joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4033ba
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0
jmp 0x4033d2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x3d
jae 0x4033eb
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x57dba0], 0
jmp 0x4033cf
mov eax, dword [ebp + 8]
push eax
call fcn.00401ac9
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x40340e
mov eax, 0xfffffff7
jmp 0x40350e
mov eax, dword [ebp - 0x10]
push eax
call fcn.00401e7e
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov word [eax], 2
mov eax, dword [ebp + 0x10]
push eax
call sub.WSOCK32.dll_htons
mov ecx, dword [ebp - 8]
mov word [ecx + 2], ax
mov eax, dword [ebp + 0xc]
push eax
call sub.WSOCK32.dll_htonl
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov dword [0x57db80], 0x57dba0
mov eax, dword [0x57db80]
mov byte [eax], 8
mov eax, dword [0x57db80]
mov byte [eax + 1], 0
mov eax, dword [0x57db80]
mov word [eax + 2], 0
mov eax, dword [0x57db80]
mov word [eax + 4], 0
mov ax, word [ebp + 0x14]
mov ecx, dword [0x57db80]
mov word [ecx + 6], ax
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x14], 0xc
jmp 0x403496
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x28
jae 0x4034b4
mov al, byte [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov byte [ecx + 0x57dba0], al
inc byte [ebp - 4]
jmp 0x403493
push 0x28
mov eax, dword [0x57db80]
push eax
call fcn.004032be
add esp, 8
mov ecx, dword [0x57db80]
mov word [ecx + 2], ax
push 0x10
mov eax, dword [ebp - 8]
push eax
push 0
push 0x2c
mov eax, dword [0x57db80]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.WSOCK32.dll_sendto
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x403504
xor ebx, ebx
call sub.WSOCK32.dll_WSAGetLastError
sub ebx, eax
mov eax, ebx
jmp 0x40350e
mov eax, 1
jmp 0x40350e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403513
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], 0x10
mov eax, dword [ebp + 8]
push eax
call fcn.00401ac9
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x403546
mov eax, 0xfffffff7
jmp 0x4035e5
mov eax, dword [ebp - 0xc]
push eax
call fcn.00401e7e
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov word [eax], 2
mov eax, dword [ebp - 4]
mov word [eax + 2], 0
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
push 0x5e
push 0x57dba0
mov eax, dword [ebp + 8]
push eax
call sub.WSOCK32.dll_recvfrom
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4035a7
xor ebx, ebx
call sub.WSOCK32.dll_WSAGetLastError
sub ebx, eax
mov eax, ebx
jmp 0x4035e5
movsx eax, byte [0x57dba0]
cmp eax, 0x45
jne 0x4035c9
mov eax, 0x57dba0
add eax, 0x14
mov dword [0x57db80], eax
jmp 0x4035d3
mov dword [0x57db80], 0x57dba0
mov eax, dword [0x57db80]
xor ecx, ecx
mov cx, word [eax + 6]
mov eax, ecx
jmp 0x4035e5
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403b80
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
and eax, 0xffff
xor ecx, ecx
mov cx, word [0x5537f4]
cmp eax, ecx
jl 0x403bb3
mov eax, 0xfffffc15
jmp 0x403ce1
call sub.WSOCK32.dll_WSAIsBlocking
test eax, eax
je 0x403be2
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov eax, dword [eax + 0x57ffb8]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403bb3
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
add eax, 0x57f080
add eax, 0xf3c
push eax
call sub.WSOCK32.dll_gethostbyname
mov ecx, dword [ebp + 8]
mov edx, ecx
shl ecx, 6
sub ecx, edx
lea ecx, [edx + ecx*4]
shl ecx, 4
mov dword [ecx + 0x58003c], eax
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
cmp dword [eax + 0x58003c], 0
jne 0x403c45
xor ebx, ebx
call sub.WSOCK32.dll_WSAGetLastError
sub ebx, eax
mov eax, ebx
jmp 0x403ce1
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov eax, dword [eax + 0x58003c]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403c83
mov eax, 0xfffffc11
jmp 0x403ce1
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
add eax, 0x57f080
add eax, 0xf3c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
cmp dword [eax], ecx
jne 0x403cb8
mov eax, 0xfffffc11
jmp 0x403ce1
mov eax, dword [ebp - 4]
push eax
call sub.WSOCK32.dll_ntohl
mov ecx, dword [ebp + 8]
mov edx, ecx
shl ecx, 6
sub ecx, edx
lea ecx, [edx + ecx*4]
shl ecx, 4
mov dword [ecx + 0x580040], eax
mov eax, 0x3e8
jmp 0x403ce1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4041b2
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
cmp dword [ebp + 8], 0x40
jle 0x4041d3
mov word [0x5537f4], 0x40
jmp 0x4041dc
mov eax, dword [ebp + 8]
mov word [0x5537f4], ax
mov dword [ebp - 8], 0
jmp 0x4041eb
inc dword [ebp - 8]
xor eax, eax
mov ax, word [0x5537f4]
cmp eax, dword [ebp - 8]
jle 0x404298
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, ecx
shl ecx, 6
sub ecx, edx
lea ecx, [edx + ecx*4]
shl ecx, 4
mov dword [ecx + 0x57f080], eax
mov eax, dword [ebp - 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov dword [eax + 0x57f084], 0
mov eax, dword [ebp - 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov dword [eax + 0x57fca0], 0
mov eax, dword [ebp - 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov dword [eax + 0x57fca4], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov edx, ecx
shl ecx, 6
sub ecx, edx
lea ecx, [edx + ecx*4]
shl ecx, 4
mov dword [ecx + 0x57ffb8], eax
mov eax, dword [ebp - 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov byte [eax + 0x57ffbc], 0
jmp 0x4041e8
push 0x5be580
mov ax, word [0x5537f8]
push eax
call sub.WSOCK32.dll_WSAStartup
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4042c0
xor eax, eax
sub eax, dword [ebp - 4]
jmp 0x4042d5
push 0x5be710
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, 0x3e8
jmp 0x4042d5
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4042fa
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.0040439b
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x40431f
mov eax, 0xfffffc16
jmp 0x404396
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40435b
mov eax, dword [ebp - 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov dword [eax + 0x57f084], 0
mov eax, 0xfffffc13
jmp 0x404396
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, ecx
shl ecx, 6
sub ecx, edx
lea ecx, [edx + ecx*4]
shl ecx, 4
mov dword [ecx + 0x57f084], eax
mov eax, dword [ebp - 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov dword [eax + 0x58004c], 1
mov eax, dword [ebp - 8]
jmp 0x404396
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4046fa
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov eax, dword [eax + 0x57f084]
mov dword [ebp - 8], eax
xor eax, eax
mov ax, word [0x5537f4]
mov ecx, dword [ebp + 8]
and ecx, 0xffff
cmp eax, ecx
jg 0x40473f
mov eax, 0xfffffc15
jmp 0x404850
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
cmp dword [eax + 0x58004c], 0
jne 0x404766
mov eax, 0xfffffc11
jmp 0x404850
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
cmp dword [eax + 0x57f084], 0
jne 0x40478d
mov eax, 0x3e8
jmp 0x404850
call sub.WSOCK32.dll_WSAIsBlocking
test eax, eax
je 0x4047bc
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov eax, dword [eax + 0x57ffb8]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40478d
mov word [ebp - 4], 1
mov word [ebp - 2], 0x1f4
push 4
lea eax, [ebp - 4]
push eax
push 0x80
push 0xffff
mov eax, dword [ebp - 8]
push eax
call sub.WSOCK32.dll_setsockopt
mov eax, dword [ebp - 8]
push eax
call sub.WSOCK32.dll_closesocket
mov dword [ebp - 0xc], eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov dword [eax + 0x57f084], 0
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40482c
xor ebx, ebx
call sub.WSOCK32.dll_WSAGetLastError
sub ebx, eax
mov eax, ebx
jmp 0x404850
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov dword [eax + 0x58004c], 0
mov eax, 0x3e8
jmp 0x404850
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404c46
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
and eax, 0xffff
xor ecx, ecx
mov cx, word [0x5537f4]
cmp eax, ecx
jl 0x404c72
mov eax, 0xfffffc15
jmp 0x404df2
mov ax, word [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, ecx
shl ecx, 6
sub ecx, edx
lea ecx, [edx + ecx*4]
shl ecx, 4
mov word [ecx + 0x580044], ax
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov eax, dword [eax + 0x57f084]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00404435
add esp, 8
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
cmp dword [eax + 0x57ffb4], 0
je 0x404d44
movsx eax, word [ebp + 0x10]
push eax
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov eax, dword [eax + 0x580040]
push eax
mov eax, dword [ebp - 4]
push eax
push str.Socket_d__RemoteIP_lx__RemotePort_d_r_n
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
add eax, 0x57f080
add eax, 0x20
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x400
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
add eax, 0x57f080
add eax, 0x20
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00404df7
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
add eax, 0x57f080
add eax, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x404d73
mov eax, 0xfffffc17
jmp 0x404df2
mov eax, dword [ebp - 8]
mov word [eax], 2
mov eax, dword [ebp + 0x10]
push eax
call sub.WSOCK32.dll_htons
mov ecx, dword [ebp - 8]
mov word [ecx + 2], ax
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov eax, dword [eax + 0x580040]
push eax
call sub.WSOCK32.dll_htonl
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
push 0x10
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.WSOCK32.dll_connect
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x404de8
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x404de8
xor eax, eax
sub eax, dword [ebp - 0xc]
jmp 0x404df2
mov eax, 0x3e8
jmp 0x404df2
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404e71
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
and eax, 0xffff
xor ecx, ecx
mov cx, word [0x5537f4]
cmp eax, ecx
jl 0x404ea4
mov eax, 0xfffffc15
jmp 0x404f31
push 3
mov eax, dword [ebp + 8]
push eax
call fcn.00404855
add esp, 8
test eax, eax
je 0x404ec1
xor eax, eax
jmp 0x404f31
push 2
mov eax, dword [ebp + 8]
push eax
call fcn.00404855
add esp, 8
test eax, eax
je 0x404ee1
mov eax, 1
jmp 0x404f31
cmp dword [ebp - 4], 0
jne 0x404ef9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0xc]
add ecx, eax
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 4]
jb 0x404f0f
xor eax, eax
jmp 0x404f31
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov eax, dword [eax + 0x57ffb8]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404ea4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404f36
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
and eax, 0xffff
xor ecx, ecx
mov cx, word [0x5537f4]
cmp eax, ecx
jl 0x404f69
mov eax, 0xfffffc15
jmp 0x40502f
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov eax, dword [eax + 0x57fca4]
add eax, 0x400
mov ecx, dword [ebp + 8]
mov edx, ecx
shl ecx, 6
sub ecx, edx
lea ecx, [edx + ecx*4]
shl ecx, 4
sub eax, dword [ecx + 0x57fca0]
cdq
xor eax, edx
sub eax, edx
and eax, 0x3ff
xor eax, edx
sub eax, edx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x404fbf
mov eax, 1
jmp 0x40502f
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00404855
add esp, 8
test eax, eax
je 0x404fdf
mov eax, 1
jmp 0x40502f
cmp dword [ebp - 4], 0
jne 0x404ff7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0xc]
add ecx, eax
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 4]
jb 0x40500d
xor eax, eax
jmp 0x40502f
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov eax, dword [eax + 0x57ffb8]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404fbf
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405034
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
xor eax, eax
mov ax, word [0x5537f4]
mov ecx, dword [ebp + 8]
and ecx, 0xffff
cmp eax, ecx
jg 0x40506e
mov eax, 0xfffffc15
jmp 0x40522c
cmp dword [ebp + 0x10], 0
jg 0x405082
mov eax, 0xfffffc0e
jmp 0x40522c
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov eax, dword [eax + 0x57f084]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov eax, dword [eax + 0x57fca4]
add eax, 0x400
mov ecx, dword [ebp + 8]
mov edx, ecx
shl ecx, 6
sub ecx, edx
lea ecx, [edx + ecx*4]
shl ecx, 4
sub eax, dword [ecx + 0x57fca0]
cdq
xor eax, edx
sub eax, edx
and eax, 0x3ff
xor eax, edx
sub eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 8], eax
jle 0x4050f5
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], 0
je 0x40516d
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00403df0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x40516d
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
cmp dword [eax + 0x57ffb4], 0
je 0x40516d
push 3
push 0x553868
mov eax, dword [ebp + 8]
push eax
call fcn.00404df7
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00404df7
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x405221
push 2
mov eax, dword [ebp + 8]
push eax
call fcn.00404855
add esp, 8
test eax, eax
jne 0x405197
mov eax, 0xffffffff
jmp 0x40522c
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00404855
add esp, 8
test eax, eax
je 0x405221
push 0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
add eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.WSOCK32.dll_recv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4051da
mov eax, 0xffffffff
jmp 0x40522c
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
cmp dword [eax + 0x57ffb4], 0
je 0x405221
push 3
push 0x55386c
mov eax, dword [ebp + 8]
push eax
call fcn.00404df7
add esp, 0xc
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
add eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00404df7
add esp, 0xc
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x10]
jmp 0x40522c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405231
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor eax, eax
mov ax, word [0x5537f4]
mov ecx, dword [ebp + 8]
and ecx, 0xffff
cmp eax, ecx
jg 0x40525d
mov eax, 0xfffffc15
jmp 0x4053a3
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov eax, dword [eax + 0x57f084]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0x400
jl 0x40528a
mov dword [ebp + 0x10], 0x3ff
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov eax, dword [eax + 0x57fca4]
add eax, 0x400
mov ecx, dword [ebp + 8]
mov edx, ecx
shl ecx, 6
sub ecx, edx
lea ecx, [edx + ecx*4]
shl ecx, 4
sub eax, dword [ecx + 0x57fca0]
cdq
xor eax, edx
sub eax, edx
and eax, 0x3ff
xor eax, edx
sub eax, edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40538a
push 2
mov eax, dword [ebp + 8]
push eax
call fcn.00404855
add esp, 8
test eax, eax
jne 0x4052f6
mov eax, 0xffffffff
jmp 0x4053a3
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00404855
add esp, 8
test eax, eax
je 0x40538a
push 0
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
add eax, 0x57f080
add eax, 0x420
push eax
mov eax, dword [ebp - 4]
push eax
call sub.WSOCK32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x405376
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
add eax, 0x57f080
add eax, 0x420
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00403ce6
add esp, 0xc
jmp 0x40538a
cmp dword [ebp - 0xc], 0
jne 0x40538a
mov eax, 0xffffffff
jmp 0x4053a3
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00403f0b
add esp, 0xc
jmp 0x4053a3
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4055fb
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor eax, eax
mov ax, word [0x5537f4]
mov ecx, dword [ebp + 8]
and ecx, 0xffff
cmp eax, ecx
jg 0x405627
mov eax, 0xfffffc15
jmp 0x405742
cmp dword [ebp + 0x10], 0
jg 0x40563b
mov eax, 0xfffffc0e
jmp 0x405742
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov byte [eax + ecx], 0
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov eax, dword [eax + 0x57f084]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov eax, dword [eax + 0x580048]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00404e71
add esp, 8
test eax, eax
jne 0x405693
mov eax, 0xffffffff
jmp 0x405742
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x10], 0
jle 0x4056f6
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.WSOCK32.dll_send
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x4056d9
xor ebx, ebx
call sub.WSOCK32.dll_WSAGetLastError
sub ebx, eax
mov eax, ebx
jmp 0x405742
xor eax, eax
sub eax, dword [ebp - 0xc]
neg eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40569f
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
cmp dword [eax + 0x57ffb4], 0
je 0x40573a
push 3
push 0x553870
mov eax, dword [ebp + 8]
push eax
call fcn.00404df7
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00404df7
add esp, 0xc
mov eax, dword [ebp + 0x10]
jmp 0x405742
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40587e
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0x10
mov eax, dword [ebp + 8]
and eax, 0xffff
xor ecx, ecx
mov cx, word [0x5537f4]
cmp eax, ecx
jl 0x4058b1
mov eax, 0xfffffc15
jmp 0x405932
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
add eax, 0x57f080
add eax, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, eax
shl eax, 6
sub eax, ecx
lea eax, [ecx + eax*4]
shl eax, 4
mov eax, dword [eax + 0x57f084]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.WSOCK32.dll_getsockname
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x40590a
xor eax, eax
jmp 0x405932
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call sub.WSOCK32.dll_ntohl
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.004040cd
add esp, 0xc
jmp 0x405932
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4064d8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.00406544
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4064fd
mov eax, 1
jmp 0x40653f
mov eax, dword [ebp - 4]
cmp dword [0x5be728], eax
je 0x406535
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0xbb8
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jae 0x40652e
jmp 0x40651a
xor eax, eax
jmp 0x40653f
mov eax, 1
jmp 0x40653f
pop edi
pop esi
pop ebx
leave
ret