joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100377c9
Capabilities:
Delete registry key

Disassembly:
mov eax, 0x10059a76
call fcn.100582b8
sub esp, 0x24
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], esi
je 0x100378ac
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x10037804
push ecx
push 0x2d75
xor dl, dl
call fcn.1003721b
pop ecx
pop ecx
mov dword [ebp - 0x24], 0xed6
cmp dword [ebp - 0x24], 0x12b8
jle 0x10037871
xor edi, edi
mov dword [ebp - 0x20], edi
xor esi, esi
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 0x18], 0x71b9
mov ecx, ebx
mov dword [ebp - 0x2c], edi
xor esi, esi
sar edi, cl
mov ecx, esi
mov eax, edi
sar eax, cl
mov ecx, 0x10072ab8
cdq
push edx
push eax
call fcn.10001ac8
inc esi
cmp esi, 0xcf5
jl 0x10037830
mov esi, dword [ebp - 0x1c]
add ebx, esi
dec dword [ebp - 0x18]
mov edi, dword [ebp - 0x20]
jne 0x10037827
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x69da
jl 0x1003781e
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x15a9
jl 0x10037819
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0xdd5
jge 0x1003788d
mov edx, str.ddmfbcsdo_enpandxhb_kfakmuu_kfjqnr_oiqini_qprw_tmeqhk_kajxfauo_egtpftgu_lcswvhl_dpdp_lmpucxp
mov ecx, 0x10072ab8
call fcn.1000350a
jmp 0x10037954
mov dword [ebp - 0x20], 0x700d
cmp dword [ebp - 0x20], 0x70b3
jle 0x1003790f
xor edi, edi
mov dword [ebp - 0x24], edi
xor ebx, ebx
and dword [ebp - 0x2c], 0
mov esi, edi
mov edi, dword [ebp - 0x2c]
mov ecx, ebx
shl esi, cl
mov eax, esi
mov ecx, 0x10072ab8
and eax, edi
cdq
push edx
push eax
call fcn.10001ac8
inc edi
cmp edi, 0x2766
jl 0x100378d0
mov edi, dword [ebp - 0x24]
inc ebx
cmp ebx, 0x6d23
jl 0x100378c3
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x2fec
jl 0x100378c1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, dword [ebp - 0x28]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x6f7a
jge 0x1003794d
mov edx, str.zwljzi_plvk_wceofazss_hhzsijx_isps_bwmo_pmkjvymq_wmliegzy_ojxacr_uhv_qvpb_rogyril_lduqsmm_lnhzlaoo
mov ecx, 0x10072ab8
call fcn.1000350a
jmp 0x1003794d
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
sub dword [esi], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037aee
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x10059a80
call fcn.100582b8
sub esp, 0x20
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10037c31
xor ecx, ecx
inc ecx
xor ebx, ebx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 0xea2a3b3f
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x2c], 0x8d9dcee3
mov dword [ebp - 0x1c], ebx
jmp 0x10037b3c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x24], 0x1476
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10037b2e
dec dword [ebp - 0x20]
jne 0x10037b6b
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x24], ebx
je 0x10037b5a
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x8af8
jle 0x10037b6b
mov ecx, ebx
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp eax, ecx
setge dl
xor ecx, ecx
neg edx
cmp edx, 0x5b3847d2
setge cl
xor eax, eax
cmp ecx, 0xaf86
setg al
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x2d8d
cmp dword [ebp - 0x20], 0x2fda
jle 0x10037bdd
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov edi, ebx
lea ebx, [edi + esi]
mov esi, 0x190
mov eax, ebx
mov ecx, 0x10072ab8
cdq
push edx
push eax
call fcn.10001ac8
dec ebx
dec esi
jne 0x10037baf
mov esi, dword [ebp - 0x28]
inc edi
cmp edi, 0x61d4
jl 0x10037ba7
inc esi
mov dword [ebp - 0x28], esi
push 0
pop ebx
cmp esi, 0x5ad5
jl 0x10037ba5
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10037bfa
push ebx
push ebx
push ebx
push ebx
push 0x17f6
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x20], 0x29f3
jge 0x10037c15
mov edx, str.tsevbte_pasbbjd_qgtgaxn_gswau_fenko
mov ecx, 0x10072ab8
call fcn.1000350a
jmp 0x10037c37
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e00b768
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x14]
xor esi, esi
movzx eax, word [ebx + 0x2e]
mov edx, dword [ebp + 0xc]
cmp word [edx + eax], 0xffff
sete al
and eax, 1
movzx edx, word [ebx + 0x2e]
mov ecx, dword [ebp + 8]
cmp word [ecx + edx], 0xffff
sete dl
and edx, 1
cmp edx, eax
je 0x4e00b7a8
mov esi, 1
jmp 0x4e00b8f9
test eax, eax
je 0x4e00b7b3
xor esi, esi
jmp 0x4e00b8f9
movzx eax, word [ebx + 0x2c]
push eax
movzx edx, word [ebx + 0x2a]
add edx, dword [ebp + 8]
push edx
movzx ecx, word [ebx + 0x2a]
add ecx, dword [ebp + 0xc]
push ecx
call fcn.4e02d3f0
add esp, 0xc
test eax, eax
je 0x4e00b8f9
mov eax, dword [ebp + 0x10]
cmp word [eax + 0x22], 1
jne 0x4e00b87c
mov edx, dword [ebp + 0x10]
cmp word [edx + 0x24], 0x1f
jne 0x4e00b87c
movzx ecx, word [ebx + 0x2a]
add ecx, dword [ebp + 8]
push ecx
call fcn.4e02d354
pop ecx
mov edi, eax
movzx eax, word [ebx + 0x2c]
dec eax
cmp edi, eax
jb 0x4e00b817
mov esi, 1
jmp 0x4e00b8f9
push edi
movzx eax, word [ebx + 0x2a]
add eax, dword [ebp + 8]
push eax
movzx edx, word [ebx + 0x2a]
add edx, dword [ebp + 0xc]
push edx
call fcn.4e02d3f0
add esp, 0xc
test eax, eax
je 0x4e00b83e
mov esi, 1
jmp 0x4e00b8f9
movzx eax, word [ebx + 0x2a]
add eax, dword [ebp + 0xc]
add eax, edi
xor edx, edx
jmp 0x4e00b859
cmp byte [eax], 0x20
je 0x4e00b857
mov esi, 1
jmp 0x4e00b864
inc edx
inc eax
movzx ecx, word [ebx + 0x2c]
sub ecx, edi
dec ecx
cmp edx, ecx
jb 0x4e00b84b
test esi, esi
jne 0x4e00b8f9
cmp byte [eax], 0
je 0x4e00b8f9
mov esi, 1
jmp 0x4e00b8f9
mov eax, dword [ebp + 0x10]
mov dx, word [eax + 0x22]
sub dx, 7
je 0x4e00b890
dec dx
je 0x4e00b8cc
jmp 0x4e00b8f4
movzx ecx, word [ebx + 0x2a]
mov eax, dword [ebp + 0xc]
fld qword [eax + ecx]
movzx edx, word [ebx + 0x2a]
mov ecx, dword [ebp + 8]
fsub qword [ecx + edx]
call fcn.4e0315b8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cdq
xor eax, edx
sub eax, edx
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fcomp qword [0x4e00b904]
fnstsw ax
sahf
jb 0x4e00b8f9
mov esi, 1
jmp 0x4e00b8f9
movzx eax, word [ebx + 0x2c]
push eax
movzx edx, word [ebx + 0x2a]
add edx, dword [ebp + 8]
push edx
movzx ecx, word [ebx + 0x2a]
add ecx, dword [ebp + 0xc]
push ecx
call fcn.4e02d3bc
add esp, 0xc
test eax, eax
je 0x4e00b8f9
mov esi, 1
jmp 0x4e00b8f9
mov esi, 1
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0x10
Function at 0x4e01189a
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
cmp dword [ebp + 8], 0
je 0x4e0118bf
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x52]
mov edx, dword [ecx + 0x191]
mov ecx, dword [edx + 8]
jmp 0x4e0118c1
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, dword [ebp + 0xc]
add ebx, 6
xor edi, edi
xor esi, esi
jmp 0x4e0118d3
inc esi
sar eax, 1
test eax, eax
je 0x4e0118e6
movzx edx, si
mov ecx, dword [edx*4 + 0x4e042860]
cmp byte [ecx], 0
jne 0x4e0118d0
movzx eax, si
mov eax, dword [eax*4 + 0x4e042860]
cmp byte [eax], 0
je 0x4e011a66
push dword [ebp + 0x10]
call fcn.4e02d354
pop ecx
mov word [ebp - 8], ax
mov word [ebp - 0xa], 0
movzx edx, si
push dword [edx*4 + 0x4e042860]
push 0x4e042a1b
push ebx
call fcn.4e0300e0
add esp, 0xc
add word [ebp - 0xa], ax
cmp dword [ebp - 4], 0
je 0x4e011949
push dword [ebp - 4]
push 0x4e042a20
movzx ecx, word [ebp - 0xa]
add ecx, ebx
push ecx
call fcn.4e0300e0
add esp, 0xc
add word [ebp - 0xa], ax
cmp dword [ebp + 0x14], 0
je 0x4e01198a
push dword [ebp + 8]
lea eax, [ebp - 6]
push eax
call fcn.4dff4350
mov esi, eax
test eax, eax
je 0x4e01198a
cmp word [ebp - 6], 0
jne 0x4e01198a
movzx edx, word [ebp - 8]
inc edx
push edx
call sub.IDAPI32.dll__OsMalloc
pop ecx
mov edi, eax
test edi, edi
je 0x4e01198a
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 0x10]
push edi
push esi
call sub.IDAPI32.dll_OsLdOemToAnsi
test edi, edi
je 0x4e0119ad
movzx edx, word [ebp - 0xa]
mov ecx, 0x2000
sub ecx, edx
dec ecx
push ecx
push edi
movzx eax, word [ebp - 0xa]
add eax, ebx
push eax
call fcn.4e02d4a8
add esp, 0xc
jmp 0x4e0119cc
movzx edx, word [ebp - 0xa]
mov ecx, 0x2000
sub ecx, edx
dec ecx
push ecx
push dword [ebp + 0x10]
movzx eax, word [ebp - 0xa]
add eax, ebx
push eax
call fcn.4e02d4a8
add esp, 0xc
mov byte [ebx + 0x1fff], 0
mov dx, word [ebp - 8]
add dx, word [ebp - 0xa]
mov ecx, dword [ebp + 0xc]
mov word [ecx + 4], dx
push 0
push dword [ebp + 0xc]
push ebx
call fcn.4e02d354
pop ecx
add ax, 7
push eax
push 0x1b
push 1
push 0
call sub.IDAPI32.dll_ExecCallBack
mov byte [ebx + 0xff], 0
mov si, 0xff
sub si, word [ebp - 0xa]
jmp 0x4e011a5b
push ebx
call sub.KERNEL32.dll_OutputDebugStringA
cmp si, word [ebp - 8]
jb 0x4e011a20
mov byte [ebx], 0
jmp 0x4e011a56
test edi, edi
je 0x4e011a3a
push 0xfe
movzx eax, si
add eax, edi
push eax
push ebx
call fcn.4e02d4a8
add esp, 0xc
jmp 0x4e011a4f
push 0xfe
movzx edx, si
add edx, dword [ebp + 0x10]
push edx
push ebx
call fcn.4e02d4a8
add esp, 0xc
mov byte [ebx + 0xff], 0
add si, 0xff
push ebx
call fcn.4e02d354
pop ecx
test eax, eax
jne 0x4e011a0f
test edi, edi
je 0x4e011a71
push edi
call sub.IDAPI32.dll__OsFree
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4e0312a8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.4e030cd8
test byte [ebp + 0xd], 0xc0
jne 0x4e0312cc
mov eax, dword [0x4e046554]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4e0312d9
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4e031306
je 0x4e031318
sub ecx, 0x100
je 0x4e031326
sub ecx, 0x100
je 0x4e03132d
sub ecx, 0x100
je 0x4e03131f
jmp 0x4e031334
sub ecx, 0x600
je 0x4e03132d
sub ecx, 0x100
je 0x4e031318
jmp 0x4e031334
mov edi, 1
jmp 0x4e031339
mov edi, 2
jmp 0x4e031339
mov edi, 4
jmp 0x4e031339
mov edi, 5
jmp 0x4e031339
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4e031360
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4e046a98]
test al, 0x80
je 0x4e031359
mov ebx, 0x80
jmp 0x4e031372
mov ebx, 1
jmp 0x4e031372
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4e031372
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4e031384
je 0x4e03138d
dec eax
je 0x4e031396
jmp 0x4e03139f
mov dword [ebp - 4], 0x80000000
jmp 0x4e0313ae
mov dword [ebp - 4], 0x40000000
jmp 0x4e0313ae
mov dword [ebp - 4], 0xc0000000
jmp 0x4e0313ae
push 1
call fcn.4e031098
pop ecx
mov ebx, eax
jmp 0x4e03149a
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4e0313ca
sub eax, 0x10
je 0x4e0313d1
sub eax, 0x10
je 0x4e0313da
sub eax, 0x10
je 0x4e0313e3
jmp 0x4e0313e3
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4e0313ea
mov dword [ebp - 8], 1
jmp 0x4e0313ea
mov dword [ebp - 8], 2
jmp 0x4e0313ea
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4e031453
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4e031448
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x4e031448
add ebx, 0xffffffb2
push ebx
call fcn.4e031098
pop ecx
mov ebx, eax
jmp 0x4e03149a
mov edi, esi
push edi
call fcn.4e03120c
pop ecx
test eax, eax
je 0x4e031467
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4e031473
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.4e030dd8
add esp, 8
mov ebx, eax
inc eax
jne 0x4e03149a
push 4
call fcn.4e031098
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
call fcn.4e030d0c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e033154
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x4e033530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x4e046f9c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4e0335e8
cmp byte [0x4e035059], 0
je 0x4e0335a2
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.4e02d558
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4e03358b
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.4e02d558
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4e03358b
lea ebx, [ebp - 0x54]
jmp 0x4e03358c
inc ebx
call fcn.4e0334e8
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x4e033609
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4e046fa0
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.4e02d354
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4e046fa3
push ebx
call sub.KERNEL32.dll_WriteFile
jmp 0x4e033609
cmp dword [0x4e046f9c], 0xffffffff
je 0x4e033609
mov eax, dword [0x4e046f9c]
test eax, eax
je 0x4e033609
cmp byte [eax], 0
je 0x4e033609
push esi
push eax
call fcn.4e033698
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e033e30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov dword [ebp - 8], 1
mov dword [ebp - 4], edi
cmp esi, 1
jne 0x4e033ed2
mov eax, dword [0x4e047550]
inc dword [0x4e047550]
test eax, eax
jne 0x4e033f45
call sub.KERNEL32.dll_GetEnvironmentStrings
mov dword [0x4e047528], eax
mov edx, dword [ebp + 0x10]
mov dword [0x4e035062], edx
cmp dword [0x4e047024], 0
je 0x4e033ea2
call fcn.4e033b58
mov ebx, eax
test eax, eax
je 0x4e033ea2
mov edx, dword [ebx]
cmp dword [ebx + edx*4 + 4], 0xffffffff
je 0x4e033ea2
mov ecx, dword [ebx]
inc dword [ebx]
mov dword [ebx + ecx*4 + 4], edi
jmp 0x4e033f45
xor eax, eax
mov dword [0x4e047024], eax
jmp 0x4e033ead
call ebx
push 0
lea edx, [ebp - 8]
push edx
call fcn.4e033b60
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4e033eab
mov edx, dword [ebp + 0x18]
push edx
push esi
mov ecx, dword [ebp + 0x10]
push ecx
call dword [edi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4e033f45
test esi, esi
jne 0x4e033f36
dec dword [0x4e047550]
jne 0x4e033f0e
mov eax, dword [ebp + 0x18]
push eax
push esi
mov edx, dword [ebp + 0x10]
push edx
call dword [edi + 0x18]
mov dword [ebp - 0xc], eax
cmp dword [0x4e047024], 0
jne 0x4e033f0e
jmp 0x4e033efa
call ebx
push 1
lea ecx, [ebp - 8]
push ecx
call fcn.4e033b60
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4e033ef8
cmp dword [0x4e047550], 0
jne 0x4e033f45
cmp dword [0x4e047528], 0
je 0x4e033f45
mov edx, dword [0x4e047528]
push edx
call sub.KERNEL32.dll_FreeEnvironmentStringsA
xor ecx, ecx
mov dword [0x4e047528], ecx
jmp 0x4e033f45
mov eax, dword [ebp + 0x18]
push eax
push esi
mov edx, dword [ebp + 0x10]
push edx
call dword [edi + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401200
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov ecx, dword [ebp + 8]
push ebx
xor al, al
push esi
push edi
mov byte [esp + 0x13], al
test ecx, ecx
je 0x40131b
cmp dword [ecx], 0x756470
jne 0x40131b
cmp dword [ebp + 0xc], 0
je 0x40131b
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x40131b
lea edi, [esi + 4]
push edi
call fcn.0040a520
mov ebx, eax
mov eax, dword [ebp + 0xc]
push esi
push eax
lea ecx, [ebx + 4]
push ecx
mov dword [esp + 0x24], ebx
mov dword [ebx], esi
call sub.ntdll.dll_memcpy
xor eax, eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov word [esp + 0x36], ax
mov eax, dword [ebp + 0x18]
add esp, 0x10
mov edx, 2
push eax
mov word [esp + 0x1c], dx
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [ebp + 0x14]
mov word [esp + 0x1a], ax
mov dword [esp + 0x1c], ecx
test edi, edi
je 0x4012f1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push 0x10
lea edx, [esp + 0x1c]
push edx
push 0
push edi
push ebx
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
mov esi, eax
cmp esi, 0xffffffff
je 0x4012e9
mov edx, dword [ebp + 8]
push esi
add edx, 0x1c
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
sub edi, esi
add ebx, esi
test edi, edi
jne 0x401297
mov ebx, dword [esp + 0x14]
push ebx
mov byte [esp + 0x17], 1
call fcn.0040a730
mov al, byte [esp + 0x17]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x40130a
mov ebx, dword [esp + 0x14]
push ebx
mov byte [esp + 0x17], 1
call fcn.0040a730
mov al, byte [esp + 0x17]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x14]
push ebx
call fcn.0040a730
mov al, byte [esp + 0x17]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4013b0
Capabilities:
Create tcp socket
Create thread
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0x24
call fcn.0040a310
add esp, 4
push 0
push 0
mov esi, eax
push 1
push 0
mov dword [esi], 0x756470
mov dword [esi + 4], 1
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x11
push 2
push 2
mov dword [esi + 0x10], eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x4013fd
push esi
call fcn.00401330
add esp, 4
xor esi, esi
test esi, esi
je 0x401462
xor eax, eax
mov dword [esp + 6], eax
mov dword [esp + 0xa], eax
mov dword [esp + 0xe], eax
mov word [esp + 0x12], ax
mov eax, 2
push 0x10
lea ecx, [esp + 8]
mov word [esp + 8], ax
mov edx, dword [esi + 8]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x401444
push esi
call fcn.00401330
add esp, 4
xor eax, eax
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
push 0
push 0
push esi
push 0x401100
push 0
push 0
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x14], eax
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x401470
Capabilities:
Create tcp socket
Create thread
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x10
push edi
mov edi, dword [esp + 0x1c]
xor eax, eax
test di, di
je 0x401576
push ebx
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x401575
push esi
push 0x24
call fcn.0040a310
add esp, 4
push 0
push 0
mov esi, eax
push 1
push 0
mov dword [esi], 0x756470
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x11
push 2
push 2
mov dword [esi + 0x10], eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x4014da
push esi
call fcn.00401330
add esp, 4
xor esi, esi
test esi, esi
je 0x401572
xor eax, eax
mov dword [esp + 0xe], eax
mov dword [esp + 0x12], eax
mov dword [esp + 0x16], eax
mov word [esp + 0x1a], ax
mov eax, dword [esp + 0x20]
mov ecx, 2
push edi
mov dword [esp + 0x14], eax
mov word [esp + 0x10], cx
call dword [sym.imp.WS2_32.dll_htons]
push 1
lea edx, [esp + 0x28]
push edx
push 4
mov word [esp + 0x1a], ax
mov byte [esp + 0x30], 1
mov eax, dword [esi + 8]
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edx, dword [esi + 8]
push 0x10
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x401558
push esi
call fcn.00401330
add esp, 4
pop esi
pop ebx
xor eax, eax
pop edi
add esp, 0x10
ret
push 0
push 0
push esi
push 0x401100
push 0
push 0
mov dword [esi + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x14], eax
mov eax, esi
pop esi
pop ebx
pop edi
add esp, 0x10
ret

Function at 0x401ae0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSASend]
push ebp
mov ebp, dword [esp + 0xc]
mov ecx, dword [ebp + 0x260]
push edi
push 0
push esi
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea edi, [esi + 0x1c]
push edi
push ecx
mov dword [esp + 0x2c], 0
call ebx
test eax, eax
je 0x401b50
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x401b50
cmp eax, 0x2733
jne 0x401b56
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x260]
push 0
push esi
push 0
lea edx, [esp + 0x1c]
push edx
push 1
push edi
push eax
mov dword [esp + 0x2c], 0
call ebx
test eax, eax
jne 0x401b12
pop edi
pop ebp
mov al, 1
pop ebx
ret
pop edi
pop ebp
xor al, al
pop ebx
ret
Function at 0x401d60
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x1c
cmp dword [esp + 0x20], 0
push esi
push edi
mov esi, eax
mov edi, ecx
jne 0x401ef2
test ebx, ebx
je 0x401ef2
call fcn.0040da20
push eax
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [esi + 0x18]
sub eax, 0
je 0x401e4e
sub eax, 1
jne 0x401f49
cmp byte [edi + 0x275], al
je 0x401dbc
add edi, 0x21c
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
pop edi
pop esi
add esp, 0x1c
ret
lea ecx, [edi + 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov edx, dword [edi + 0x27c]
push ebx
add edx, 0x44
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov eax, dword [edi + 0x264]
mov ecx, dword [edi + 0x268]
mov edx, dword [edi + 0x26c]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x270]
mov dword [esp + 0xc], ecx
mov ecx, dword [edi + 0x278]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [edi + 0x27c]
lea eax, [esp + 8]
lea edx, [edi + 8]
push eax
mov dword [esp + 0x20], edx
push ecx
mov ecx, 3
mov edx, edi
mov dword [esp + 0x28], ebx
call fcn.00401740
add esp, 8
mov eax, edi
call fcn.00401cf0
test al, al
jne 0x401f49
mov byte [edi + 0x275], 1
pop edi
pop esi
add esp, 0x1c
ret
cmp byte [edi + 0x275], 0
je 0x401e67
add esi, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
pop edi
pop esi
add esp, 0x1c
ret
add dword [esi + 0x28], ebx
mov eax, dword [esi + 0x28]
cmp eax, dword [esi + 0x24]
jae 0x401e87
add dword [esi + 0x20], ebx
sub dword [esi + 0x1c], ebx
push edi
call fcn.00401ae0
add esp, 4
pop edi
pop esi
add esp, 0x1c
ret
lea edx, [esi + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ecx, dword [edi + 0x268]
mov edx, dword [edi + 0x26c]
mov eax, dword [edi + 0x264]
mov dword [esp + 0xc], ecx
mov ecx, dword [edi + 0x278]
mov dword [esp + 0x10], edx
mov edx, dword [esi + 0x30]
mov dword [esp + 0x18], ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x270]
mov dword [esp + 0x1c], edx
mov edx, dword [edi + 0x27c]
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x28]
push edx
mov ecx, 2
mov edx, edi
mov dword [esp + 0x28], eax
call fcn.00401740
add esp, 8
pop edi
pop esi
add esp, 0x1c
ret
add esi, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 4
lea edx, [esp + 0x2c]
push edx
mov eax, 1
push 0x80
mov word [esp + 0x34], ax
mov eax, dword [edi + 0x260]
push 0xffff
xor ecx, ecx
push eax
mov byte [edi + 0x275], 1
mov word [esp + 0x3e], cx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [edi + 0x260]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi + 0x260], 0xffffffff
pop edi
pop esi
add esp, 0x1c
ret