joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aad61
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x521500]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4aadac
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004ab223
test al, al
jne 0x4aada6
sub edx, 2
cmp edx, edi
jne 0x4aad8c
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4aadce
lea eax, [edi + 2]
cmp edx, eax
je 0x4aadce
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004aa95a
add esp, 0x10
jmp 0x4aaec8
push esi
lea ecx, [ebp - 0x255]
call fcn.004ab223
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4aae11
push dword [ebp - 0x25c]
jmp 0x4aadbe
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4aae4e
cmp word [ebp - 0x226], 0
je 0x4aae6f
cmp word [ebp - 0x226], ax
jne 0x4aae4e
cmp word [ebp - 0x224], 0
je 0x4aae6f
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004aa95a
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4aaebb
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4aae28
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4aaea3
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4aaec8
push 0x4aa342
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00405b5f
add esp, 0x10
jmp 0x4aae98
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403337
leave
ret
Function at 0x403330
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x40548b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x318
push ebx
push ebp
xor ebx, ebx
xor ebp, ebp
push esi
mov dword [esp + 0x14], ebx
push edi
mov dword [esp + 0x1c], ebp
mov esi, 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x330], esi
mov dword [esp + 0x20], 0x104
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x14]
mov byte [esp + 0x330], 2
push eax
push 0x20019
push ebx
push str.SoftwareWebPlayerRMCodecs
push 0x80000000
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40345a
mov ebp, dword [esp + 0x14]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x24]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push ebx
push ebx
push ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x40345a
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40345a
cmp ebp, ebx
je 0x4033f4
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebp, ebp
mov dword [esp + 0x1c], ebp
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
mov edx, dword [esp + 0x10]
mov esi, dword [edx - 8]
mov al, byte [esp + esi + 0x23]
cmp al, 0x5c
je 0x403420
cmp al, 0x2f
je 0x403420
push 0x5c
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
add esi, 0xfffffff6
lea eax, [esp + 0x14]
push esi
push eax
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x334], 3
call fcn.00404c18
lea ecx, [esp + 0x14]
mov byte [esp + 0x330], 2
call fcn.00404a98
jmp 0x4034db
lea ecx, [esp + 0x128]
push 0x200
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, ebx
jne 0x4034a8
mov edi, dword [esp + 0x338]
push str.C:Program_FilesVIEWGOODWebPlayer_V6.0_
mov ecx, edi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x18], esi
lea ecx, [esp + 0x10]
mov byte [esp + 0x330], 1
call fcn.00404a98
cmp ebp, ebx
je 0x4034a4
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x403514
lea edi, [esp + 0x128]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x12a], bl
repne scasb al, byte es:[edi]
dec edi
mov ecx, 0xa
mov esi, str.Program_FilesVIEWGOODWebPlayer_V6.0_
lea edx, [esp + 0x128]
rep movsd dword es:[edi], dword [esi]
push edx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
mov esi, dword [esp + 0x338]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], 1
mov byte [esp + 0x330], 1
call fcn.00404a98
cmp ebp, ebx
je 0x403512
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x328]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x324
ret 4
Function at 0x4048c0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x405668
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
push 0
push 0x40835c
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0
call sub.MFC42.DLL_CString::Find
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
mov bl, 1
inc esi
lea ecx, [esp + 0x24]
push esi
push 0x40835c
call sub.MFC42.DLL_CString::Find
mov esi, eax
cmp esi, 0xffffffff
je 0x404965
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x10]
push esi
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], bl
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 2
call fcn.00404c18
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call fcn.00404a98
mov ecx, dword [esp + 0xc]
push 0
push ecx
call edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 0
call fcn.00404a98
jmp 0x4048fd
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00404a98
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x403ac0
Capabilities:
Access peb ldr_data
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x46db41
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebp
push esi
push edi
call fcn.00421640
mov eax, dword [eax + 0x40]
or al, 1
push eax
call fcn.00421640
mov ecx, eax
call fcn.00421420
mov eax, dword [0x4885a0]
mov dword [esp + 0x18], eax
mov dword [esp + 0x12c], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
push str.skins_vista.ski
push 0x491088
lea eax, [esp + 0x20]
push str._s_s
push eax
mov byte [esp + 0x13c], 2
call fcn.0045f3f0
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x31]
mov byte [esp + 0x30], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 0x10
mov ebp, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
stosb byte es:[edi], al
push ecx
lea eax, [esp + 0x20]
push edx
push eax
push str.skin
push str.SoftwareNetSoftp2pover_skin
push SysReAllocString
mov dword [esp + 0x34], 1
mov dword [esp + 0x2c], 0x104
call ebp
mov esi, 0x490fb0
lea eax, [esp + 0x20]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403bad
test cl, cl
je 0x403ba9
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403bad
add eax, 2
add esi, 2
test cl, cl
jne 0x403b89
xor eax, eax
jmp 0x403bb2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403bc6
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
call fcn.0046404f
jmp 0x403bd4
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x14]
call fcn.0046409f
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x20]
push eax
push ecx
push str.color
push str.SoftwareNetSoftp2pover_skin
push SysReAllocString
mov dword [esp + 0x2c], 0x104
call ebp
mov esi, 0x490fb0
lea eax, [esp + 0x20]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403c36
test cl, cl
je 0x403c32
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403c36
add eax, 2
add esi, 2
test cl, cl
jne 0x403c12
xor eax, eax
jmp 0x403c3b
sbb eax, eax
sbb eax, 0xffffffff
pop edi
pop esi
test eax, eax
pop ebp
jne 0x403c49
push str.NormalBlue.ini
jmp 0x403c4e
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 4]
call fcn.0046409f
mov ecx, dword [esp]
mov edx, dword [esp + 4]
push ecx
push edx
call fcn.00421640
mov ecx, eax
call fcn.00421280
lea ecx, [esp]
mov byte [esp + 0x120], 1
call fcn.00463f16
lea ecx, [esp + 4]
mov byte [esp + 0x120], 0
call fcn.00463f16
lea ecx, [esp + 0xc]
mov dword [esp + 0x120], 0xffffffff
call fcn.00463f16
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
add esp, 0x124
ret
Function at 0x403f30
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + 0x4872d4]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x487264]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x403f43
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp word [esp + 0x10c], 1
je 0x403f85
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x48730c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x403fb7
mov bl, byte [esp + ecx + 0x4c]
jmp 0x403fbb
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x403fac
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x403fd9
mov bl, byte [esp + ecx + 0x4c]
jmp 0x403fdd
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x403fce
xor ecx, ecx
mov eax, 0x487274
xor ebx, ebx
mov bl, byte [ecx + 0x48731c]
cmp byte [esp + ebx + 0x14], 0
je 0x404008
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x487334]
cmp byte [esp + ebx + 0x14], 0
je 0x40401f
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, 0x4872d4
jl 0x403fef
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x403f77
lea edx, [esp + 0x84]
push edx
call fcn.00404060
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x4045bd
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46dc15
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x4885a0]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 4]
mov dword [ecx], eax
mov edx, dword [0x4885a0]
lea ebx, [esi + 8]
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [ebx], edx
mov eax, dword [0x4885a0]
lea ebp, [esi + 0xc]
mov dword [ebp], eax
mov edx, dword [0x4885a0]
mov dword [esi + 0x34], edx
mov eax, dword [0x4885a0]
mov dword [esi + 0x3c], eax
mov edx, dword [0x4885a0]
mov dword [esi + 0x40], edx
mov eax, dword [0x4885a0]
mov dword [esi + 0x44], eax
mov edx, dword [0x4885a0]
mov dword [esi + 0x68], edx
mov eax, dword [0x4885a0]
mov dword [esi + 0x7c], eax
mov edx, dword [0x4885a0]
mov dword [esi + 0x80], edx
mov eax, dword [0x4885a0]
mov dword [esi + 0x88], eax
mov edx, dword [0x4885a0]
mov dword [esi + 0x98], edx
mov eax, dword [0x4885a0]
mov dword [esi + 0x9c], eax
mov edx, dword [0x4885a0]
mov dword [esi + 0xa0], edx
mov eax, dword [0x4885a0]
mov dword [esi + 0xa4], eax
mov edx, dword [0x4885a0]
mov dword [esi + 0xa8], edx
push 0x490fb0
mov byte [esp + 0x20], 0xf
mov dword [esi], 0x472e18
call fcn.0046409f
push 0x490fb0
mov ecx, ebx
call fcn.0046409f
push 0x490fb0
mov ecx, ebp
call fcn.0046409f
push 0x490fb0
lea ecx, [esi + 0x34]
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
call fcn.0046409f
push 0x490fb0
lea ecx, [esi + 0x3c]
call fcn.0046409f
push str.HttpDownload_2.0
lea ecx, [esi + 0x44]
call fcn.0046409f
mov eax, 0x2710
push 0x490fb0
lea ecx, [esi + 0x68]
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
call fcn.0046409f
push 0x490fb0
lea ecx, [esi + 0x7c]
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
call fcn.0046409f
push 0x490fb0
lea ecx, [esi + 0x80]
call fcn.0046409f
push 0x490fb0
lea ecx, [esi + 0x88]
mov dword [esi + 0x84], edi
call fcn.0046409f
push 0x490fb0
lea ecx, [esi + 0x98]
mov word [esi + 0x8c], di
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
call fcn.0046409f
push 0x490fb0
lea ecx, [esi + 0x9c]
call fcn.0046409f
push 0x490fb0
lea ecx, [esi + 0xa0]
call fcn.0046409f
push 0x490fb0
lea ecx, [esi + 0xa4]
call fcn.0046409f
push 0x490fb0
lea ecx, [esi + 0xa8]
call fcn.0046409f
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xb4], edi
mov word [esi + 0xac], 0x50
mov dword [esi + 0xb0], 0xffffffff
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40819c
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46e1fb
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
lea edi, [esi + 0x60]
push ebx
mov ecx, edi
mov dword [esi + 0x154], ebx
mov dword [esi + 0x150], ebx
mov dword [esi + 0x14c], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x144], 0x3e8
call fcn.00401950
push 0xf
mov ecx, edi
call fcn.00401610
mov ecx, edi
call fcn.00402a20
mov eax, dword [esi + 0x7c]
push 0x105
push ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
push str.0.00_KB_S
lea ecx, [esi + 0x22c]
call fcn.004634e8
push str.0.00_KB_S
lea ecx, [esi + 0x440]
call fcn.004634e8
push str.0.00_KB_S
lea ecx, [esi + 0x404]
call fcn.004634e8
push str.0.00_KB_S
lea ecx, [esi + 0x3c8]
call fcn.004634e8
cmp dword [esi + 0x158], ebx
jne 0x40823f
mov ecx, esi
call fcn.00407e10
mov ecx, esi
call fcn.00407ee0
test eax, eax
jne 0x408262
push 0x40
push 0x487fb0
push 0x487f94
mov ecx, esi
call fcn.0046221b
jmp 0x408399
mov ecx, dword [esi + 0x1c]
push 1
push 0x501
push ecx
lea ecx, [esi + 0x174]
mov dword [esi + 0x158], 1
call fcn.00406060
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x10]
push edx
push 0x104
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x114]
lea ecx, [esp + 0x10]
push eax
push ebx
push str.p2pbwt
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edx, dword [esi + 0x1c]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
push 1
push edx
call edi
mov eax, dword [esi + 0x144]
push ebx
push eax
mov eax, dword [esi + 0x1c]
push 1
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x168], ebx
mov dword [esi + 0x16c], ebx
mov dword [esi + 0x170], ebx
mov ecx, dword [0x4885a0]
mov dword [esp + 0xc], ecx
mov eax, dword [esi + 0x4b8]
mov dword [esp + 0x220], ebx
cmp eax, ebx
jne 0x408331
lea edx, [esi + 0x160]
push edx
jmp 0x408338
lea eax, [esi + 0x140]
push eax
lea ecx, [esp + 0x10]
call fcn.0046404f
mov eax, dword [esi + 0x160]
lea ecx, [esp + 0x114]
push ecx
push eax
mov ecx, esi
call fcn.00408160
test eax, eax
push 1
je 0x40836c
mov edx, dword [esi + 0x1c]
push edx
call edi
mov ecx, esi
call fcn.00408640
jmp 0x408385
mov eax, dword [esi + 0x1c]
push eax
call edi
push 0x40
push 0x487fb0
push 0x487f60
mov ecx, esi
call fcn.0046221b
lea ecx, [esp + 0xc]
mov dword [esp + 0x220], 0xffffffff
call fcn.00463f16
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x218
ret
Function at 0x408640
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x46e260
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov ecx, dword [0x4885a0]
mov eax, dword [esi + 0x148]
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ecx
fild qword [esp + 0x18]
fidiv dword [esi + 0x14c]
fstp dword [esp + 0x14]
mov edi, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edi
push edx
mov ecx, esi
mov dword [esp + 0x30], ebx
call fcn.00408990
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 1
call fcn.0046404f
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.00463f16
mov eax, dword [esp + 0x10]
lea ecx, [esi + 0x440]
push eax
call fcn.004634e8
mov ecx, dword [esi + 0x16c]
lea edx, [esp + 0x18]
push ecx
push edx
mov ecx, esi
call fcn.00408990
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 2
call fcn.0046404f
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.00463f16
mov eax, dword [esp + 0x10]
lea ecx, [esi + 0x404]
push eax
call fcn.004634e8
mov ecx, dword [esi + 0x170]
lea edx, [esp + 0x18]
push ecx
push edx
mov ecx, esi
call fcn.00408990
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 3
call fcn.0046404f
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.00463f16
mov eax, dword [esp + 0x10]
lea ecx, [esi + 0x3c8]
push eax
call fcn.004634e8
push 0x48805c
lea ecx, [esi + 0x22c]
call fcn.004634e8
push ebx
lea ecx, [esi + 0x60]
call fcn.004028d0
mov ecx, dword [0x4885a0]
mov dword [esp + 0xc], ecx
mov byte [esp + 0x28], 4
push edi
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.00408990
mov eax, dword [eax]
lea ecx, [esp + 0xc]
push eax
push 0x488048
push ecx
mov byte [esp + 0x34], 5
call fcn.0045f3f0
add esp, 0xc
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 4
call fcn.00463f16
fld dword [esp + 0x14]
fcomp dword [0x472fd8]
fnstsw ax
test ah, 1
jne 0x4087b9
push 0x488030
jmp 0x40881e
fld dword [esp + 0x14]
fcomp dword [0x472fd4]
fnstsw ax
test ah, 1
jne 0x4087d1
push 0x48801c
jmp 0x40881e
fld dword [esp + 0x14]
fcomp dword [0x472fd0]
fnstsw ax
test ah, 1
jne 0x4087e9
push 0x488008
jmp 0x40881e
fld dword [esp + 0x14]
fcomp dword [0x472fcc]
fnstsw ax
test ah, 1
jne 0x408801
push 0x487ff4
jmp 0x40881e
fld dword [esp + 0x14]
fcomp dword [0x472fc8]
fnstsw ax
test ah, 1
jne 0x408819
push 0x487fe0
jmp 0x40881e
push 0x487fc8
lea ecx, [esp + 0x10]
call fcn.004642f2
mov edx, dword [esp + 0xc]
push 0x40
push 0x487fbc
push edx
mov ecx, esi
call fcn.0046221b
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], bl
call fcn.00463f16
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.00463f16
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x4092b0
Capabilities:
Resolve dns

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46e448
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], 0
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x409304
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call fcn.00463f16
xor eax, eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [esi + 0x13c]
call fcn.0046409f
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call fcn.00463f16
mov ecx, dword [esp + 4]
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4

Function at 0x409350
Capabilities:
Send icmp echo request

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46e468
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [esp + 0x34]
mov ecx, 5
mov esi, str.Latency_Test_Buffer
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ebx, eax
or ebp, 0xffffffff
cmp ebx, ebp
je 0x4093b1
call sub.iphlpapi.dll_IcmpCreateFile
mov esi, eax
cmp esi, ebp
je 0x4093b1
push 0x30
call fcn.00415373
mov edi, eax
add esp, 4
test edi, edi
jne 0x4093c2
push esi
call sub.iphlpapi.dll_IcmpCloseHandle
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], ebp
call fcn.00463f16
mov eax, ebp
jmp 0x40940c
push 0x3e8
push 0x30
push edi
push 0
lea ecx, [esp + 0x20]
push 0x14
push ecx
push ebx
push esi
call sub.iphlpapi.dll_IcmpSendEcho
push esi
mov ebx, eax
call sub.iphlpapi.dll_IcmpCloseHandle
test ebx, ebx
je 0x4093fa
mov edi, dword [edi + 8]
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], ebp
call fcn.00463f16
mov eax, edi
jmp 0x40940c
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], ebp
call fcn.00463f16
mov eax, 0xfffffffe
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4

Function at 0x40a580
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push 4
push eax
push 4
push 0xffff
push ecx
mov dword [esp + 0x14], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x40a5bb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.0040a4d0
add esp, 4
or eax, 0xffffffff
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x40a6e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x1c]
xor ecx, ecx
xor eax, eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 8], edx
push eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
push eax
lea edx, [esp + 0xc]
lea eax, [esp + 8]
mov dword [esp + 0x14], ecx
push edx
mov edx, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push 1
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x40a731
mov eax, dword [esp]
add esp, 0x10
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
neg eax
add esp, 0x10
ret