joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call fcn.00476ee7
mov eax, dword [ebp + 8]
mov cl, byte [eax]
mov byte [ebp - 8], cl
mov edx, dword [ebp + 8]
mov al, byte [edx + 1]
mov byte [ebp - 0xc], al
mov ecx, dword [ebp + 8]
add ecx, 2
mov dword [ebp - 4], ecx
mov word [ebp - 0x10], 0
jmp 0x4773b7
mov dx, word [ebp - 0x10]
add dx, 1
mov word [ebp - 0x10], dx
movsx eax, word [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jge 0x477491
mov ecx, dword [ebp - 8]
and ecx, 0xff
add ecx, 1
and ecx, 0x800000ff
jns 0x4773e0
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 8], cl
mov edx, dword [ebp - 8]
and edx, 0xff
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cl, byte [eax + edx]
mov edx, dword [ebp - 0xc]
and edx, 0xff
add ecx, edx
and ecx, 0x800000ff
jns 0x47740f
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 0xc], cl
mov eax, dword [ebp - 0xc]
and eax, 0xff
mov ecx, dword [ebp - 4]
add ecx, eax
push ecx
mov edx, dword [ebp - 8]
and edx, 0xff
mov eax, dword [ebp - 4]
add eax, edx
push eax
call fcn.00477277
mov ecx, dword [ebp - 8]
and ecx, 0xff
mov edx, dword [ebp - 4]
xor eax, eax
mov al, byte [edx + ecx]
mov ecx, dword [ebp - 0xc]
and ecx, 0xff
mov edx, dword [ebp - 4]
xor ebx, ebx
mov bl, byte [edx + ecx]
add eax, ebx
and eax, 0x800000ff
jns 0x477466
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp - 0x14], al
movsx eax, word [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
and ecx, 0xff
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp - 4]
mov al, byte [edx + eax]
xor al, byte [esi + ecx]
movsx ecx, word [ebp - 0x10]
mov edx, dword [ebp + 0x14]
mov byte [edx + ecx], al
jmp 0x4773ab
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 8]
mov byte [eax], cl
mov edx, dword [ebp + 8]
mov al, byte [ebp - 0xc]
mov byte [edx + 1], al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401650
Capabilities:
Encrypt data using blowfish

Disassembly:
sub esp, 8
mov ecx, 0x412
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
mov esi, 0x414238
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
cmp ecx, 0x48
jle 0x401676
mov ecx, 0x48
mov edi, dword [esp + 0x20]
push ebp
mov eax, edi
mov ebp, ebx
lea esi, [ecx + edi]
mov dword [esp + 0x1c], 0x12
xor ecx, ecx
mov cl, byte [eax]
inc eax
cmp eax, esi
jb 0x401695
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x4016a5
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x4016b5
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x4016c5
mov eax, edi
mov edx, dword [ebp]
add ebp, 4
xor edx, ecx
mov ecx, dword [esp + 0x1c]
mov dword [ebp - 4], edx
dec ecx
mov dword [esp + 0x1c], ecx
jne 0x40168a
xor eax, eax
mov esi, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov edi, 9
pop ebp
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.00401200
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
add esp, 8
add esi, 8
dec edi
jne 0x4016ed
lea esi, [ebx + 0x48]
mov edi, 0x200
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.00401200
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
add esp, 8
add esi, 8
dec edi
jne 0x401716
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x402e90
Capabilities:
Create thread
Terminate process

Disassembly:
push esi
push edi
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x402eb5
push str.cant_get_handle_to_kernel_library
push eax
push eax
call fcn.00404de0
add esp, 0xc
pop edi
pop esi
ret
push str.RegisterServiceProcess
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x402ed9
push str.cant_get_the_address_of_RegisterServiceProcess__
push eax
push eax
call fcn.00404de0
add esp, 0xc
pop edi
pop esi
ret
push 1
push 0
call esi
add esp, 8
test eax, eax
jne 0x402efd
push str.failed_to_register_service_process
push eax
push eax
call fcn.00404de0
add esp, 0xc
push 1
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [0x41e1c8]
push eax
call dword [0x41e1c4]
push 0
push 0
call esi
add esp, 0xc
test eax, eax
jne 0x402f2d
push str.failed_to_unregister_service_process
push eax
push eax
call fcn.00404de0
add esp, 0xc
push 1
call dword [sym.imp.MSVCRT.dll_exit]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
mov eax, dword [0x41e1c0]
push 0x403070
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
test eax, eax
mov dword [0x41e510], eax
jne 0x402f6e
push str.failed_to_register_service_control_handler
push eax
push eax
call fcn.00404de0
add esp, 0xc
jmp 0x403036
push 0x1388
push 1
push 0
push 2
mov dword [0x41e520], 0x10
mov dword [0x41e530], 0
call fcn.00403100
add esp, 0x10
test eax, eax
je 0x403015
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [0x41e1b8], eax
je 0x403046
push 0x1388
push 2
push 0
push 2
call fcn.00403100
add esp, 0x10
test eax, eax
je 0x403015
mov ecx, dword [0x41e1c8]
mov edx, dword [0x41e1c4]
push ecx
push 0x10000
push edx
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov dword [0x41e1bc], eax
test eax, eax
jne 0x403001
push str.failed_to_create_worker_thread
push eax
push eax
call fcn.00404de0
add esp, 0xc
jmp 0x403036
push 0
push 0
push 0
push 4
call fcn.00403100
add esp, 0x10
test eax, eax
jne 0x403028
push str.failed_to_report_status_to_SCM
push 0
push 0
call fcn.00404de0
add esp, 0xc
jmp 0x403036
mov eax, dword [0x41e1b8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x41e1b8]
test eax, eax
je 0x403046
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x41e510]
test eax, eax
je 0x403064
mov ecx, dword [0x41e53c]
push 0
push 0
push ecx
push 1
call fcn.00403100
add esp, 0x10
ret
Function at 0x4032b0
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebx
push ebp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x4032d0
push str.cant_open_SCM_database
jmp 0x40330b
mov ebp, dword [esp + 0x18]
push 0
mov esi, dword [esp + 0x18]
push 0
push 0
push 0
push 0
push ebp
push 1
push 2
push 0x10
push 0xf01ff
push esi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
call ebx
test edi, edi
jne 0x403321
push str.cant_create_service
push 0
push 0
call fcn.00404de0
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call ebx
push ebp
push esi
push str._s_service_installed_to_run__s
push 0
push 1
call fcn.00404de0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x403340
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push edi
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x403363
push str.cant_locate_registry_key
jmp 0x40339b
mov esi, dword [esp + 0x14]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x10]
not ecx
push ecx
mov ecx, dword [esp + 0xc]
push esi
push 1
push eax
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4033b0
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.failed_to_add_value_to_registry
push 0
push 0
call fcn.00404de0
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ecx
ret
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push edi
push str._s_service_installed_to_run__s
push 0
push 1
call fcn.00404de0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ecx
ret
Function at 0x403430
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
sub esp, 0x24
push ebp
push 0xf003f
push 0
push 0
mov dword [esp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
mov dword [esp + 8], ebp
je 0x403577
push esi
push edi
mov edi, dword [esp + 0x34]
push 0xf01ff
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x40354b
lea eax, [esp + 0x14]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4034e3
lea ecx, [esp + 0x14]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push ecx
push esi
call ebx
test eax, eax
je 0x4034bf
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x1c], 3
jne 0x4034bb
push 0x3e8
call ebp
lea edx, [esp + 0x18]
push edx
push esi
call ebx
test eax, eax
jne 0x4034a1
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
pop ebx
cmp eax, 1
je 0x4034e3
push edi
push str.failed_to_stop_the__s_service
push 0
push 0
call fcn.00404de0
add esp, 0x10
mov dword [esp + 0xc], 1
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
push edi
je 0x403519
push str.successfully_removed_the__s_service
push 0
push 1
call fcn.00404de0
add esp, 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x24
ret
push str.failed_to_remove_the__s_service
push 0
push 0
call fcn.00404de0
add esp, 0x10
mov dword [esp + 0xc], 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x24
ret
push edi
push str.cant_find_the__s_service
push 0
push 0
call fcn.00404de0
add esp, 0x10
mov dword [esp + 0xc], 1
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x24
ret
push str.cant_contact_Service_Control_Manager
push 0
push 0
call fcn.00404de0
add esp, 0xc
mov eax, 1
pop ebp
add esp, 0x24
ret
Function at 0x4035a0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ecx
lea eax, [esp]
push edi
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.WS2_32.dll_bind
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4035d4
push str.cant_find_the_RunServices_registry_key
push edi
push edi
call fcn.00404de0
add esp, 0xc
mov eax, 1
pop edi
pop ecx
ret
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
push esi
je 0x403611
push str.failed_to_delete_registry_RunServices_entry_for__s
push 0
push 0
call fcn.00404de0
mov edx, dword [esp + 0x18]
add esp, 0x10
mov edi, 1
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop esi
pop edi
pop ecx
ret
push str.successfully_removed_the__s_service
push 0
push 1
call fcn.00404de0
mov edx, dword [esp + 0x18]
add esp, 0x10
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop esi
pop edi
pop ecx
ret

Function at 0x403640
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
ret
Function at 0x404d80
Capabilities:
Access the windows event log

Disassembly:
sub esp, 8
mov eax, dword [str.zebedee]
push esi
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov ecx, dword [esp + 0x14]
mov esi, eax
test esi, esi
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
je 0x404dd4
mov eax, dword [esp + 0x10]
lea edx, [esp + 4]
push 0
push edx
push 0
push 1
push 0
push 0
push eax
neg ax
sbb eax, eax
and eax, 3
inc eax
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
add esp, 8
ret

Function at 0x405100
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
push ebx
push ebp
mov ebp, dword [esp + 0x118]
push esi
push edi
xor ebx, ebx
mov eax, dword [0x41e3f0]
test ax, ax
je 0x405155
and eax, 0xffff
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
lea edx, [ebp + 1]
push ecx
push edx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], 1
call sub.WS2_32.dll_select
test eax, eax
je 0x4051bc
mov eax, dword [esp + 0x128]
mov esi, ebx
and eax, 0xffff
and esi, 0xffff
mov edi, eax
push eax
sub edi, esi
push edi
push str.readData:_receiving__d_of__d
push 0
push 5
call fcn.00404de0
mov eax, dword [esp + 0x138]
add esp, 0x14
add esi, eax
push 0
push edi
push esi
push ebp
call sub.WS2_32.dll_recv
mov esi, eax
test esi, esi
jle 0x4051e2
push esi
push str.readData:_read__d_byte_s_
push 0
push 5
call fcn.00404de0
add ebx, esi
add esp, 0x10
cmp bx, word [esp + 0x128]
jae 0x405207
jmp 0x405113
push str.timed_out_reading_data
call dword [sym.imp.MSVCRT.dll__errno]
mov ecx, dword [eax]
push ecx
push 0
call fcn.00404de0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
push str.readData:_EOF_or_error
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, dword [eax]
push edx
push 5
call fcn.00404de0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
pop edi
mov eax, ebx
pop esi
pop ebp
and eax, 0xffff
pop ebx
add esp, 0x10c
ret
Function at 0x405270
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
and ebx, 0xffff
push edi
push ebx
xor ebp, ebp
push ebx
push str.writeData:_sending__d_of__d
push ebp
push 5
call fcn.00404de0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
add esp, 0x14
push ebp
push ebx
push eax
push ecx
call sub.WS2_32.dll_send
mov esi, eax
test esi, esi
jle 0x4052fd
push esi
push str.writeData:_sent__d_byte_s_
push 0
push 5
add ebp, esi
call fcn.00404de0
add esp, 0x10
cmp bp, word [esp + 0x1c]
jae 0x40531c
mov esi, ebp
mov edi, ebx
and esi, 0xffff
push ebx
sub edi, esi
push edi
push str.writeData:_sending__d_of__d
push 0
push 5
call fcn.00404de0
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
add esp, 0x14
add esi, edx
push 0
push edi
push esi
push eax
call sub.WS2_32.dll_send
mov esi, eax
test esi, esi
jg 0x4052a9
push str.writeData:_EOF_or_error
call dword [sym.imp.MSVCRT.dll__errno]
mov ecx, dword [eax]
push ecx
push 5
call fcn.00404de0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
mov eax, ebp
pop esi
pop ebp
and eax, 0xffff
pop ebx
ret
Function at 0x4059b0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
mov dword [esp + 0x14], 1
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], 0x20
call fcn.00404bc0
mov esi, dword [esp + 0x24]
push 0x2f
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 0xc
test eax, eax
je 0x405a62
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
add esp, 4
cmp edi, ebp
mov dword [esp + 0x18], edi
je 0x405a20
lea eax, [esp + 0x14]
push eax
push edi
push str.______hu
push esi
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x10
cmp eax, 2
je 0x405a2c
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], ebp
mov dword [esp + 0x10], ebp
mov esi, edi
mov edi, dword [esp + 0x2c]
cmp edi, ebp
je 0x405a62
mov eax, dword [esp + 0x14]
cmp ax, bp
jbe 0x405a45
cmp ax, 0x20
jbe 0x405a4e
mov eax, 0x20
mov dword [esp + 0x14], eax
mov ecx, 0x20
or edx, 0xffffffff
sub ecx, eax
shl edx, cl
push edx
call sub.WS2_32.dll_htonl
mov dword [edi], eax
push esi
call sub.WS2_32.dll_inet_addr
mov ecx, dword [esp + 0x24]
cmp eax, 0xffffffff
lea ebx, [ecx + 4]
mov dword [ebx], eax
jne 0x405aa9
push esi
call sub.WS2_32.dll_gethostbyname
mov ebp, eax
test ebp, ebp
jne 0x405a90
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], ebp
mov dword [esp + 0x10], ebp
jmp 0x405aa9
movsx ecx, word [ebp + 0xa]
mov edx, dword [ebp + 0xc]
mov eax, ecx
mov edi, ebx
mov esi, dword [edx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x28]
test edi, edi
je 0x405b2b
test ebp, ebp
je 0x405b0d
mov eax, dword [ebp + 0xc]
xor esi, esi
cmp dword [eax], 0
je 0x405aca
mov ecx, dword [eax + 4]
add eax, 4
inc esi
test ecx, ecx
jne 0x405abf
lea ecx, [esi + 1]
push 4
push ecx
call dword [sym.imp.MSVCRT.dll_calloc]
add esp, 8
mov dword [edi], eax
test eax, eax
jne 0x405ae5
mov dword [esp + 0x10], eax
jmp 0x405b2b
xor eax, eax
test esi, esi
jle 0x405aff
mov edx, dword [ebp + 0xc]
inc eax
cmp eax, esi
mov ecx, dword [edx + eax*4 - 4]
mov edx, dword [edi]
mov ecx, dword [ecx]
mov dword [edx + eax*4 - 4], ecx
jl 0x405aeb
mov edx, dword [edi]
mov dword [edx + eax*4], 0xffffffff
lea eax, [edx + eax*4]
jmp 0x405b2b
push 4
push 2
call dword [sym.imp.MSVCRT.dll_calloc]
mov dword [edi], eax
mov ecx, dword [ebx]
mov dword [eax], ecx
mov edx, dword [edi]
add esp, 8
add edx, 4
mov dword [edx], 0xffffffff
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
je 0x405b41
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
push 0
call fcn.00404be0
mov eax, dword [esp + 4]
add esp, 0x10
ret
Function at 0x405b90
Capabilities:
Connect socket
Connect udp socket
Create udp socket

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x20]
push esi
push edi
test ebx, ebx
jne 0x405bd6
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x405bd6
mov eax, dword [0x41e3f8]
test eax, eax
je 0x405bd6
cmp word [0x41e3fc], bx
je 0x405bd6
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
push ecx
push edx
call fcn.00405d20
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x10
ret
xor eax, eax
push 0
test ebx, ebx
setne al
inc eax
push eax
push 2
call sub.WS2_32.dll_socket
mov esi, eax
test esi, esi
jge 0x405c1a
mov esi, dword [sym.imp.MSVCRT.dll__errno]
push str.socket_creation_failed
call esi
mov ecx, dword [eax]
push ecx
push 0
call fcn.00404de0
add esp, 0xc
call esi
pop edi
mov dword [eax], 0
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x405c68
mov eax, dword [eax + 4]
test eax, eax
je 0x405c68
xor edx, edx
push 0x10
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x18], edx
push eax
push esi
mov dword [esp + 0x24], edx
call sub.WS2_32.dll_bind
test eax, eax
jge 0x405c68
push str.WARNING:_failed_to_set_connection_source_address____ignored
call dword [sym.imp.MSVCRT.dll__errno]
mov ecx, dword [eax]
push ecx
push 1
call fcn.00404de0
add esp, 0xc
xor edx, edx
mov edi, dword [esp + 0x20]
mov dword [esp + 0xc], edx
lea eax, [esp + 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
push edx
push edx
push eax
push edi
mov dword [esp + 0x28], edx
call fcn.004059b0
add esp, 0x10
test eax, eax
jne 0x405cac
push edi
push str.cant_resolve_host_or_address__s
push eax
push eax
call fcn.00404de0
add esp, 0x10
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov ecx, dword [esp + 0x24]
mov word [esp + 0xc], 2
push ecx
call sub.WS2_32.dll_htons
test ebx, ebx
mov word [esp + 0xe], ax
jne 0x405cf0
push esi
call fcn.004060f0
add esp, 4
lea edx, [esp + 0xc]
push 0x10
push edx
push esi
call sub.WS2_32.dll_connect
test eax, eax
jge 0x405cf0
push esi
call sub.WS2_32.dll_closesocket
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x34]
test eax, eax
je 0x405d13
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x405f60
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x34]
xor eax, eax
push esi
test ebx, ebx
setne al
push edi
inc eax
push 0
push eax
push 2
mov dword [esp + 0x18], 0x10
call sub.WS2_32.dll_socket
mov edi, eax
test edi, edi
jge 0x405f9f
mov esi, dword [sym.imp.MSVCRT.dll__errno]
push str.cant_create_listener_socket
call esi
mov ecx, dword [eax]
push ecx
jmp 0x4060b2
xor edx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
push edx
mov dword [esp + 0x20], edx
call sub.WS2_32.dll_htonl
mov esi, dword [esp + 0x38]
mov dword [esp + 0x14], eax
test esi, esi
je 0x405fe9
push 0
lea eax, [esp + 0x14]
push 0
push eax
push esi
call fcn.004059b0
add esp, 0x10
test eax, eax
jne 0x405fe9
push esi
push str.cant_resolve_listen_address__s
push eax
push eax
call fcn.00404de0
add esp, 0x10
mov esi, dword [esp + 0x34]
mov word [esp + 0x10], 2
test esi, esi
je 0x406008
mov cx, word [esi]
push ecx
call sub.WS2_32.dll_htons
mov word [esp + 0x12], ax
jmp 0x40600f
mov word [esp + 0x12], 0
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
push eax
call fcn.00405b50
push eax
push str.listening_on__s
push 0
push 5
call fcn.00404de0
mov ecx, dword [esp + 0x24]
add esp, 0x18
lea edx, [esp + 0x10]
push ecx
push edx
push edi
call sub.WS2_32.dll_bind
test eax, eax
je 0x406056
mov esi, dword [sym.imp.MSVCRT.dll__errno]
push str.listener_bind_failed
call esi
mov eax, dword [eax]
push eax
jmp 0x4060b2
test ebx, ebx
jne 0x406078
push 5
push edi
call sub.WS2_32.dll_listen
test eax, eax
jge 0x406078
mov esi, dword [sym.imp.MSVCRT.dll__errno]
push str.listen_failed
call esi
mov ecx, dword [eax]
push ecx
jmp 0x4060b2
test esi, esi
je 0x4060e6
xor edx, edx
lea eax, [esp + 0xc]
mov dword [esp + 0x10], edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
mov dword [esp + 0x1c], edx
push ecx
push edi
mov dword [esp + 0x28], edx
call sub.WS2_32.dll_getsockname
test eax, eax
je 0x4060d9
mov esi, dword [sym.imp.MSVCRT.dll__errno]
push str.cant_get_local_port_number
call esi
mov edx, dword [eax]
push edx
push 0
call fcn.00404de0
add esp, 0xc
cmp edi, 0xffffffff
je 0x4060c7
push edi
call sub.WS2_32.dll_closesocket
call esi
pop edi
mov dword [eax], 0xffffffff
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x24
ret
mov eax, dword [esp + 0x12]
push eax
call sub.WS2_32.dll_ntohs
mov word [esi], ax
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x24
ret

Function at 0x4060f0
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push 4
push eax
push 0x80
push 0xffff
push ecx
mov word [esp + 0x14], 0
mov word [esp + 0x16], 0
call sub.WS2_32.dll_setsockopt
test eax, eax
jge 0x40612f
push str.Warning:_failed_to_set_SO_LINGER_option_on_socket
push 0
push 1
call fcn.00404de0
add esp, 0xc
pop ecx
ret
Function at 0x406140
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push 4
push eax
push 8
push 0xffff
push ecx
mov dword [esp + 0x14], 1
call sub.WS2_32.dll_setsockopt
test eax, eax
jge 0x406176
push str.Warning:_failed_to_set_SO_KEEPALIVE_option_on_socket
push 0
push 1
call fcn.00404de0
add esp, 0xc
pop ecx
ret