
lea esp, [esp + 0x20]
je 0x873b71
mov ecx, 0x393986a4
ror cl, cl
adc cx, 0x5843
add edx, eax
bsr cx, si
btc cx, di
bswap cx
mov ecx, dword [esi + 0x7c]
call fcn.007633d4
invalid
Function at 0x994c69
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0x92ddffc8
add dl, byte [ecx + esi]
inc eax
js 0x994c34
sbb dword [esi + esi*2 + 0x33b43b2c], esi
ret 0x900
out 0x1f, al
or byte [0x180e1424], dl
lodsb al, byte [esi]
std
dec esi
dec ecx
jnp 0x994c00
xchg ebp, eax
mov eax, 0x14c13017
pop ecx
sub eax, 0x53a91a02
into
movsb byte es:[edi], byte [esi]
wait
in eax, 0x27
xor eax, 0x89fa3066
pop edi
insb byte es:[edi], dx
mul dword [ecx + 0x73]
bt dword [ebx - 0x5f], 0x90
invalid
xor ah, ch
adc al, al
call 0x9935de
aaa
in eax, 0x45
rol byte [0x54d7e9b1], 0xa3
jp 0x994cc5
mov es, ecx
cwde
invalid
mov edx, 0x56567e35
loop 0x994c5b
inc edx
xor eax, 0x811fb187
dec ebp
add al, 0xd6
js 0x994c40
retf 0xd518
cld
jl 0x994c67
cmp ebx, dword [esi - 0x7c]
mov eax, es
fcmovne st(0), st(3)
mov cl, byte [edx + 7]
jbe 0x994cad
sub eax, 0xaf57d507
xchg ebx, eax
movsd dword es:[edi], dword [esi]
or eax, 0x73cafea2
mov esi, 0xd760e779
loopne 0x994d5b
pop esi
or byte [esi + 0x42], ah
push 0xcef56610
fsub dword [eax]
dec byte cs:[ebp + 0x55]
fadd qword [ebx + 0x40]
adc ebx, edx
push bp
xchg ebx, eax
adc al, dh
nop
invalid
jg 0x994d39
jns 0x994d50
or dword [edx + 0x7b], edx
cld
sbb byte [eax + ecx*2 - 0x647257a1], bl
insd dword es:[edi], dx
ljmp 0xe4ec
in al, dx
in al, 0xa3
outsd dx, dword [esi]
cld
imul edi, dword [ebx - 0x24], 0x31
lcall 0x9594, 0x1da10f8
cmp bh, byte [eax]
add edi, dword [edi - 0x7d]
inc ebp
scasd eax, dword es:[edi]
call dword [edi + ebx*8 - 0x6e]
lodsb al, byte [esi]
movsb byte es:[edi], byte [esi]
jb 0x994d5f
invalid
out dx, al
clc
xor eax, 0x651eaa7c
xor dword [ebp - 0x10], ebx
stosb byte es:[edi], al
push ds
xor dword gs:[ebp - 0x10], ebx
jge 0x994d23
mov esp, 0x26797ffa
push 0x1b
cli
jg 0x994de3
push 0x1b
pop edi
shr byte [eax - 0x6f], cl
fstp dword [edx]
je 0x994d66
xchg edi, eax
lodsd eax, dword [esi]
or al, 0x98
fisttp qword [ebx]
nop
invalid
stosb byte es:[edi], al
daa
aaa
and byte [ebp + 0x53], ch
imul esp, dword [eax - 0x2805d9f], 0x4e
sbb byte [eax - 0x615d239d], ah
adc eax, 0x18dbbae0
rcl esi, 0x81
xchg byte [edi + 0x29a0ddea], bh
stosd dword es:[edi], eax
sal byte [ebp - 0x5536dfc3], cl
aam 0xc3
sbb esp, dword gs:[eax]
mul byte [ebp - 0x63fec152]
cmp byte cs:[edi + esi*2], ah
xor dh, byte [eax]
lodsb al, byte [esi]
wait
invalid
Function at 0x40224c
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
xor edi, edi
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x402328
cmp dword [ebp + 0x14], ebx
je 0x40229d
push ebx
push ebx
push dword [ebp + 0x14]
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
cmp eax, 0xffffffff
jne 0x40229d
cmp dword [0x40873c], ebx
jl 0x40229d
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.004028a2
pop ecx
mov dword [0x40873c], 0xffffffeb
push 1
push dword [esi]
call sub.WSOCK32.dll_shutdown
mov edi, eax
cmp edi, 0xffffffff
je 0x40231e
push 1
pop edi
cmp edi, 0xffffffff
je 0x4022f4
push ebx
lea eax, [ebp - 0x400]
push 0x400
push eax
push dword [esi]
call sub.WSOCK32.dll_recv
cmp dword [0x408710], ebx
mov edi, eax
je 0x4022f0
cmp edi, ebx
jle 0x4022f2
mov eax, dword [0x407048]
cmp eax, 0xffffffff
je 0x4022f0
lea ecx, [ebp - 0x400]
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll__lwrite]
cmp edi, ebx
jne 0x4022b0
mov eax, dword [0x417ca4]
cmp dword [eax], ebx
je 0x40231e
lea eax, [ebp + 0x14]
push 4
push eax
push 0x80
push 0xffff
mov word [ebp + 0x14], 1
push dword [esi]
mov word [ebp + 0x16], bx
call sub.WSOCK32.dll_setsockopt
push dword [esi]
call sub.WSOCK32.dll_closesocket
or dword [esi], 0xffffffff
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40232f
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push edi
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
jne 0x40235a
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.004028a2
pop ecx
mov dword [0x40873c], 0xffffffe9
jmp 0x4023d8
push 0x33
push dword [esp + 0x14]
push dword [esp + 0x14]
push edi
call sub.WSOCK32.dll_WSAAsyncSelect
cmp eax, 0xffffffff
jne 0x402387
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.004028a2
pop ecx
mov dword [0x40873c], 0xffffffe8
jmp 0x4023cf
push esi
mov esi, dword [esp + 0xc]
push dword [esp + 0x18]
mov word [esi], 2
call sub.WSOCK32.dll_htons
push 0x10
push esi
push edi
mov word [esi + 2], ax
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
pop esi
jne 0x4023d8
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4023d8
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.004028a2
pop ecx
mov dword [0x40873c], 0xffffffe7
push edi
call sub.WSOCK32.dll_closesocket
or edi, 0xffffffff
mov eax, edi
pop edi
ret
Function at 0x4023dc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
xor ebx, ebx
cmp dword [0x408740], ebx
push esi
push edi
mov edi, 0x4103a0
je 0x402426
cmp byte [0x4103a0], bl
je 0x402433
push 9
pop esi
cmp dword [section..data], 0xffffffff
je 0x402454
test esi, esi
jle 0x402454
mov eax, esi
push 0
sub eax, ebx
push eax
push edi
push dword [section..data]
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x402437
add ebx, eax
cmp ebx, esi
jl 0x402406
jmp 0x402454
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test esi, esi
jne 0x4023f9
xor eax, eax
jmp 0x402461
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x402454
push eax
call fcn.004028a2
pop ecx
mov dword [0x40873c], 0xffffffe6
cmp ebx, esi
jne 0x40245f
and byte [0x4103a0], 0
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x402465
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [0x410384]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x20]
xor esi, esi
cmp eax, edi
mov ebx, 0x2733
jge 0x4024df
mov ecx, edi
push 0
sub ecx, eax
add eax, ebp
push ecx
push eax
push dword [esp + 0x20]
call sub.WSOCK32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
je 0x4024c0
test esi, esi
je 0x4024df
cmp dword [0x408740], 0
jne 0x4024b5
add dword [0x410384], esi
push esi
call fcn.00402660
pop ecx
mov eax, dword [0x410384]
cmp eax, edi
jl 0x402481
jmp 0x4024df
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, ebx
je 0x4024df
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.004028a2
pop ecx
mov dword [0x40873c], 0xffffffe0
cmp dword [0x408740], 0
jne 0x402659
add edi, 0xfffffa4c
cmp dword [0x410384], edi
jg 0x402510
cmp esi, 0xffffffff
jne 0x402508
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, ebx
jne 0x402510
test esi, esi
jne 0x402659
cmp dword [0x408710], 0
mov esi, ebp
jne 0x40262b
mov dword [0x408710], 1
mov al, byte [ebp]
cmp al, 0x20
je 0x40253a
cmp al, 9
je 0x40253a
mov al, byte [esi + 1]
inc esi
jmp 0x40252c
mov al, byte [esi]
cmp al, 0x20
je 0x402544
cmp al, 9
jne 0x402547
inc esi
jmp 0x40253a
cmp byte [esi], 0x32
je 0x4025f6
mov eax, dword [0x408b60]
mov dword [0x40873c], 0xfffffffd
test eax, eax
je 0x402623
cmp dword [0x408738], 0
je 0x402586
push str.ServerError
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x408b60]
add eax, 0xc
jmp 0x40259a
push str._r_n_r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x408b60]
add eax, 4
mov cl, byte [esi]
mov edx, esi
test cl, cl
je 0x4025c5
cmp cl, 0xd
je 0x4025c5
cmp cl, 0xa
je 0x4025c5
mov edi, eax
sub edi, dword [0x408b60]
cmp edi, 0xfa
jge 0x4025c5
mov byte [eax], cl
mov cl, byte [edx + 1]
inc eax
inc edx
jmp 0x40259e
and byte [eax], 0
cmp dword [0x408738], 0
je 0x402623
push 0x40743c
push dword [0x408b60]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [0x408b60]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add dword [0x408b60], eax
jmp 0x402623
mov al, byte [esi]
cmp al, 0xd
je 0x402600
cmp al, 0xa
jne 0x402619
mov al, byte [esi]
lea ecx, [esi + 1]
cmp al, byte [ecx]
je 0x40261c
cmp al, byte [esi + 2]
je 0x402620
cmp al, 0xd
jne 0x402614
mov esi, ecx
cmp byte [esi], 0xa
jne 0x4025f6
inc esi
jmp 0x4025f6
inc esi
inc esi
jmp 0x402623
add esi, 4
sub ebp, esi
add dword [0x410384], ebp
cmp dword [esp + 0x18], 0xffffffff
je 0x402652
push dword [0x410384]
push esi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll__lwrite]
cmp eax, 0xffffffff
jne 0x402652
mov dword [0x40873c], 0xfffffffc
and dword [0x410384], 0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret