joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4a1008], 0x8088405
inc edx
mov dword [ebx + 0x4a1008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf00
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf19
add dl, dl
jne 0x41cf3c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf8d
xor eax, eax
add dl, dl
jne 0x41cf49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d02a
add dl, dl
jne 0x41cf58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf79
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cf83
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf28
mov eax, 1
add dl, dl
jne 0x41cf9b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cf92
sub eax, ebx
mov ebx, 1
jne 0x41cfd9
mov ecx, 1
add dl, dl
jne 0x41cfbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cfca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfb6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cff0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cffb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfe7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d04b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf28
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f04c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x48553a
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f09b
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f0ba
mov ecx, edx
add ecx, ebx
jmp 0x41f0ba
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f0ba
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f12c
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f115
test esi, esi
jbe 0x41f12c
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f107
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f12c
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f0e4
jmp 0x41f12c
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f12c
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485541
ret
Function at 0x420284
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x48689f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202bf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202d8
lea eax, [ebp - 0x10]
mov edx, dword [0x4a3348]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202eb
lea eax, [ebp - 0x10]
mov edx, dword [0x4a3348]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4202f7
adc edx, 0
mov edx, dword [edx*4 + 0x4a2178]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420471
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420464
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420464
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420402
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420402
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420402
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420402
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420464
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420464
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420489
inc ebx
cmp ebx, 0x19
jne 0x4202b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4868a6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x4083a0
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x4091f0
call fcn.004089f8
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x40dcf8
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x4081c8
cmp eax, esi
jne 0x4081bb
xor esi, esi
inc esi
mov edi, esi
jmp 0x4081cb
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40819f
xor esi, esi
inc esi
cmp dword [0x40dcfc], esi
jne 0x4081dd
push 0x1f
call fcn.0057d000
pop ecx
jmp 0x408217
cmp dword [0x40dcfc], ebx
jne 0x408211
mov dword [0x40dcfc], esi
push 0x4012d8
push 0x4012cc
call fcn.004082fc
pop ecx
pop ecx
test eax, eax
je 0x408217
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4082ec
mov dword [0x40c798], esi
cmp dword [0x40dcfc], esi
jne 0x40823a
push 0x4012c8
push 0x4012b0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x40dcfc], 2
test edi, edi
jne 0x408247
xor eax, eax
mov ecx, 0x40dcf8
xchg dword [ecx], eax
cmp dword [0x40dd08], 0
je 0x408273
push 0x40dd08
call fcn.00408850
pop ecx
test eax, eax
je 0x408273
push ebx
push 2
push ebx
mov esi, dword [0x40dd08]
mov ecx, esi
call dword [0x40e1a4]
call esi
push dword [0x40c7a4]
push dword [0x40c7a0]
push dword [0x40c79c]
call fcn.004042e2
add esp, 0xc
mov dword [0x40c794], eax
cmp dword [0x40c7ac], 0
jne 0x4082d1
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x40c798], 0
jne 0x4082e5
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x40c794]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.00408945
jmp 0x408183

Function at 0x408734
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x409230
call fcn.004089f8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x408794
cmp eax, 0xffffffff
je 0x408794
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40878d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40878d
cmp edx, 0x10000000
jae 0x40878d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40878a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x408800
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40883e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x408836
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x408840
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x408826
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40b998
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
push ebp
push ebx
mov edx, 0x43
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40b99f
call fcn.00433d00
mov edx, dword [esp + 0x118]
lea ecx, [esp]
call fcn.0040b000
mov eax, 0x59f09c
push 0x59b570
push 0x10
push eax
call fcn.0040b010
mov ebx, dword [0x59f094]
cmp ebx, 3
jne 0x40ba39
push dword [esp]
call fcn.0040c630
mov dword [esp + 4], eax
push dword [esp + 4]
call sub.USER32.DLL_IsWindow
and eax, eax
je 0x40ba37
push 0x104
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
call sub.USER32.DLL_GetWindowTextA
push dword [esp + 4]
lea ebp, [0x59f09c]
pop eax
mov dword [ebp + 8], eax
lea edx, [esp + 8]
call fcn.00433b20
push eax
push 0x104
call fcn.00434090
lea eax, [ebp]
push eax
call fcn.00433b60
jmp 0x40ba4a
push 0x59f09c
lea eax, [0x40ba68]
push eax
call sub.USER32.DLL_EnumWindows
mov eax, 0x59f09c
jmp 0x40ba53
push dword [esp]
call fcn.00433da0
add esp, 0x10c
pop ebx
pop ebp
ret 4

Function at 0x40d10a
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [esp + 0x10], ebx
je 0x40d159
push dword [esp + 0x10]
push 0x40d088
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x59f0c0]
cmp esi, ebx
je 0x40d1ad
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x40d151
cmp byte [esi + 0x10], bl
je 0x40d151
push 3
push ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, edi
cmp edi, ebx
jne 0x40d12e
jmp 0x40d1ad
mov esi, dword [0x59f0c0]
cmp esi, ebx
je 0x40d1ad
push ebp
mov ebp, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x40d1a6
cmp byte [esi + 0x11], bl
je 0x40d183
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], bl
je 0x40d199
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push edi
push 0x59f0c0
call fcn.00433a3d
pop ecx
pop ecx
mov esi, ebp
cmp ebp, ebx
jne 0x40d164
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x424ab8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov eax, 0x1000
xor esi, esi
push eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], esi
call fcn.00434110
mov edi, dword [ebp + 8]
mov ebx, eax
mov eax, dword [edi + 0x14]
test eax, eax
je 0x424b10
push eax
push ebx
call sub.MSVCRT.dll_strcpy
push dword [edi + 0x14]
call sub.MSVCRT.dll_strlen
add esp, 0xc
push dword [edi + 0x14]
mov esi, eax
push 0
push dword [0x59efb8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [edi + 0x14], 0
and dword [edi + 0x1c], 0
mov eax, 0x1000
sub eax, esi
mov dword [ebp + 8], eax
mov eax, dword [ebp - 4]
jmp 0x424b30
mov cl, byte [ebx + eax]
cmp cl, 0xd
je 0x424b36
cmp cl, 0xa
je 0x424b36
inc eax
mov dword [ebp - 4], eax
cmp eax, esi
jl 0x424b1f
jmp 0x424b9e
cmp byte [ebx + eax], 0xd
mov dword [ebp - 0x10], eax
jne 0x424b50
lea ecx, [esi - 1]
cmp eax, ecx
je 0x424b9e
inc eax
cmp byte [ebx + eax], 0xa
mov dword [ebp - 4], eax
jne 0x424b54
inc eax
mov dword [ebp - 4], eax
cmp eax, esi
jge 0x424b94
mov ecx, esi
sub ecx, eax
mov dword [ebp - 8], ecx
inc ecx
push ecx
push 0
push dword [0x59efb8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp - 8]
mov ecx, dword [ebp - 4]
add ecx, ebx
push ecx
push eax
mov dword [edi + 0x14], eax
call sub.MSVCRT.dll_strncpy
mov eax, dword [edi + 0x14]
add esp, 0xc
sub esi, dword [ebp - 4]
mov byte [esi + eax], 0
mov eax, dword [ebp - 8]
mov dword [edi + 0x1c], eax
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x424bf2
cmp dword [ebp + 8], 0x200
jge 0x424bc7
push dword [ebp + 0xc]
lea eax, [esi + 0x1000]
push eax
mov dword [ebp + 8], 0x1000
mov dword [ebp - 0xc], eax
call fcn.00434110
mov ebx, eax
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
lea eax, [ebx + esi]
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x424bf2
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x424bf2
add esi, eax
sub dword [ebp + 8], eax
jmp 0x424b1a
mov eax, dword [ebp - 0xc]
sub eax, esi
push eax
call fcn.004341b0
pop edi
mov byte [ebx + esi], 0
pop esi
pop ebx
leave
ret 8
Function at 0x424c08
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x18]
xor ebx, ebx
push edi
xor edi, edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x424c2e
push eax
call sub.MSVCRT.dll_strlen
pop ecx
mov edi, eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov eax, dword [ebp - 8]
push dword [ebp + 0xc]
add eax, edi
push eax
call fcn.00434110
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x424c75
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push dword [esi + 0x18]
push ebx
push dword [0x59efb8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi + 0x18], ebx
cmp dword [ebp - 8], ebx
jle 0x424c91
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, edi
push eax
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
lea ecx, [edi + eax]
test ecx, ecx
jle 0x424d13
mov ecx, dword [ebp + 8]
mov dl, byte [ebx + ecx]
cmp dl, 0xd
je 0x424cb5
cmp dl, 0xa
je 0x424cb5
inc ebx
lea ecx, [edi + eax]
cmp ebx, ecx
jl 0x424c9b
jmp 0x424d13
cmp byte [ebx + ecx], 0xd
mov dword [ebp + 0xc], ebx
jne 0x424cc5
inc ebx
cmp byte [ebx + ecx], 0xa
jne 0x424cc6
inc ebx
lea ecx, [edi + eax]
cmp ebx, ecx
jge 0x424d11
mov ecx, edi
sub ecx, ebx
lea eax, [ecx + eax + 1]
push eax
push 0
push dword [0x59efb8]
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
push edx
add ecx, ebx
push ecx
push eax
mov dword [esi + 0x18], eax
call sub.MSVCRT.dll_strncpy
mov ecx, dword [esi + 0x18]
mov eax, edi
sub eax, ebx
add esp, 0xc
add eax, dword [ebp - 4]
mov byte [eax + ecx], 0
mov eax, dword [ebp - 4]
xor ebx, ebx
lea ecx, [edi + eax]
cmp ebx, ecx
jl 0x424d72
test edi, edi
jle 0x424d37
test eax, eax
jne 0x424d37
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x424d34
mov dword [ebp + 0xc], edi
jmp 0x424d72
mov eax, dword [ebp - 4]
add eax, edi
test eax, eax
jle 0x424d6e
inc eax
push eax
push 0
push dword [0x59efb8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 4]
add ecx, edi
push ecx
push dword [ebp + 8]
mov dword [esi + 0x18], eax
push eax
call sub.MSVCRT.dll_strncpy
mov eax, dword [ebp - 4]
mov ecx, dword [esi + 0x18]
add esp, 0xc
add eax, edi
mov byte [eax + ecx], 0
and dword [ebp + 0xc], 0
sub edi, dword [ebp + 0xc]
add edi, dword [ebp - 8]
push edi
call fcn.004341b0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov byte [eax + ecx], 0
pop ebx
leave
ret 8
Function at 0x428416
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
test eax, eax
jne 0x428432
inc eax
jmp 0x428434
xor eax, eax
push str.ws2_32.dll
mov word [0x59fc80], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x59f23c], eax
test eax, eax
je 0x4284a7
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.getaddrinfo
push eax
call esi
push str.freeaddrinfo
push dword [0x59f23c]
mov dword [0x59f248], eax
call esi
push str.getnameinfo
push dword [0x59f23c]
mov dword [0x59f24c], eax
call esi
cmp dword [0x59f248], 0
mov dword [0x59f250], eax
pop esi
je 0x4284a7
cmp dword [0x59f24c], 0
je 0x4284a7
test eax, eax
je 0x4284a7
mov dword [0x59f244], 1
push 0x42836e
push 0x10
push 0x2c
call fcn.00433710
mov dword [0x59f240], eax
movsx eax, word [0x59fc80]
add esp, 0x190
ret

Function at 0x4284c8
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0xff
lea eax, [ebp - 0x100]
push eax
mov dword [0x59fc84], esi
mov dword [0x59fc94], esi
mov dword [0x59fc98], edi
mov dword [0x59fc9c], esi
call dword [sym.imp.WSOCK32.DLL_gethostname]
test eax, eax
jne 0x428574
cmp edi, 0x10000000
jne 0x428550
cmp dword [0x59f244], esi
je 0x428574
mov eax, dword [0x59f254]
cmp eax, esi
je 0x42852c
push eax
call dword [0x59f24c]
mov dword [0x59f254], esi
push 0x59f254
push esi
push esi
lea eax, [ebp - 0x100]
push eax
call dword [0x59f248]
test eax, eax
jne 0x428574
mov eax, dword [0x59f254]
mov dword [0x59fc9c], eax
jmp 0x428571
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.WSOCK32.DLL_gethostbyname]
cmp eax, esi
je 0x428574
push 0x10
push eax
push 0x59fc88
call sub.MSVCRT.dll_memcpy
add esp, 0xc
xor esi, esi
inc esi
pop edi
mov eax, esi
pop esi
leave
ret 4
Function at 0x428a59
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 1
jne 0x428a7b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 8]
call dword [sym.imp.WSOCK32.DLL_send]
jmp 0x428aba
push 2
pop eax
mov word [ebp - 0x10], ax
mov eax, dword [esi + 4]
mov dword [ebp - 0xc], eax
movzx eax, word [esi + 8]
push eax
call dword [sym.imp.WSOCK32.DLL_htons]
mov word [ebp - 0xe], ax
mov eax, dword [esi + 0xc]
test eax, eax
je 0x428aa2
mov eax, dword [eax]
jmp 0x428aa5
mov eax, dword [esi + 0x10]
push 0x10
lea ecx, [ebp - 0x10]
push ecx
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.WSOCK32.DLL_sendto]
pop esi
leave
ret 0xc

Function at 0x428abf
Capabilities:
Get socket status
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x924
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi], 1
mov dword [ebp - 4], edi
jne 0x428b39
lea eax, [ebp + 8]
push eax
push 0x4004667f
push dword [esi + 8]
call dword [sym.imp.WSOCK32.DLL_ioctlsocket]
test eax, eax
jne 0x428b30
cmp dword [ebp + 8], edi
jle 0x428afe
mov dword [ebp - 4], 2
jmp 0x428b97
mov eax, dword [esi + 8]
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x10]
push eax
push edi
push edi
lea eax, [ebp - 0x124]
push eax
push 1
mov dword [ebp - 0x124], 1
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.WSOCK32.DLL_select]
test eax, eax
je 0x428b97
mov dword [ebp - 4], 4
jmp 0x428b97
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
push edi
push 0x800
lea eax, [ebp - 0x924]
push eax
push dword [esi + 0x10]
mov dword [ebp - 8], 0x10
call dword [sym.imp.WSOCK32.DLL_recvfrom]
mov dword [ebp + 8], eax
cmp eax, edi
jle 0x428b97
push eax
push edi
push dword [0x59efb8]
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
push ecx
mov dword [esi + 0x18], ecx
lea ecx, [ebp - 0x924]
push ecx
push eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4

Function at 0x428ba0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi], 1
jne 0x428bc3
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 8]
call dword [sym.imp.WSOCK32.DLL_recv]
mov edi, eax
jmp 0x428c04
cmp dword [esi + 0x14], edi
je 0x428c04
mov eax, dword [esi + 0x18]
mov edi, dword [ebp + 0x10]
cmp edi, eax
jle 0x428bd4
mov edi, eax
push edi
push dword [esi + 0x1c]
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0x18], edi
mov eax, dword [esi + 0x18]
add dword [esi + 0x1c], edi
add esp, 0xc
test eax, eax
jne 0x428c04
push dword [esi + 0x14]
push eax
push dword [0x59efb8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [esi + 0x14], 0
mov eax, edi
pop edi
pop esi
pop ebp
ret 0xc