joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425090
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46c6a8
push 0x42879a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x42514b
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42514b
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x4250f0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea edx, [ebp - 0x1c]
push edx
push 0xf003f
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42514b
mov dword [ebp - 4], eax
push esi
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
push 0xffffffffffffffff
jne 0x42513f
lea ecx, [ebp - 0x10]
push ecx
call sub.MSVCRT.dll__local_unwind2
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea edx, [ebp - 0x10]
push edx
call sub.MSVCRT.dll__local_unwind2
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x425170
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x108
test eax, eax
push ebx
mov ebx, ecx
je 0x4251f7
push esi
push edi
push 1
push 0
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00420ea0
mov edi, dword [eax]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
dec ecx
push reloc.WS2_32.dll_bind
push ecx
lea ecx, [esp + 0x20]
push ecx
push 0x479130
mov ecx, ebx
call fcn.00425010
pop edi
pop esi
pop ebx
add esp, 0x108
ret 4
push 0x479130
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
mov ecx, ebx
call fcn.00425090
pop ebx
add esp, 0x108
ret 4
Function at 0x425330
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x466108
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
push edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], esp
call sub.MFC42.DLL_AFX_EXCEPTION_LINK::AFX_EXCEPTION_LINK
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x14c]
lea ecx, [ebx + 0x14c]
push 0
push 0x9011
mov dword [ebp - 4], 0
push edx
mov byte [ebp - 4], 1
call dword [eax + 0x28]
mov edi, str.XFILTER_PASSECK
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0x18
call fcn.00425440
xor ecx, ecx
test eax, eax
setne cl
mov esi, ecx
test esi, esi
je 0x4253e8
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_AfxTryCleanup
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, ebx
call fcn.00425660
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_AfxTryCleanup
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x425440
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x466128
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], esp
call sub.MFC42.DLL_AFX_EXCEPTION_LINK::AFX_EXCEPTION_LINK
mov eax, dword [edi + 0x14c]
lea esi, [edi + 0x14c]
push 0
mov dword [ebp - 4], 0
push 0
mov ecx, esi
mov byte [ebp - 4], 1
call dword [eax + 0x30]
mov edx, dword [esi]
add edi, 0x1c
push 0x18
push edi
mov ecx, esi
call dword [edx + 0x40]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_AfxTryCleanup
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426990
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x466298
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x58]
test eax, eax
jne 0x426a3a
push esi
lea ecx, [esp + 8]
call fcn.004280dc
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReleaseBuffer
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.00428478
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x426a21
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x426a21
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x58], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x427c39
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x427c91
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x487570
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x427c84
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x427c93
xor eax, eax
pop esi
leave
ret 4

Function at 0x427e50
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea ecx, [esp]
mov eax, dword [esp + 0x58]
lea edx, [esp + 0x10]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x427e89
add esp, 0x54
ret
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x427eb4
mov ecx, dword [esp]
push esi
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
pop esi
mov eax, dword [esp]
add esp, 0x54
ret
Function at 0x427ec0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46caa8
push 0x42879a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x427f5d
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x427f4f
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp + 0x1c]
jne 0x427f4f
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call sub.MSVCRT.dll__local_unwind2
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
push ecx
call sub.MSVCRT.dll__local_unwind2
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4289f0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x428a2a
mov ax, word [esp]
cmp al, 2
jne 0x428a24
xor ecx, ecx
mov cl, ah
cmp cl, al
jne 0x428a24
xor eax, eax
add esp, 0x190
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
add esp, 0x190
ret
Function at 0x434e40
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
push eax
push esi
mov edi, dword [esi + eax*4 + 0x190]
call fcn.00434ed0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
add esp, 8
push 0
push eax
push ecx
push edi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [esp + 0x24]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebx], 0
jne 0x434ec4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x434e9e
pop edi
pop esi
mov dword [ebx], 0x51
pop ebp
xor eax, eax
pop ebx
ret
push ebp
push esi
call fcn.0043a350
mov edx, dword [esi]
push eax
push str.Send_failure:__s
push edx
call fcn.00434c50
mov eax, dword [esi]
add esp, 0x14
mov dword [eax + 0x4724], ebp
mov dword [ebx], 0x37
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x434ed0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
mov edx, ecx
push ebx
shl edx, 4
push esi
push edi
mov edi, dword [edx + eax + 0x1bc]
lea esi, [edx + eax + 0x1b8]
mov ebx, dword [eax + ecx*4 + 0x190]
mov edx, dword [esi + 8]
sub edi, edx
mov edx, dword [eax + 0x308]
test byte [edx + 0x3c], 3
je 0x434f92
cmp dword [eax + ecx*4 + 0x1a8], 0x434fe0
jne 0x434f92
cmp dword [esi], 0
je 0x434f20
test edi, edi
je 0x434f92
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.00428dc0
add esp, 0x10
cmp eax, 0xffffffff
je 0x434f92
test al, 1
je 0x434f92
cmp dword [esi], 0
jne 0x434f65
push 0x8000
mov dword [esi + 4], 0x8000
call dword [0x479e74]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, dword [esi]
test eax, eax
je 0x434f8b
mov ecx, dword [esi + 8]
push 0
add eax, ecx
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x434f92
mov ecx, dword [esi + 8]
pop edi
add ecx, eax
mov dword [esi + 8], ecx
pop esi
pop ebx
ret
mov dword [esi + 4], 0
pop edi
pop esi
pop ebx
ret

Function at 0x4353c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x4353f1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and al, 0xe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret
Function at 0x435640
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x1a0]
test eax, eax
je 0x43566d
mov ecx, dword [esi + 0x12c]
mov edx, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
push ecx
push edx
push esi
call eax
add esp, 0x14
pop esi
ret
mov eax, dword [esp + 0xc]
test eax, eax
jl 0x4356af
cmp eax, 2
jg 0x4356af
mov ecx, dword [esi + 0x128]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fwrite]
push ecx
push 1
lea edx, [eax + eax*2 + 0x46cc10]
push 2
push edx
call edi
mov eax, dword [esi + 0x128]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push eax
push 1
push ecx
push edx
call edi
add esp, 0x20
pop edi
xor eax, eax
pop esi
ret

Function at 0x4379b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x10c]
push ebp
push esi
mov eax, dword [ebx + 0x8c]
mov ebp, dword [ebx]
cmp eax, 2
push edi
je 0x437b3a
mov eax, dword [ebx + 0x270]
test eax, eax
jne 0x437b31
mov eax, dword [ebx + 0x2e0]
test eax, eax
jne 0x437b31
mov esi, dword [esp + 0x11c]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x94]
push eax
mov edi, 0x80
push ecx
push esi
mov dword [esp + 0x1c], edi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x437a40
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebx
call fcn.0043a350
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebp
call fcn.00434c50
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
mov dword [esp + 0x10], edi
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x437a90
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebx
call fcn.0043a350
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebp
call fcn.00434c50
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
lea ecx, [ebx + 0x130]
lea esi, [ebx + 0x102]
push ecx
lea edx, [esp + 0x98]
push esi
push edx
call fcn.00437b50
add esp, 0xc
test eax, eax
jne 0x437adc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebx
call fcn.0043a350
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebp
call fcn.00434c50
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
lea edi, [ebx + 0x58]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
lea eax, [ebx + 0x164]
lea ecx, [ebx + 0x134]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
movsw word es:[edi], word [esi]
call fcn.00437b50
add esp, 0xc
test eax, eax
jne 0x437b31
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebx
call fcn.0043a350
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebp
call fcn.00434c50
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
push ebx
call fcn.00437930
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x438060
Capabilities:
Set socket configuration

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push 4
mov esi, dword [edi]
push eax
push 1
push 6
push ecx
mov dword [esp + 0x20], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x4380a9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.0043a350
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.00434be0
add esp, 0x14
pop edi
pop esi
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.00434be0
add esp, 8
pop edi
pop esi
ret

Function at 0x4380c0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
mov eax, dword [0x499df0]
push esi
test eax, eax
mov dword [esp + 8], 0x4020
mov dword [esp + 4], 0
mov dword [esp + 0xc], 4
jne 0x438113
push 3
push 2
push eax
push 6
call fcn.00457770
add esp, 0x10
test eax, eax
je 0x438107
mov dword [0x499df0], 2
pop esi
add esp, 0xc
ret
mov dword [0x499df0], 1
jmp 0x438118
cmp eax, 2
je 0x43815f
mov esi, dword [esp + 0x14]
lea eax, [esp + 0xc]
lea ecx, [esp + 4]
push eax
push ecx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x438147
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, eax
jg 0x43815f
lea eax, [esp + 8]
push 4
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
pop esi
add esp, 0xc
ret
Function at 0x438440
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
xor eax, eax
push edi
mov ecx, dword [esi + 0x520]
mov edi, dword [esp + 0x1c]
test ecx, ecx
lea ecx, [esp + 0x18]
push 4
push ecx
push 8
setne al
push 0xffff
push edi
mov dword [esp + 0x2c], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x43848c
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.00434be0
add esp, 0xc
pop edi
pop esi
add esp, 0xc
ret
mov edx, dword [esi + 0x524]
mov dword [esp + 8], 1
push edx
call fcn.004503e0
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x528]
push eax
call fcn.004503e0
add esp, 8
lea eax, [eax + eax*4]
lea ecx, [esp + 0x1c]
lea edx, [esp + 8]
push 0
push 0
lea eax, [eax + eax*4]
push ecx
push 0
push 0
lea eax, [eax + eax*4]
push 0xc
push edx
push 0x98000004
shl eax, 3
push edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x438511
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.00434be0
add esp, 0x10
pop edi
pop esi
add esp, 0xc
ret
Function at 0x438ad0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x1d8]
test ecx, ecx
je 0x438ae1
xor eax, eax
ret
mov eax, dword [eax + 0x190]
cmp eax, 0xffffffff
jne 0x438aef
xor eax, eax
ret
push 2
lea ecx, [esp + 8]
push 1
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x438cd0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push 0
push eax
push ecx
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x438cf4
cmp eax, 0xffffffff
jne 0x438cf6
xor eax, eax
ret
Function at 0x446350
Capabilities:
Send data
Send data on socket

Disassembly:
mov al, byte [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push 0
lea ecx, [esp + 0x14]
mov edx, dword [esi + 0x190]
mov edi, dword [esi]
push 3
push ecx
push edx
mov byte [esp + 0x20], 0xff
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], al
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x44639d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.00434c50
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esi]
push eax
push ebx
push str.SENT
push ecx
call fcn.004463c0
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x447570
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push edi
mov eax, dword [eax]
mov dword [esp + 8], eax
mov edi, dword [eax + 0x124]
mov eax, dword [esp + 0x14]
cmp eax, 0x1f
jne 0x4476d9
push ebp
push esi
lea ebp, [edi + 0x1cb0]
lea esi, [edi + 0x1eb0]
cmp ebp, esi
mov dword [esi], ebp
jae 0x4475ad
mov byte [ebp], 0xff
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, esi
jae 0x4475bb
mov byte [eax], 0xfa
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, esi
jae 0x4475c9
mov byte [eax], 0x1f
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov cx, word [edi + 0x1ca8]
mov ebx, dword [sym.imp.WS2_32.dll_htons]
push ecx
call ebx
mov dx, word [edi + 0x1caa]
mov dword [esp + 0x1c], eax
push edx
call ebx
mov ecx, dword [esi]
cmp ecx, esi
jae 0x4475f8
mov dl, byte [esp + 0x1c]
mov byte [ecx], dl
mov ecx, dword [esi]
inc ecx
mov dword [esi], ecx
mov ecx, dword [esi]
cmp ecx, esi
jae 0x447609
mov dl, byte [esp + 0x1d]
mov byte [ecx], dl
mov ecx, dword [esi]
inc ecx
mov dword [esi], ecx
mov ecx, dword [esi]
cmp ecx, esi
jae 0x447616
mov byte [ecx], al
mov ecx, dword [esi]
inc ecx
mov dword [esi], ecx
mov ecx, dword [esi]
cmp ecx, esi
jae 0x447623
mov byte [ecx], ah
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, esi
jae 0x447631
mov byte [eax], 0xff
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, esi
jae 0x44763f
mov byte [eax], 0xf0
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov eax, dword [esi]
mov ebx, dword [esp + 0x10]
mov ecx, eax
lea edx, [edi + 0x1cb2]
sub ecx, ebp
mov dword [edi + 0x1eb4], eax
sub ecx, 2
mov dword [esi], ebp
push ecx
push edx
push 0x3e
push ebx
call fcn.00447260
add esp, 0x10
mov esi, dword [sym.imp.WS2_32.dll_send]
push 0
push 3
push ebp
mov ebp, dword [esp + 0x24]
mov eax, dword [ebp + 0x190]
push eax
call esi
test eax, eax
jge 0x447698
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.00434c50
add esp, 0xc
lea ecx, [edi + 0x1cb3]
push 4
push ecx
push ebp
call fcn.004476e0
mov edx, dword [ebp + 0x190]
add esp, 0xc
add edi, 0x1cb7
push 0
push 2
push edi
push edx
call esi
pop esi
pop ebp
test eax, eax
jge 0x4476d9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.00434c50
add esp, 0xc
pop edi
pop ebx
pop ecx
ret
Function at 0x449b90
Capabilities:
Check http status code

Disassembly:
mov ecx, dword [esp + 8]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
shr eax, 0x1f
mov ebx, dword [edi]
add edx, eax
cmp edx, 2
je 0x449bcc
push str.Couldnt_set_desired_mode
push ebx
call fcn.00434c50
add esp, 8
mov eax, 0x11
pop edi
pop esi
pop ebx
ret
cmp ecx, 0xc8
je 0x449be3
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.00434be0
add esp, 0xc
mov eax, dword [esp + 0x18]
cmp eax, 0x13
jne 0x449bfb
push edi
call fcn.00448630
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebx
ret
cmp eax, 0x14
jne 0x449c0f
push edi
call fcn.00449c40
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebx
ret
cmp eax, 0x15
jne 0x449c23
push edi
call fcn.00449d60
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebx
ret
cmp eax, 0x16
jne 0x449c33
push edi
call fcn.00449d80
add esp, 4
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x44a340
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x20]
push edi
mov ebp, dword [esi + 0x194]
mov ebx, dword [esi]
lea ecx, [esp + 0x10]
push eax
push ecx
push ebp
or edi, 0xffffffff
mov dword [esp + 0x30], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x44a38e
lea edx, [esp + 0x24]
lea eax, [esp + 0x10]
push edx
push eax
push ebp
mov dword [esp + 0x30], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push ebp
push esi
call fcn.00438b10
add esp, 8
cmp edi, 0xffffffff
jne 0x44a3b8
push str.Error_accept__ing_server_connect
push ebx
call fcn.00434c50
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push str.Connection_accepted_from_server_n
push ebx
call fcn.00434be0
push 1
push edi
mov dword [esi + 0x298], 0
mov dword [esi + 0x194], edi
call fcn.00457a20
mov dword [esi + 0x1a4], 1
mov eax, dword [ebx + 0x1a8]
add esp, 0x10
test eax, eax
je 0x44a41b
mov ecx, dword [ebx + 0x1ac]
push 1
push edi
push ecx
call eax
add esp, 0xc
test eax, eax
je 0x44a41b
push esi
call fcn.00448f10
add esp, 4
mov eax, 0x2a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x450400
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push eax
call fcn.004503f0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0x10
ret