joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404520
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x40c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x40c874]
push ebx
push esi
push edi
push 0x6a
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x2710
mov esi, eax
call fcn.00406fd0
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea ecx, [ebp - 0x104]
push str.UserCount:__d__d
push ecx
call ebx
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0x10
lea edx, [ebp - 0x104]
push edx
push 0
push 0x401
push esi
call edi
mov eax, dword [0x48eec8]
mov ecx, dword [0x48eec4]
push eax
push ecx
lea edx, [ebp - 0x104]
push str.ServerCount:__d__d
push edx
call ebx
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
push 1
push 0x401
push esi
call edi
push 0x48ef28
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x48ef50]
push 0x48ef28
mov dword [ebp - 0x108], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebp - 0x108]
push 0x800
push edx
lea eax, [ebp - 0x104]
push str.QueueSize:__d__d
push eax
call ebx
add esp, 0x10
lea ecx, [ebp - 0x104]
push ecx
push 2
push 0x401
push esi
call edi
push 0
push 3
push 0x401
push esi
call edi
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004071d0
mov esp, ebp
pop ebp
ret

Function at 0x404b40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [0x48eecc], bl
je 0x404b7d
call edi
sub eax, dword [0x48eed0]
cmp eax, 0x2710
jbe 0x404b7d
push str._SocketUDP__JoinServer_disconnected
push 1
mov byte [0x48eecc], bl
mov dword [0x48eed0], ebx
call fcn.00406e70
add esp, 8
mov eax, dword [0x48eedc]
mov esi, dword [eax]
cmp esi, eax
je 0x404c10
lea esp, [esp]
cmp dword [esi + 0x48], ebx
je 0x404bce
call edi
sub eax, dword [esi + 0x4c]
cmp eax, 0x2710
jbe 0x404bce
movzx eax, word [esi + 0x10]
movzx ecx, word [esi + 0x42]
push eax
push ecx
lea edx, [esi + 0x32]
push edx
lea eax, [esi + 0x12]
push eax
push str._SocketUDP__GameServer_disconnected___s____s:_d___d_
push 1
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
call fcn.00406e70
add esp, 0x18
dec dword [0x48eec4]
cmp byte [esi + 0x59], bl
jne 0x404c08
mov eax, dword [esi + 8]
cmp byte [eax + 0x59], bl
jne 0x404bef
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x59], bl
jne 0x404c08
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x59], bl
je 0x404be4
jmp 0x404c08
mov eax, dword [esi + 4]
cmp byte [eax + 0x59], bl
jne 0x404c06
cmp esi, dword [eax + 8]
jne 0x404c06
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x59], bl
je 0x404bf7
mov esi, eax
cmp esi, dword [0x48eedc]
jne 0x404b90
pop edi
pop esi
pop ebx
ret
Function at 0x4059f0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x74]
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
xor edi, edi
cmp eax, edi
je 0x405a18
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x74]
push eax
call ebx
mov dword [esi + 0x74], edi
mov eax, dword [esi + 0x70]
cmp eax, edi
je 0x405a25
push eax
call ebx
mov dword [esi + 0x70], edi
lea ecx, [esi + 0x38]
call fcn.00403f90
lea edi, [esi + 0x14]
mov dword [ebp - 4], 8
mov eax, dword [edi]
test eax, eax
je 0x405a51
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [edi]
push ecx
call ebx
mov dword [edi], 0
add edi, 4
dec dword [ebp - 4]
jne 0x405a37
mov eax, dword [esi + 0x10]
test eax, eax
je 0x405a76
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 0x10]
push edx
call ebx
mov dword [esi + 0x10], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x405a87
push eax
call ebx
mov dword [esi + 8], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x405a9d
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405ab0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x40c018]
xor eax, ebp
mov dword [ebp - 4], eax
push 1
push 0
push 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [0x48eeec], eax
cmp eax, 0xffffffff
jne 0x405b02
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str._SocketTCP__WSASocket___failed_with_error:__d
push 1
call fcn.00406e70
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004071d0
mov esp, ebp
pop ebp
ret
mov eax, 2
push 0
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htonl]
movzx ecx, word [0x48eef4]
push ecx
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea edx, [ebp - 0x14]
mov word [ebp - 0x12], ax
mov eax, dword [0x48eeec]
push edx
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x405b65
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str._SocketTCP__bind___failed_with_error:__d
push 1
call fcn.00406e70
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004071d0
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x48eeec]
push 5
push ecx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x405b9f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str._SocketTCP__listen___failed_with_error:__d
push 1
call fcn.00406e70
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004071d0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
call fcn.004071d0
mov esp, ebp
pop ebp
ret
Function at 0x405bb0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x405bde
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str._SocketTCP__socket___failed_with_error:__d
push 1
call fcn.00406e70
add esp, 0xc
xor al, al
pop esi
ret
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [0x48eef0], eax
test eax, eax
jne 0x405c15
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SocketTCP__CreateIoCompletionPort___failed_with_error:__d
push 1
call fcn.00406e70
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor al, al
pop esi
ret
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
pop esi
ret

Function at 0x405c20
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0x48eee8
push 0x406600
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x48eef8], eax
test eax, eax
jne 0x405c5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SocketTCP__CreateThread___failed_with_error:__d
push 1
call fcn.00406e70
add esp, 0xc
xor al, al
ret
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x405c80
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SocketTCP__SetThreadPriority___failed_with_error:__d
push 1
call fcn.00406e70
add esp, 0xc
xor al, al
ret
mov al, 1
ret

Function at 0x405c90
Capabilities:
Create thread
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
cmp eax, 8
jbe 0x405cad
mov eax, 8
push ebx
push esi
push edi
xor edi, edi
mov dword [0x48ef1c], eax
test eax, eax
je 0x405cf9
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, 0x48eefc
push 0
push 0
push 0x48eee8
push 0x4067a0
push 0
push 0
call ebx
mov dword [esi], eax
test eax, eax
je 0x405d02
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x405d21
inc edi
add esi, 4
cmp edi, dword [0x48ef1c]
jb 0x405cc6
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SocketTCP__CreateThread___failed_with_error:__d
push 1
call fcn.00406e70
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SocketTCP__SetThreadPriority___failed_with_error:__d
push 1
call fcn.00406e70
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405d40
Capabilities:
Create thread

Disassembly:
push 0
push 0x800
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [0x48ef58], eax
test eax, eax
jne 0x405d73
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SocketTCP__CreateSemaphore___failed_with_error:__d
push 1
call fcn.00406e70
add esp, 0xc
xor al, al
ret
push 0
push 0
push 0x48eee8
push 0x4068a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x48ef5c], eax
test eax, eax
jne 0x405dad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SocketTCP__CreateThread___failed_with_error:__d
push 1
call fcn.00406e70
add esp, 0xc
xor al, al
ret
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x405dd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SocketTCP__SetThreadPriority___failed_with_error:__d
push 1
call fcn.00406e70
add esp, 0xc
xor al, al
ret
mov al, 1
ret
Function at 0x406060
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x48ef64
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
test esi, esi
js 0x406086
xor eax, eax
cmp esi, 0x2710
setl al
test eax, eax
jne 0x40609a
push 0x48ef64
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, esi
imul ebx, ebx, 0x34
add ebx, 0x40ff80
mov eax, dword [ebx + 4]
test eax, eax
js 0x4061e4
xor ecx, ecx
cmp eax, 0x2710
setl cl
mov eax, ecx
test eax, eax
je 0x4061e4
cmp dword [ebx + 8], 0
je 0x4061e4
cmp dword [ebx + 0x1c], 0xffffffff
je 0x4061e4
cmp edi, 0x800
jle 0x406107
push edi
push esi
push str._SocketTCP__Max_msg_size__Type:_1_Index:__d_Size:__d_
push 1
call fcn.00406e70
add esp, 0x10
push 0x48ef64
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebx + 0x24]
cmp dword [esi + 0x20], 0
jle 0x40616c
mov eax, dword [esi + 0x1028]
lea ecx, [eax + edi]
cmp ecx, 0x800
jle 0x40613c
mov esi, dword [ebp + 8]
push ecx
push esi
push str._SocketTCP__Max_msg_size__Type:_2_Index:__d_Size:__d_
push 1
call fcn.00406e70
add esp, 0x10
mov eax, esi
jmp 0x4061da
mov edx, dword [ebp + 0xc]
push edi
push edx
lea eax, [eax + esi + 0x828]
push eax
call sub.MSVCR100.dll_memcpy
add esp, 0xc
add dword [esi + 0x1028], edi
push 0x48ef64
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
push edi
lea eax, [esi + 0x24]
push ecx
push eax
call sub.MSVCR100.dll_memcpy
add esp, 0xc
xor ecx, ecx
push ecx
push esi
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [esi + 0x24]
mov dword [esi + 0x18], eax
lea eax, [esi + 0x14]
push 1
mov dword [eax], edi
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], edi
mov dword [esi + 0x824], ecx
push eax
mov eax, dword [ebx + 0x1c]
push eax
mov dword [ebp - 4], ecx
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x406157
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x3e5
je 0x406157
call esi
push eax
push str._SocketTCP__WSASend___failed_with_error:__d
push 1
call fcn.00406e70
mov eax, dword [ebp + 8]
add esp, 0xc
mov ecx, 0x48eee8
call fcn.00406200
push 0x48ef64
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4062e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
add ebx, 0x7c
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test edi, edi
js 0x4063d7
xor eax, eax
cmp edi, 0x2710
setl al
test eax, eax
je 0x4063d7
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
test eax, eax
je 0x4063d0
add dword [esi + 0x824], eax
lea eax, [esi + 0x24]
push eax
push edi
push ecx
call fcn.00405de0
test al, al
jne 0x40635b
mov edx, edi
imul edx, edx, 0x34
add edx, 0x40ff8c
push edx
push edi
push str._DataRecv__MainBuffer_Error__Index:__d_IpAddress:__s_
push 2
mov ecx, 0x40c1a8
call fcn.00403670
add esp, 0x10
jmp 0x4063cd
mov eax, dword [esi + 0x824]
lea ecx, [eax + esi + 0x24]
mov edx, 0x800
sub edx, eax
xor eax, eax
push eax
mov dword [esi + 0x1c], eax
push esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
mov dword [esi + 0x18], ecx
mov eax, edi
lea ecx, [esi + 0x14]
imul eax, eax, 0x34
mov dword [ecx], edx
lea edx, [esp + 0x18]
push edx
push 1
push ecx
mov ecx, dword [eax + 0x40ff9c]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x4063d7
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x3e5
je 0x4063d7
call esi
push eax
push str._SocketTCP__WSARecv___failed_with_error:__d
push 2
mov ecx, 0x40c1a8
call fcn.00403670
add esp, 0xc
mov ecx, dword [ebp + 8]
mov eax, edi
call fcn.00406200
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4063f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi + 0x7c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0xc]
test eax, eax
js 0x40642b
xor ecx, ecx
cmp eax, 0x2710
setl cl
test ecx, ecx
je 0x40642b
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x40643a
mov ecx, edi
call fcn.00406200
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
add dword [ebx + 0x824], ecx
mov ecx, dword [ebx + 0x824]
mov edi, eax
mov eax, dword [ebx + 0x20]
imul edi, edi, 0x34
add edi, 0x40ff80
mov dword [ebp + 0x10], edi
cmp ecx, eax
jl 0x406521
mov eax, dword [ebx + 0x1028]
test eax, eax
jg 0x40647f
push esi
mov dword [ebx + 0x20], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x800
jle 0x4064eb
lea eax, [ebx + 0x828]
lea edx, [ebx + 0x24]
mov esi, eax
mov edi, edx
mov ecx, 0x200
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x1028]
add ecx, 0xfffff800
push ecx
lea ecx, [ebx + 0x1028]
push ecx
lea esi, [ebx + 0x14]
push eax
mov dword [ebx + 0x18], edx
mov dword [esi], 0x800
mov dword [ebx + 0x1c], 1
mov dword [ebx + 0x20], 0x800
mov dword [ebx + 0x824], 0
call dword [sym.imp.MSVCR100.dll_memmove]
mov edi, dword [ebp + 0x10]
add esp, 0xc
add dword [ebx + 0x1028], 0xfffff800
jmp 0x406536
push eax
lea eax, [ebx + 0x828]
push eax
lea esi, [ebx + 0x24]
push esi
call sub.MSVCR100.dll_memcpy
mov eax, dword [ebx + 0x1028]
add esp, 0xc
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x824], 0
mov dword [ebx + 0x1028], 0
jmp 0x40652a
lea edx, [ecx + ebx + 0x24]
mov dword [ebx + 0x18], edx
sub eax, ecx
lea esi, [ebx + 0x14]
mov dword [ebx + 0x1c], 1
mov dword [esi], eax
mov ecx, dword [edi + 0x1c]
push 0
push ebx
push 0
lea eax, [ebp - 8]
push eax
push 1
push esi
push ecx
mov dword [ebp - 8], 0
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x406596
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x3e5
je 0x406596
call esi
push eax
push str._SocketTCP__WSASend___failed_with_error:__d
push 1
call fcn.00406e70
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
add esp, 0xc
call fcn.00406200
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406a00
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
mov dword [esi], vtable.CSocketManagerUdp.0
test eax, eax
je 0x406a2d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x406a43
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
test byte [ebp + 8], 1
je 0x406a53
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x406a60
Capabilities:
Create thread
Create udp socket
Terminate thread

Disassembly:
push esi
push 0
push 2
push 2
mov esi, eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x40da2c], eax
cmp eax, 0xffffffff
jne 0x406ad6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str._SocketUDP__WSASocket___failed_with_error:__d
push 1
call fcn.00406e70
mov eax, dword [0x40da40]
add esp, 0xc
test eax, eax
je 0x406ab7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x40da40]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x40da40], 0
mov eax, dword [0x40da2c]
cmp eax, 0xffffffff
je 0x406ad2
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x40da2c], 0xffffffff
xor al, al
pop esi
ret
mov ecx, 2
push 0
mov word [0x40da30], cx
call dword [sym.imp.WS2_32.dll_htonl]
push esi
mov dword [0x40da34], eax
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [0x40da2c]
push 0x10
push 0x40da30
push edx
mov word [0x40da32], ax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x406b26
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str._SocketUDP__bind___failed_with_error:__d
jmp 0x406a85
push 0
push 0
push 0x40da28
push 0x406be0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x40da40], eax
test eax, eax
jne 0x406b6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SocketUDP__CreateThread___failed_with_error:__d
push 1
call fcn.00406e70
add esp, 0xc
mov esi, 0x40da28
call fcn.00406ba0
xor al, al
pop esi
ret
push 0x1000
push 0
push 0x40da44
call sub.MSVCR100.dll_memset
movzx ecx, si
push ecx
push str._SocketUDP__Server_started_at_port___d_
push 3
mov dword [0x40ea44], 0
call fcn.00406e70
add esp, 0x18
mov al, 1
pop esi
ret

Function at 0x406ba0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 0x18]
test eax, eax
je 0x406bc1
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x406bd7
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
ret
Function at 0x406de0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x40c018]
xor eax, ebp
mov dword [ebp - 4], eax
jmp 0x406e05
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push 0
push eax
call sub.MSVCR100.dll_memset
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
push edx
lea eax, [ebp - 0x104]
push pe_nt_image_headers32
push eax
call dword [sym.imp.MSVCR100.dll_vsprintf_s]
add esp, 0x1c
push 0x10
push str.Error
lea ecx, [ebp - 0x104]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x406e5d
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x406f40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
xor edi, edi
mov esi, 0x40ff9c
test edi, edi
js 0x406fbf
xor eax, eax
cmp edi, 0x2710
setl al
test eax, eax
je 0x406fbf
cmp dword [esi - 0x14], 0
je 0x406fbf
cmp dword [esi], 0xffffffff
je 0x406fbf
call ebx
sub eax, dword [esi + 0x10]
cmp eax, 0x3e8
jb 0x406f86
mov dword [esi + 0x14], 0
call ebx
mov dword [esi + 0x10], eax
call ebx
mov ecx, dword [0x40fe98]
sub eax, dword [esi + 0xc]
imul ecx, ecx, 0x3e8
cmp eax, ecx
jb 0x406fbf
lea edx, [esi - 0x10]
push edx
push str.__s__Client_disconnected__timeout.
push 2
mov ecx, 0x40c1a8
call fcn.00403670
add esp, 0xc
mov eax, edi
mov ecx, 0x48eee8
call fcn.00406200
add esi, 0x34
inc edi
cmp esi, 0x48eedc
jl 0x406f50
pop edi
pop esi
pop ebx
ret

Function at 0x4071d0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c018]
jne 0x4071da
repz ret
jmp fcn.0040770a
Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x61366f31
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..reloc_1
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x551043e
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x403433
Capabilities:
Contain obfuscated stackstrings
Get system information on windows

Disassembly:
push 0x54
push 0x4e3188
call fcn.0045cfe0
mov dword [ebp - 0x40], 0x4e52454b
mov dword [ebp - 0x3c], 0x32334c45
mov dword [ebp - 0x38], 0x6c6c642e
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x30], 0x74726956
mov dword [ebp - 0x2c], 0x466c6175
mov dword [ebp - 0x28], 0x656572
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov dword [ebp - 0x24], ebx
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0x60]
push 4
push 0x1000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x4034f7
mov byte [esi], 0xc3
lea eax, [ebp - 0x20]
push eax
push 0x120
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
and dword [ebp - 4], 0
call dword [ebp - 0x1c]
push 0x8000
push 0
push esi
call ebx
or dword [ebp - 4], 0xffffffff
xor eax, eax
inc eax
jmp 0x4034f9
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret