joyce8/EMBER2024-capa huggingface dataset:
Function at 0x727f76
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, 0x9046e956
call fcn.0072842b
invalid
jmp 0x727f9c
xor bx, 0xc8b1
jbe 0x727f60
ja 0x727f60
neg bx
mov bx, 0xe198
lea ebx, reloc.MSVCRT.dll_strncpy
jmp 0x727fbb
mov al, cl
shl bl, cl
jle 0x727f7f
neg bx
jmp 0x727fab
mov bx, 0xe198
lea ebx, reloc.MSVCRT.dll_strncpy
jmp 0x727fbb
add al, 0x7a
shl ebx, 0xd
je 0x728328
cmc
mov bh, bl
bts ebx, esp
jmp 0x72825f
lea ebx, reloc.MSVCRT.dll_strncpy
jmp 0x72804d
neg bh
ja 0x727fd9
lea ebx, reloc.MSVCRT.dll_strncpy
jmp 0x72804d
inc al
mov bx, dx
call fcn.00728014
not al
dec bx
jmp 0x728100
lea ebx, [eax*4]
neg bx
dec bl
jmp 0x7280a2
neg al
mov ebx, ebp
mov bx, word [esp]
mov bl, 0x49
mov ebx, dword [esp]
jmp 0x727fef
jmp 0x7280d9
add dl, al
mov al, byte [esp]
setge ah
rcr eax, cl
jns 0x72808c
js 0x7280d9
lahf
or eax, 0xa617e49d
setle byte [ebx + ebp*2]
cmpsb byte [esi], byte es:[edi]
bound ebp, qword [edi + 0x76]
popal
dec bl
jmp 0x7280a2
jmp 0x728112
dec edi
mov eax, 0x4f3bd074
bswap eax
bt eax, ecx
jno 0x7280c3
mov ebx, eax
lea eax, [edi*4]
xchg bx, ax
mov bx, ax
neg bx
jmp 0x72812a
jnp 0x728061
lea ebx, [eax*4]
neg bx
jmp 0x7280bf
mov ebx, eax
lea eax, [edi*4]
xchg bx, ax
jmp 0x728124
mov bx, ax
neg bx
mov ebx, edi
push esi
jmp 0x7281c1
mov bx, 0x7bf2
mov ebx, 0x1e6353ed
lea ebx, [ebp*4]
lea ebx, reloc.MSVCRT.dll_strncpy
mov bl, byte [esp]
mov ebx, eax
jmp 0x72807a
neg bx
jo 0x728196
lea eax, [esi*4]
mov bx, 0x949d
jmp 0x7281a3
ror cl, 0
not eax
lea eax, [eax + edx]
jmp 0x72815e
mov ah, 0x9b
not ax
jmp 0x728225
lea eax, [esi*4]
mov bx, 0x949d
jmp 0x728180
mov ah, 0x9b
not ax
jmp 0x728225
shr ah, 4
jb 0x728176
jae 0x728176
jp 0x7281de
lea eax, [ebp + ebp]
bsf bx, si
jmp 0x728209
lea eax, [ebp + ebp]
bsf bx, si
lea eax, [esi*4]
lea esp, [esp + 2]
add cl, 0xf1
stc
jmp 0x728297
lea eax, [esi*4]
lea esp, [esp + 2]
jmp 0x7281f1
lea esp, [esp + 4]
sub cl, 0x26
setb ah
call fcn.007281aa
call fcn.0072827c
pushfd
mov bl, al
jmp 0x728266
mov bh, bl
bts ebx, esp
inc al
jmp 0x72813e
neg bl
lea esp, [esp + 3]
jmp 0x7282c0
je 0x728234
jne 0x728234
setg bh
jmp 0x7282f1
setg bh
sub esp, 0xc
bt bx, bx
lea ebx, [ebp + ebp]
jmp 0x7282cd
lea esp, [esp + 0x14]
xor cl, 0x20
inc bh
jno 0x72829b
jo 0x7282a4
ror cl, 0
mov bl, 0xe0
or ebx, 0xa13fd41e
jne 0x7282fe
je 0x72830b
das
ja 0x7282d0
pushal
pop es
inc eax
jnp 0x7282db
add dh, cl
dec esi
arpl ax, bp
jle 0x728305
call 0x27a7084c
sub esp, 0xc
bt bx, bx
lea ebx, [ebp + ebp]
jmp 0x7282cd
lea ebx, [edx*4]
jmp 0x72835c
lea ebx, [edx*4]
bswap ebx
jmp 0x72835e
cmc
jmp 0x72825a
mov bx, 0xa94
mov bh, 0xd9
jmp 0x728346
jmp 0x72832e
rcr bl, cl
jo 0x72839c
neg ebx
jmp 0x728381
bswap ebx
mov eax, ecx
cmc
jbe 0x728344
mov bx, 0xa94
mov bh, 0xd9
jmp 0x728346
bswap ebx
jmp 0x7283a7
shl eax, 2
clc
lea ebx, [edx + ebp]
jmp 0x72836b
neg ebx
shl eax, 2
clc
lea ebx, [edx + ebp]
bswap ebx
mov ebx, dword [esp]
cmc
jne 0x7283c7
mov bh, byte [esp]
jmp 0x725025
mov bh, byte [esp]
call fcn.00728c67
jecxz 0x728446
in eax, 0x8c
jg 0x72839e
hlt
push 0xfa655f9b
push 0x454ffa0f
fisttp word [edi + 0x2a]
fldenv [ecx]
mov dl, 0xad
Function at 0x728014
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [esi + 0x97]
dec bx
lea ebx, [ebp + ebp]
lea esp, [esp + 2]
jmp 0x728057
add esp, 2
ja 0x727ffb
jbe 0x728023
mov eax, dword [edx]
nop
test dword [edx], reloc.MSVCRT.dll_strncpy
sahf
xchg edi, eax
add byte [eax], al
add byte [esi + 0x4b], ah
lea ebx, [esi + 0x97]
dec bx
lea ebx, [ebp + ebp]
jmp 0x728035
lea esp, [esp + 2]
jmp 0x728057

Function at 0x7281aa
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
bsf bx, dx
jmp 0x7281c8

Function at 0x72827c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bl, al
neg bl
lea esp, [esp + 3]
jmp 0x7282c0
sub esp, 0xf
jnp 0x728239
pushfd
jmp 0x728242

Function at 0x729323
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, 0x622f7b0b
mov dx, 0x3790
or edi, dword [ebx + 0x2f]
bound esp, qword [esi - 0x46]
nop
aaa
rol esi, cl
and ax, dx
jmp 0x72934f
xchg dword [esp], esi
xchg ecx, eax
mov ch, byte [esp]
mov edx, 0xedb0001a
lea ebx, [ebx + 0x6f]
jmp 0x729391
xchg dword [esp], esi
mov bx, word [esp]
dec cl
call fcn.007293a2
cmp esi, dword [edi + reloc.MSVCRT.dll_strncpy]
sub al, byte [ebp - 0x47]
cmpsb byte [esi], byte es:[edi]
out 0x97, al
jle 0x729324
mov ecx, 0x7e97e6a6
lea esi, [esi + 0x39]
jbe 0x7293d2
rdtsc
cmc
xchg bh, ah
rdtsc
jmp 0x72937b
je 0x7293f8
add cl, byte [edi]
mov dh, byte [esi - 0x72000002]
and al, 1

Function at 0x7c2f7c
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esi - 0x44], reloc.MSVCRT.dll_strncpy
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
fcomp dword [esi]
mov word [edx], es
xchg esp, eax
sub cl, byte [eax + 0x1be88919]
fucomi st(2)
jp 0x7c2f5d
invalid
call fcn.007c2e69
sbb al, 0x93
add esp, dword [esi - 0x6b]
push edi
adc byte [edx + ecx*4], 0xed
sbb al, 0xaa
adc al, 0x81
adc dword [eax - 0x7d], esi
xor eax, 0xb7d042d6
inc edx
not byte [edi + eax - 0x31fe0d69]
and bh, byte [eax + 0x7eb8492e]
or al, 0x95
add eax, 0x9e299f6c
push es
xchg esp, eax
push cs
mov edx, 0x4e2bbb2c
mov ebp, 0x329c027d
push ebp
movsb byte es:[edi], byte [esi]
bound esi, qword [ecx + ebp*8 + 0x79]
sbb bl, ch
pop esp
xchg esi, eax
or bl, byte [eax + 0x34cc0aff]
scasd eax, dword es:[edi]
aas
pop edx
test eax, 0x56c06273
xor eax, eax
inc edi
std
jge 0x7c2fc5
cwde
dec dword [edx]
int3
je 0x7c2f61
inc eax
int 0x4e
fdivr qword [ebx - 0x1ca21aaa]
jae 0x7c2ffb
in eax, 0x55
movsd dword es:[edi], dword [esi]
and al, 0xba
invalid
invalid

Function at 0x80c1e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pop bx
cpuid
mov edx, 0xe2653890
xchg cl, ah
mov ebp, dword [esp + 0x19]
jmp 0x80c216
setae al
xchg dword [esp], edx
xchg bp, bx
jmp 0x80c1d2

Function at 0x80cf28
Capabilities:
Access peb ldr_data

Disassembly:
push word [esp]
push word [esp + 5]
lea esp, [esp + 3]
jmp 0x80cfb0
pushal
pop word [esp + 0x14]
mov dword [esp + 3], ebx
mov dword [esp], edi
push dword [esp + 0xe]
lea esp, [esp + 1]
jmp 0x80cf61
lea esp, [esp + 1]
mov dword [esp + 0x34], ebp
push bx
pushal
push word [esp + 0xb]
mov dword [esp + 0x54], esi
jmp 0x80cf77
Function at 0x40a4c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x412250], 0
push esi
push edi
jne 0x40a436
call fcn.0040a3a2
test eax, eax
je 0x40a47b
mov eax, dword [0x412250]
cmp eax, 1
jne 0x40a457
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40a47b
jmp 0x40a4bd
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x40a4bd
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40a47f
xor eax, eax
jmp 0x40a4bd
mov eax, dword [esi]
push dword [0x412250]
call edi
mov edi, eax
test edi, edi
je 0x40a4a1
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x40a4bd
lea edi, [esi + 0xff0]
push esi
push dword [0x412250]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x40a4a7
mov eax, esi
pop edi
pop esi
ret
jmp 0x40a422

Function at 0x40a788
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412120]
jne 0x40a792
repz ret
jmp fcn.0040adba

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x51343d32
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..rdata
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2d061410
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x100a7280
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.10001843
mov eax, dword [0x100ee148]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x100efaa0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x100a7458
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x100a73a7
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x100a73a7
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x100a7385
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x100a7309
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100a7411
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x100a7478
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x100a7453
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x100a7478
jmp 0x100a72e2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100023f1
mov esp, ebp
pop ebp
ret
Function at 0x100a7510
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.10001843
mov eax, dword [0x100ee148]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x100efaa0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x100a76fb
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x100a7646
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x100a7646
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x100a7622
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x100a7599
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100a76b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x100a771b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x100a76f6
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x100a771b
jmp 0x100a7572
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100023f1
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x68
push 0
push 0x41563c
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x415640], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x41563c], eax
call fcn.0040aab0
call fcn.0040a130
call fcn.0040a10f
call fcn.004092d1
call fcn.00408e1f
call fcn.00407842
call fcn.00407734
call fcn.00407573
call fcn.00405ee1
call fcn.00404518
call fcn.00403b8b
call fcn.00403946
mov edx, str.COM1
lea ecx, [0x41569c]
call fcn.00403008
mov dword [0x4156a0], 0x12c
call fcn.004015eb
push 0
call 0x4010b9
call fcn.0040ab00
push dword [0x41563c]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0040393a
call fcn.00403d5c
call fcn.00403e57
call fcn.00404588
call fcn.00405e63
call fcn.00407728
call fcn.00408e13
call fcn.0040935f
call fcn.0040a150
ret

Function at 0x403afd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x403b71
push edi
push dword [ebp + 8]
push dword [0x415984]
call fcn.0040a37c
mov edi, eax
test edi, edi
je 0x403b70
push ebx
mov ebx, dword [ebp + 0x10]
cmp ebx, 0x19
jne 0x403b33
push esi
call fcn.0040b260
jmp 0x403b3e
cmp ebx, 2
jne 0x403b40
push esi
call fcn.0040b2f0
mov esi, eax
push 0
lea eax, [ebp - 4]
push eax
push esi
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp ebx, 0x19
jne 0x403b64
push esi
call fcn.0040b2e0
jmp 0x403b6f
cmp ebx, 2
jne 0x403b6f
push esi
call fcn.0040b3a0
pop ebx
pop edi
mov eax, dword [ebp - 4]
pop esi
leave
ret 0xc

Function at 0x403c85
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [esp + 0x10], ebx
je 0x403cd4
push dword [esp + 0x10]
push 0x403c03
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x4156a4]
cmp esi, ebx
je 0x403d28
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x403ccc
cmp byte [esi + 0x10], bl
je 0x403ccc
push 3
push ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, edi
cmp edi, ebx
jne 0x403ca9
jmp 0x403d28
mov esi, dword [0x4156a4]
cmp esi, ebx
je 0x403d28
push ebp
mov ebp, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x403d21
cmp byte [esi + 0x11], bl
je 0x403cfe
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], bl
je 0x403d14
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push edi
push 0x4156a4
call fcn.0040aa65
pop ecx
pop ecx
mov esi, ebp
cmp ebp, ebx
jne 0x403cdf
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x403e87
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
test eax, eax
jne 0x403ea3
inc eax
jmp 0x403ea5
xor eax, eax
push str.ws2_32.dll
mov word [0x415988], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4156ac], eax
test eax, eax
je 0x403f18
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.getaddrinfo
push eax
call esi
push str.freeaddrinfo
push dword [0x4156ac]
mov dword [0x4156b8], eax
call esi
push str.getnameinfo
push dword [0x4156ac]
mov dword [0x4156bc], eax
call esi
cmp dword [0x4156b8], 0
mov dword [0x4156c0], eax
pop esi
je 0x403f18
cmp dword [0x4156bc], 0
je 0x403f18
test eax, eax
je 0x403f18
mov dword [0x4156b4], 1
push fcn.00403ddf
push 0x10
push 0x2c
call fcn.0040a41d
mov dword [0x4156b0], eax
movsx eax, word [0x415988]
add esp, 0x190
ret

Function at 0x403f39
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
push ebx
xor ebx, ebx
push esi
xor esi, esi
inc ebx
mov dword [ebp - 4], esi
cmp word [edi + 0x20], bx
jne 0x403f92
push esi
push esi
push dword [edi]
call dword [sym.imp.WSOCK32.DLL_accept]
mov esi, eax
cmp esi, 0xffffffff
je 0x404090
lea eax, [edi + 0x28]
push 0x18
push eax
call fcn.0040aa38
pop ecx
mov dword [eax], ebx
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
pop ecx
mov ecx, dword [edi + 0x24]
mov dword [ebp - 4], ebx
mov dword [0x415990], ecx
mov dword [0x41598c], eax
jmp 0x404090
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push 0x800
lea eax, [ebp - 0x81c]
push eax
push dword [edi]
mov dword [ebp - 0xc], 0x10
call dword [sym.imp.WSOCK32.DLL_recvfrom]
mov dword [ebp - 8], eax
cmp eax, esi
jle 0x404090
push dword [ebp - 0x1a]
lea ebx, [edi + 0x28]
mov esi, dword [ebx]
mov dword [ebp - 4], 2
call dword [sym.imp.WSOCK32.DLL_ntohs]
movzx eax, ax
jmp 0x403fea
cmp dword [esi + 0x10], eax
jne 0x403fe8
mov ecx, dword [esi + 0xc]
cmp ecx, dword [ebp - 0x18]
je 0x40404c
mov esi, dword [esi]
test esi, esi
jne 0x403fdb
push 0x28
push ebx
call fcn.0040aa38
pop ecx
mov esi, eax
pop ecx
mov dword [esi], 2
push dword [ebp - 0x1a]
call dword [sym.imp.WSOCK32.DLL_ntohs]
movzx eax, ax
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 4], eax
mov dword [esi + 0xc], edi
mov eax, dword [esi + 0x14]
mov ebx, dword [ebp - 8]
test eax, eax
jne 0x404051
push ebx
push eax
push dword [0x41563c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push ebx
lea ecx, [ebp - 0x81c]
push ecx
push eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x404082
add esi, 8
jmp 0x404018
mov ecx, dword [esi + 0x18]
add ecx, ebx
push ecx
push eax
push 8
push dword [0x41563c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
push ebx
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [esi + 0x18]
add ecx, eax
push ecx
mov dword [esi + 0x14], eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [esi + 0x18], ebx
mov dword [0x41598c], esi
mov eax, dword [edi + 0x24]
mov dword [0x415990], eax
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x404228
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push dword [ebp + 8]
xor esi, esi
push dword [0x4156b0]
mov dword [ebp - 8], esi
call fcn.0040a2f7
mov ebx, eax
cmp ebx, esi
je 0x40439c
cmp dword [ebp + 0xc], 0xffff
ja 0x40439c
test dword [ebp + 0x10], 0x10000000
push edi
push 2
pop edi
je 0x404277
and dword [ebp + 0x10], 0xefffffff
mov dword [ebp - 4], 0x17
jmp 0x40427a
mov dword [ebp - 4], edi
cmp dword [ebp + 0x10], esi
jne 0x404286
mov dword [ebp + 0x10], 1
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.WSOCK32.DLL_socket]
mov esi, eax
mov dword [ebp - 0x10], esi
cmp esi, 0xffffffff
je 0x40439b
lea eax, [ebp - 0xc]
push eax
push 0x8004667e
push esi
mov dword [ebp - 0xc], 1
call dword [sym.imp.WSOCK32.DLL_ioctlsocket]
cmp eax, 0xffffffff
jle 0x404394
cmp dword [ebp - 4], 0x17
jne 0x4042d0
push 0x17
pop eax
mov word [ebx + 4], ax
jmp 0x4042d4
mov word [ebx + 4], di
push dword [ebp + 0xc]
call dword [sym.imp.WSOCK32.DLL_htons]
mov word [ebx + 6], ax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40431e
cmp byte [eax], 0
je 0x40431e
push eax
call fcn.0040b3b0
cmp dword [ebp - 4], 0x17
mov edi, eax
jne 0x40430c
lea eax, [ebx + 4]
push eax
push edi
push 0x17
call fcn.00403d6c
add esp, 0xc
jmp 0x404316
push edi
call dword [sym.imp.WSOCK32.DLL_inet_addr]
mov dword [ebx + 8], eax
push edi
call fcn.0040b3c0
jmp 0x404339
cmp dword [ebp - 4], 0x17
jne 0x404335
lea edi, [ebx + 0xc]
mov esi, 0x41305c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x10]
jmp 0x40433f
and dword [ebx + 8], 0
cmp dword [ebp - 4], 0x17
jne 0x404343
push 0x1c
jmp 0x404345
push 0x10
lea eax, [ebx + 4]
push eax
push esi
call dword [sym.imp.WSOCK32.DLL_bind]
test eax, eax
jne 0x404394
mov edi, dword [ebp + 0x10]
cmp edi, 1
jne 0x404369
push 0x64
push esi
call dword [sym.imp.WSOCK32.DLL_listen]
test eax, eax
jne 0x404394
xor eax, eax
cmp dword [ebp - 4], 0x17
mov dword [ebx], esi
sete al
mov word [ebx + 0x20], di
mov word [ebx + 0x22], ax
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x40438c
mov dword [ebp - 8], ebx
mov dword [ebx + 0x24], ebx
jmp 0x40439b
mov dword [ebp - 8], esi
mov dword [ebx + 0x24], eax
jmp 0x40439b
push esi
call dword [sym.imp.WSOCK32.DLL_closesocket]
pop edi
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret 0x10