joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a682
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 0x114]
cmp eax, 0xffffffff
je 0x40a6bb
xor esi, esi
push esi
lea ecx, [ebp - 4]
push ecx
push edi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a6b7
cmp dword [ebp - 4], esi
je 0x40a6b7
xor eax, eax
inc eax
jmp 0x40a6e0
xor eax, eax
jmp 0x40a6e0
mov eax, dword [esi + 4]
cmp eax, dword [esi + 0x118]
jb 0x40a6ca
xor al, al
jmp 0x40a6e0
mov ecx, dword [esi]
push edi
add ecx, eax
push ecx
push dword [ebp + 8]
call fcn.00426780
add esp, 0xc
add dword [esi + 4], edi
mov al, 1
pop esi
leave
ret 4

Function at 0x40b392
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
xor edi, edi
push edi
push edi
push edi
push edi
call ebx
push edi
push edi
push edi
push edi
mov dword [ebp - 4], eax
call ebx
push edi
push edi
push 1
push edi
mov dword [esi + 0x18], eax
call ebx
mov ecx, dword [esi + 0x18]
mov ebx, dword [ebp - 4]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x25c], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x270], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [esi + 0x234], ebx
mov dword [esi + 0x258], ecx
mov dword [esi + 0x250], 0x408ac1
mov dword [esi + 0x254], eax
call fcn.00421456
cmp dword [ebp + 0x10], edi
pop ecx
jne 0x40b400
xor eax, eax
jmp 0x40b409
push dword [ebp + 0x10]
call fcn.004018fc
pop ecx
push edi
mov dword [esi + 0x238], eax
call fcn.00421456
cmp dword [ebp + 0x20], edi
pop ecx
jne 0x40b41f
xor eax, eax
jmp 0x40b428
push dword [ebp + 0x20]
call fcn.004018fc
pop ecx
push edi
mov dword [esi + 0x278], eax
call fcn.00421456
cmp dword [ebp + 0x24], edi
pop ecx
jne 0x40b43e
xor eax, eax
jmp 0x40b447
push dword [ebp + 0x24]
call fcn.004018fc
pop ecx
push edi
mov dword [esi + 0x27c], eax
call fcn.00421456
cmp dword [ebp + 0x28], edi
pop ecx
jne 0x40b45d
xor eax, eax
jmp 0x40b466
push dword [ebp + 0x28]
call fcn.004018fc
pop ecx
cmp dword [ebp + 0x14], edi
mov dword [esi + 0x280], eax
mov eax, dword [ebp + 0x2c]
mov dword [esi + 0x284], eax
mov al, byte [ebp + 0x30]
mov byte [esi + 0x289], al
je 0x40b499
push edi
call fcn.00421456
push dword [ebp + 0x14]
call fcn.004018fc
pop ecx
pop ecx
mov dword [esi + 0x23c], eax
push dword [ebp + 0x18]
lea eax, [esi + 0x244]
push 0x430278
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
call fcn.00421456
add esp, 0x10
cmp dword [ebp + 0x1c], edi
jne 0x40b4c0
xor eax, eax
jmp 0x40b4c9
push dword [ebp + 0x1c]
call fcn.004018fc
pop ecx
mov dword [esi + 0x260], eax
lea eax, [esi + 8]
push eax
push edi
push esi
push 0x40b567
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push ebx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x18]
pop edi
pop ebx
leave
ret 0x2c
Function at 0x40b62a
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
lea edi, [ebx + 0x28]
call fcn.0040c34e
lea edi, [ebx + 0x12c]
call fcn.0040c34e
mov esi, dword [ebx + 0x268]
xor edi, edi
cmp esi, edi
je 0x40b67b
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b659
sub eax, edx
je 0x40b67b
push 5
push edi
push dword [ebx + 0x26c]
push esi
push edi
push dword [ebx + 0x274]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push dword [ebx + 0x20]
push edi
call fcn.0040c249
mov esi, dword [ebx + 0x294]
mov dword [ebx + 0x24], edi
jmp 0x40b6ad
push edi
push dword [ebx + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40b6b1
push ebx
call fcn.0040bfbf
test eax, eax
je 0x40b6d1
mov esi, dword [esi + 0x610]
cmp esi, edi
jne 0x40b68f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
push dword [ebx + 0x254]
push 2
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [ebx + 0x250]
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
push esi
lea eax, [ebp - 0x104]
push str.StartDownloadFiles_failed_for_file:__s_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x40b6cd

Function at 0x40bfbf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
cmp dword [esi + 0x614], 0
push edi
mov byte [ebp - 1], 0
jne 0x40c0c6
push ebx
push 0x103
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.00426af0
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push dword [eax + 0x264]
mov ebx, 0x4302c4
lea eax, [ebp - 0x10c]
push ebx
push eax
call edi
push 0x10
push str.systemcomponents
push esi
call fcn.00420f65
add esp, 0x28
test eax, eax
jne 0x40c042
lea eax, [esi + 0x11]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x264]
lea eax, [ebp - 0x10c]
push ebx
push eax
call edi
add esp, 0x10
lea edi, [ebp - 0x10c]
call fcn.0040c34e
test eax, eax
pop ebx
jne 0x40c059
xor eax, eax
jmp 0x40c112
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40c0c6
shr eax, 4
not eax
and eax, 1
je 0x40c0c6
and dword [ebp - 8], 0
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
call fcn.0040c2a3
mov eax, dword [ebp - 8]
pop ecx
lea ecx, [esi + 0x208]
call fcn.0040c26a
test eax, eax
jne 0x40c09f
mov byte [ebp - 1], 1
push dword [ebp - 8]
call fcn.00421456
cmp byte [ebp - 1], 0
pop ecx
je 0x40c0c6
cmp dword [esi + 0x614], 0
jne 0x40c0c6
push 0
push dword [esi + 0x60c]
call fcn.0040c249
jmp 0x40c0d8
push dword [ebp + 8]
mov eax, esi
call fcn.0040c117
test eax, eax
je 0x40c052
cmp byte [esi], 0
je 0x40c10f
mov edi, dword [ebp + 8]
lea edx, [esi + 0x208]
push edx
add edi, 0x230
mov ecx, dword [edi]
mov eax, dword [ecx]
push str.hash
push esi
call dword [eax + 0x20]
push dword [esi + 0x608]
mov edi, dword [edi]
mov eax, dword [edi]
push str.version
push esi
mov ecx, edi
call dword [eax + 0x24]
xor eax, eax
inc eax
pop edi
leave
ret 4
Function at 0x40c117
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x290]
push fcn.0040c249
lea edx, [ebp - 4]
push edx
xor ebx, ebx
lea edx, [esi + 0x104]
mov dword [ebp - 4], ebx
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov edi, eax
cmp edi, ebx
je 0x40c1b2
cmp dword [esi + 0x618], ebx
je 0x40c187
push ebx
push 0x80
push 2
push ebx
push 2
push 0x40000000
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
mov esi, eax
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40c19a
push esi
push edi
push dword [ebp - 4]
call fcn.0040da65
push dword [ebp - 4]
call fcn.00421456
pop ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x290]
cmp byte [eax + 0x332], bl
je 0x40c1b2
push ebx
push edi
call fcn.0040c249
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40c1bb
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push 0
push dword [esi + 0x1c]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40c1d1
xor al, al
jmp 0x40c245
mov eax, dword [esp + 8]
add dword [esi + 0x10], eax
test ebx, ebx
push edi
mov edi, dword [esi + 0x10]
je 0x40c1e3
add dword [esi + 0x14], ebx
mov ecx, dword [esi + 0x14]
xor edx, edx
mov eax, ecx
mov ebx, 0xc8
div ebx
cmp edi, eax
jbe 0x40c242
push dword [esi + 0x254]
add dword [esi + 0x24], edi
mov eax, dword [esi + 0x24]
and dword [esi + 0x10], 0
push 1
shr ecx, 0xa
push ecx
shr eax, 0xa
push eax
call dword [esi + 0x250]
push str.bytesDownloadedMutex
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40c242
mov eax, dword [esi + 0x24]
push edi
mov dword [0x441268], eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov al, 1
pop edi
pop ebx
ret 4
Function at 0x40c2a3
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0xc], esi
jne 0x40c2dc
mov dword [ebx], edi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push edi
push edi
push edi
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push edi
push edi
push edi
push 4
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, edi
jne 0x40c328
xor esi, esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 8]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0xc]
call ebx
mov eax, esi
jmp 0x40c2d7
push dword [ebp - 4]
lea eax, [ebp - 0x1c]
push eax
mov eax, esi
call fcn.00401b0d
push 0x20
call fcn.00420778
mov dword [ebx], eax
add esp, 0xc
mov edi, eax
lea ebx, [ebp - 0x1c]
call fcn.0040d708
jmp 0x40c30b

Function at 0x40c34e
Capabilities:
Create directory
Get file attributes

Disassembly:
cmp byte [edi], 0
je 0x40c376
push esi
mov esi, edi
mov al, byte [esi]
cmp al, 0x5c
je 0x40c360
cmp al, 0x2f
jne 0x40c36f
push 0
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [esi], 0x5c
inc esi
cmp byte [esi], 0
jne 0x40c356
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x40c384
Capabilities:
Read file on windows

Disassembly:
push edi
push 0x43173c
push dword [esp + 0xc]
call fcn.00422268
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x40c3a2
and dword [ebx], eax
or eax, 0xffffffff
pop edi
ret
push esi
push 2
push 0
push edi
call fcn.00422031
push edi
call fcn.00421f3c
push 0
push 0
push edi
mov esi, eax
call fcn.00422031
lea eax, [esi + 1]
push eax
call fcn.004212ff
push edi
push esi
push 1
push eax
mov dword [ebx], eax
call fcn.00422517
add esp, 0x30
cmp esi, eax
je 0x40c3e8
push dword [ebx]
call fcn.0042198e
pop ecx
push 0xfffffffffffffffe
pop eax
jmp 0x40c3f1
push edi
call fcn.00422128
pop ecx
mov eax, esi
pop esi
pop edi
ret
Function at 0x40c96f
Capabilities:
Check if file exists
Check internet connectivity via wininet
Create http request
Get file attributes
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
or dword [ebx + 8], 0xffffffff
sub esp, 0x198
push esi
push edi
push 0x25
xor esi, esi
lea edi, [ebx + 0xc]
pop eax
mov dword [ebx], fcn.0040f983
mov dword [ebx + 4], esi
call fcn.0040dd3e
lea eax, [esp + 0x10]
push eax
push 0x101
mov dword [ebx + 0x14], 0xc8
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x1c], esi
call sub.WSOCK32.dll_WSAStartup
push esi
push esi
push esi
push esi
push 0x4317f8
mov byte [ebx + 0x20], 0
mov byte [ebx + 0x124], 0
mov dword [ebx], fcn.0040f983
mov byte [ebx + 0x330], 0
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0x104
lea edi, [ebx + 0x22c]
push esi
push edi
mov dword [ebx + 0x33c], eax
mov dword [ebx + 0x334], esi
call fcn.00426af0
add esp, 0xc
push esi
call fcn.004074d9
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40ca02
mov esi, str.upgrade_
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebx + 0x22c]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40ca2a
xor esi, esi
xor eax, eax
jmp 0x40ca2f
and eax, 0x10
xor esi, esi
cmp eax, esi
setg al
mov byte [ebx + 0x332], al
push esi
lea eax, [esp + 0x10]
push eax
mov byte [ebx + 0x331], 1
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov edi, eax
lea eax, [esp + 8]
push eax
call sub.SensApi.dll_IsNetworkAlive
cmp edi, esi
je 0x40ca69
cmp eax, esi
jne 0x40ca70
mov byte [ebx + 0x331], 0
pop edi
mov dword [ebx + 0x228], esi
mov dword [ebx + 0x338], esi
mov eax, ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40cf3d
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp byte [eax + 0x332], bl
jne 0x40cf5e
xor eax, eax
jmp 0x40d06a
mov eax, dword [ebp + 0xc]
push edi
push 0x103
mov dword [eax], ebx
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.00426af0
push 4
push str.http
push esi
mov edi, esi
call fcn.00420f65
add esp, 0x18
test eax, eax
jne 0x40cfb7
push 0x2f
push esi
call fcn.00420860
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
jne 0x40cfb2
push 0x5c
push esi
call fcn.00420860
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x40cfb5
inc edi
jmp 0x40cfb7
mov edi, esi
mov eax, dword [ebp + 8]
add eax, 0x22c
lea edx, [ebp - 0x108]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x40cfc7
mov eax, edi
mov edx, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40cfd5
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x40cfe5
mov ecx, eax
shr ecx, 2
push ebx
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 0x80
push 3
push ebx
mov ecx, eax
push 1
and ecx, 3
push SysReAllocStringLen
lea eax, [ebp - 0x108]
rep movsb byte es:[edi], byte [esi]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40d05b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
call fcn.004208a6
pop ecx
push ebx
lea ecx, [ebp - 4]
push ecx
push esi
push eax
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], esi
je 0x40d05f
push dword [ebp + 8]
call fcn.00420926
pop ecx
xor eax, eax
jmp 0x40d069
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40dcbd
Capabilities:
Hash data using rshash

Disassembly:
push esi
mov esi, eax
mov edx, 0xf8c9
xor eax, eax
jmp 0x40dcd8
imul eax, edx
imul edx, edx, 0x5c6b7
movsx ecx, cl
add eax, ecx
inc esi
mov cl, byte [esi]
test cl, cl
jne 0x40dcc9
cmp dword [esp + 8], 0
pop esi
je 0x40dcee
xor edx, edx
div dword [esp + 4]
mov eax, edx
ret
Function at 0x41127a
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41127f
sub eax, edx
je 0x4112c5
mov cl, byte [esi + eax - 1]
cmp cl, 0x2e
je 0x4112a7
cmp cl, 0x78
je 0x4112a7
cmp cl, 0x58
je 0x4112a7
cmp cl, 0x30
jl 0x4112aa
cmp cl, 0x39
jg 0x4112aa
dec eax
jne 0x41128a
test eax, eax
je 0x4112c5
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x4112c1
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
ret
or eax, 0xffffffff
ret
push esi
call dword [sym.imp.WSOCK32.dll_inet_addr]
ret

Function at 0x4112cd
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and word [ebp - 0x14], 0
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, ecx
stosw word es:[edi], ax
call fcn.0041127a
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x4112f7
or eax, 0xffffffff
jmp 0x411342
push 0
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
push dword [ebp + 8]
mov esi, eax
mov word [ebp - 0x14], 2
call dword [sym.imp.WSOCK32.dll_htons]
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
je 0x411340
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call sub.WSOCK32.dll_closesocket
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4112f2
mov eax, esi
pop edi
pop esi
leave
ret 4

Function at 0x411348
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, eax
test esi, esi
push edi
mov edi, ecx
jne 0x411370
test edi, edi
je 0x411370
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x41135b
sub esi, ecx
jmp 0x411370
cmp eax, esi
jge 0x411383
mov esi, eax
neg esi
add edi, eax
push dword [esp + 0x10]
push esi
push edi
push dword [esp + 0x18]
call sub.WSOCK32.dll_send
test eax, eax
jg 0x411366
pop edi
pop esi
ret 8

Function at 0x4113b8
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
lea eax, [ebp - 4]
push eax
push 0x4004667f
push esi
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
cmp dword [ebp - 4], 0
jne 0x411415
push 0x4373a4
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x108], 1
call dword [sym.imp.WSOCK32.dll_select]
test eax, eax
jne 0x411413
push 0x2733
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x411424
jl 0x411424
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
push esi
call dword [sym.imp.WSOCK32.dll_recv]
leave
ret 8
Function at 0x411428
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov edi, eax
mov esi, ecx
mov dword [ebp - 8], ebx
push ebx
push edi
call fcn.004113b8
cmp eax, 1
jne 0x411489
mov al, byte [edi]
cmp al, 0xd
je 0x41145e
cmp al, 0xa
je 0x411484
inc dword [ebp - 8]
inc edi
cmp dword [ebp - 8], 0x400
jl 0x411439
jmp 0x411484
push 2
lea eax, [ebp - 1]
push eax
mov byte [ebp - 1], bl
call fcn.004113b8
cmp eax, 1
jne 0x411489
cmp byte [ebp - 1], 0xa
jne 0x411484
push ebx
push eax
lea eax, [ebp - 1]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_recv]
mov eax, dword [ebp - 8]
mov byte [edi], bl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x416099
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push esi
lea eax, [ebp + 8]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push dword [ebp + 8]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4160d5
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
ret 0x14

Function at 0x41613a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x4161b2
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push ebx
push dword [ebp + 0x10]
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
mov eax, dword [edi]
inc eax
push eax
call fcn.00420778
pop ecx
push edi
push eax
push dword [ebp + 0x10]
mov dword [ebp + 8], eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
pop esi
je 0x4161b6
cmp dword [ebp + 8], ebx
je 0x4161b2
push dword [ebp + 8]
call fcn.00420926
pop ecx
xor eax, eax
jmp 0x4161b9
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x4161c2
mov ecx, dword [edi]
mov byte [eax + ecx], bl
pop ebx
leave
ret 0xc
Function at 0x4163cf
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
mov edi, ebx
call fcn.00416383
push 0x103
lea eax, [ebp - 0x103]
push 0
push eax
mov byte [ebp - 0x104], 0
call fcn.00426af0
mov eax, dword [ebp + 8]
add esp, 0xc
dec eax
je 0x41643b
dec eax
je 0x416427
dec eax
je 0x416412
push 2
pop eax
jmp 0x4164e1
push 6
pop ecx
mov esi, str.MGSPOKERV2CREATEMUTEXPIGGY
lea edi, [ebp - 0x104]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x41644b
push 5
pop ecx
mov esi, str.MGSPOKERV2CREATEMUTEX
lea edi, [ebp - 0x104]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x41644b
push 6
pop ecx
mov esi, str.MGSPOKERV2CREATEMUTEXSB
lea edi, [ebp - 0x104]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x104]
push eax
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push esi
push eax
mov dword [ebx + 0xf4], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x416472
xor eax, eax
jmp 0x4164e1
lea edi, [ebp - 0x104]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x416479
mov esi, str._SEM
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x104]
push eax
push 1
movsb byte es:[edi], byte [esi]
push 1
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push edi
push eax
mov dword [ebx + 0xf8], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4164de
push dword [ebx + 0xf4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebx + 0xf4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebx + 0xf8]
mov dword [ebx + 0xf4], edi
call esi
mov dword [ebx + 0xf8], edi
jmp 0x41646e
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 4