joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426740
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4b6558
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4de57c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
push 0x40dd70
push 0x40d720
push 0xd
push 4
lea ebp, [esi + 8]
push ebp
mov dword [esi], vtable.CDialogX_class_DlgUpdateServer__2_.0
call fcn.0048f2dd
xor ebx, ebx
lea edi, [esi + 0x3c]
mov dword [esp + 0x20], ebx
mov eax, edi
mov ecx, 5
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
add eax, 0x10
sub ecx, 1
jns 0x426798
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov eax, 0xf
mov dword [esi + 0xe4], eax
mov dword [esi + 0xe0], ebx
mov byte [esi + 0xd0], bl
lea ecx, [esi + 0xe8]
push 4
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], ebx
push 0x4bfb44
mov byte [esp + 0x28], 1
mov byte [ecx + 4], bl
call fcn.00401e90
lea ecx, [esi + 0x104]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
mov byte [ecx + 4], bl
mov dword [esi + 0x120], ebx
mov dword [esi + 0x124], ebx
mov dword [esi + 0x128], ebx
mov dword [esi + 0x12c], ebx
push ebx
push 0x4bf904
mov byte [esp + 0x28], 7
mov dword [esi + 4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc0], ebx
call fcn.00401e90
push edi
mov edi, dword [sym.imp.USER32.dll_SetRectEmpty]
call edi
lea eax, [esi + 0x4c]
push eax
call edi
lea ecx, [esi + 0x5c]
push ecx
call edi
lea edx, [esi + 0x6c]
push edx
call edi
lea eax, [esi + 0x8c]
push eax
call edi
mov eax, dword [esi + 0x12c]
cmp eax, ebx
je 0x42689d
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x12c], ebx
push str.xunyoubar.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.IDB_BITMAP_CAPTION_CLOSE_BTN_SW
mov ecx, eax
push ecx
mov dword [esi + 0x12c], eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
mov edi, eax
mov eax, dword [ebp]
cmp eax, ebx
je 0x4268d0
cmp eax, edi
je 0x4268d0
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp], edi
mov edx, dword [esi + 0x12c]
push str.IDB_BITMAP_CAPTION_BKGND_SW
push edx
call dword [sym.imp.USER32.dll_LoadBitmapA]
mov edi, eax
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x4268f9
cmp eax, edi
je 0x4268f9
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x18], edi
cmp dword [ebp], ebx
je 0x42692f
cmp edi, ebx
je 0x42692f
push 0xd2975c
push 1
push ebx
call dword [sym.imp.GDI32.dll_CreatePen]
mov dword [esi + 0x128], eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push 0x10
push 0x4bfaf0
push 0x4bfad4
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x42b1d0
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x4b6b98
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4de57c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
push 0x3f4
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [esp + 0x14]
xor edi, edi
mov ebx, eax
push ecx
push ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [esi + 0xd848], 0x10
jb 0x42b238
mov eax, dword [esi + 0xd834]
jmp 0x42b23e
lea eax, [esi + 0xd834]
push eax
lea ecx, [esp + 0x14]
call fcn.0041a910
mov eax, dword [eax]
cmp eax, edi
mov dword [esp + 0x2c], edi
je 0x42b256
mov eax, dword [eax]
jmp 0x42b258
xor eax, eax
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x34]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
push ebx
lea ecx, [esi + 0xda8c]
call fcn.0042a9d0
mov esi, dword [esp + 0x10]
cmp esi, edi
je 0x42b2c5
lea edx, [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x42b2c5
cmp esi, edi
je 0x42b2c5
mov eax, dword [esi]
cmp eax, edi
je 0x42b2ac
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, edi
je 0x42b2bc
push eax
call fcn.0048e604
add esp, 4
push esi
call fcn.0048d433
add esp, 4
push 5
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x42d5e0
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x4b6e1b
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
push esi
mov eax, dword [0x4de57c]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0xda9c], 0x14
jge 0x42d709
push 1
push 3
lea ecx, [esp + 0x2c]
call fcn.00411260
mov eax, 0x14
sub eax, dword [esi + 0xda9c]
lea ecx, [esp + 0x2c]
push eax
push 0x4c0c48
push ecx
mov dword [esp + 0xc0], 0
call fcn.0042c6b0
add esp, 8
mov ecx, eax
call fcn.0042b700
lea edx, [esp + 8]
push edx
lea ecx, [esp + 0x28]
call fcn.0040f880
cmp dword [eax + 0x18], 0x10
jb 0x42d66f
mov eax, dword [eax + 4]
jmp 0x42d672
add eax, 4
push eax
mov eax, dword [esi + 0xd98c]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
cmp dword [esp + 0x20], 0x10
jb 0x42d694
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0048d433
add esp, 4
mov edx, dword [esi + 0xd98c]
push edx
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x42d6c9
mov eax, dword [esi + 0xd98c]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esp + 0x78]
mov dword [esp + 0xb4], 0xffffffff
call fcn.0040ea50
lea ecx, [esp + 0x78]
push ecx
mov dword [esp + 0x7c], vtable.std::ios_base.0
call fcn.0048cc6e
add esp, 4
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xb0
ret
mov edx, dword [esi + 0xd98c]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xb0
ret

Function at 0x42dc30
Capabilities:
Hide graphical window

Disassembly:
test ecx, ecx
push esi
je 0x42dc3a
lea esi, [ecx - 0x20]
jmp 0x42dc3c
xor esi, esi
mov eax, dword [esi + 4]
push 6
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 4]
push 0
push 0xf020
push 0x112
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop esi
ret
Function at 0x433d90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b750b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4de57c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea edi, [esi + 4]
xor ebx, ebx
mov dword [esi], vtable.DlgSoftKeyboard::KeyboardUI.0
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [esp + 0x30], ebx
call fcn.00433a00
mov ecx, esi
call fcn.00433b20
mov ecx, esi
call fcn.00433c70
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], 0xf3
mov dword [esp + 0x28], 3
mov dword [esp + 0x2c], 0x13b
mov dword [esp + 0x30], 0x32
call dword [sym.imp.USER32.dll_InflateRect]
push 0x18
call fcn.0048e9fc
add esp, 4
cmp eax, ebx
je 0x433e51
mov dword [eax], vtable.Key.0
mov ecx, dword [esp + 0x18]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x1c]
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x20]
mov dword [eax + 0xc], ecx
mov edx, dword [esp + 0x24]
mov dword [eax + 0x10], edx
mov dword [eax], vtable.KeyShift.0
mov byte [eax + 0x14], bl
jmp 0x433e53
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.00433990
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x435050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4b77b0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4de57c]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x18], eax
xor ebx, ebx
mov dword [esp + 0x60], ebx
mov ebp, 0x10
lea ebx, [ebx]
mov edi, dword [esp + 0x6c]
cmp edi, ebx
je 0x43509e
cmp edi, dword [esp + 0x74]
je 0x4350a3
call fcn.0048ed51
mov esi, dword [esp + 0x70]
cmp esi, dword [esp + 0x78]
je 0x435162
cmp edi, ebx
jne 0x4350ba
call fcn.0048ed51
cmp esi, dword [edi + 4]
jne 0x4350c4
call fcn.0048ed51
lea eax, [esi + 0xc]
push eax
lea ecx, [esp + 0x24]
call fcn.00434d10
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0xa4]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [esp + 0x88], 1
mov byte [ecx + 4], bl
call fcn.00401cf0
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x9c]
call fcn.00434820
cmp dword [esp + 0x54], ebp
mov byte [esp + 0x17], al
mov byte [esp + 0x60], bl
jb 0x43512b
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0048d433
add esp, 4
cmp dword [esp + 0x38], ebp
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
jb 0x43514e
mov edx, dword [esp + 0x24]
push edx
call fcn.0048d433
add esp, 4
cmp byte [esp + 0x17], bl
jne 0x435162
lea ecx, [esp + 0x6c]
call fcn.00419aa0
jmp 0x435090
cmp dword [esp + 0x98], ebp
mov ebx, dword [esp + 0x18]
mov dword [ebx], edi
mov dword [ebx + 4], esi
jb 0x435184
mov eax, dword [esp + 0x84]
push eax
call fcn.0048d433
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x437250
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7b20
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4de57c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
cmp dword [edi + 0x14], 0
mov dword [ebp - 4], 0
je 0x437399
mov esi, dword [ebp + 8]
cmp esi, 0x20010001
ja 0x437314
je 0x4372ee
mov eax, esi
sub eax, 0
je 0x4372cb
sub eax, 1
jne 0x43731c
mov ecx, dword [edi + 0x18]
mov edx, dword [edi + 0x14]
mov eax, 1
push ecx
push eax
call edx
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edi + 0x18]
mov edx, dword [edi + 0x14]
xor eax, eax
push ecx
push eax
call edx
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edi + 0x18]
mov edx, dword [edi + 0x14]
mov eax, 3
push ecx
push eax
call edx
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, 0x20010002
je 0x437359
test esi, esi
jge 0x43732b
push 0x4c0fe0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4c0fd4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [edi + 0x18]
mov edx, dword [edi + 0x14]
mov eax, esi
push ecx
push eax
call edx
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edi + 0x18]
mov edx, dword [edi + 0x14]
mov eax, 2
push ecx
push eax
call edx
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4377e0
Capabilities:
Accept command line arguments
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7b48
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4de57c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x20], 0
mov dword [ebp - 4], 0
je 0x437833
cmp dword [ebp + 0x20], 0x10
jb 0x43782c
mov eax, dword [ebp + 0xc]
push eax
call fcn.0048d433
add esp, 4
xor eax, eax
jmp 0x43794d
push 8
call fcn.0048e9fc
add esp, 4
test eax, eax
je 0x43784c
mov dword [eax], vtable.CKVipUpdateCB.0
mov dword [eax + 4], edi
jmp 0x43784e
xor eax, eax
test eax, eax
mov dword [edi + 8], eax
je 0x437938
mov ecx, edi
call fcn.004371b0
test eax, eax
je 0x437938
call dword [0x4de488]
cmp dword [ebp + 0x20], 0x10
mov dword [ebp - 0x14], eax
jb 0x4378f3
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4378a8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
add esi, 1
cmp esi, 0x3fffffff
jg 0x4378a8
lea eax, [esi + esi]
call fcn.0048eaf0
mov ecx, dword [ebp - 0x14]
mov eax, esp
push ecx
push esi
push ebx
push eax
call fcn.00414610
mov eax, dword [edi]
test eax, eax
je 0x43792c
mov edx, dword [eax]
push 1
push eax
mov eax, dword [edx + 0xc]
call eax
test eax, eax
jl 0x43792c
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push 0
push eax
call edx
test eax, eax
jl 0x43792c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push str._needupdate_0
push eax
call fcn.004903a0
add esp, 8
test eax, eax
je 0x4378f8
lea ecx, [ebp + 8]
call fcn.00401cb0
mov eax, 1
jmp 0x43794d
lea ebx, [ebp + 0xc]
jmp 0x43787e
lea eax, [ebp - 0x18]
push eax
push 0
push edi
push 0x437220
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [edi + 0x1c], eax
lea ecx, [ebp + 8]
jne 0x43791f
call fcn.00401cb0
jmp 0x43794a
mov byte [edi + 0x20], 1
call fcn.00401cb0
xor eax, eax
jmp 0x43794d
cmp dword [ebp + 0x20], 0x10
jb 0x43794a
mov ecx, dword [ebp + 0xc]
push ecx
jmp 0x437942
cmp dword [ebp + 0x20], 0x10
jb 0x43794a
mov edx, dword [ebp + 0xc]
push edx
call fcn.0048d433
add esp, 4
or eax, 0xffffffff
lea esp, [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048de34
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x43c3d0
Capabilities:
Connect socket
Get socket status
Resolve dns

Disassembly:
sub esp, 0x120
mov eax, dword [0x4de57c]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
push esi
push eax
mov esi, ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x43c413
xor al, al
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0048de34
add esp, 0x120
ret 0xc
xor ecx, ecx
mov dword [esp + 0x112], ecx
mov dword [esp + 0x116], ecx
mov dword [esp + 0x11a], ecx
mov word [esp + 0x11e], cx
mov word [esp + 0x110], 2
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [esp + 0x12c]
mov edx, dword [ecx]
push eax
mov dword [esp + 0x118], edx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esi]
push 0x10
lea ecx, [esp + 0x114]
push ecx
push edx
mov word [esp + 0x11e], ax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x43c491
mov al, 1
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0048de34
add esp, 0x120
ret 0xc
push 0x100
lea eax, [esp + 0x14]
push 0
push eax
mov dword [esp + 0x18], 0
call fcn.0048ea70
mov ecx, dword [esp + 0x18]
add esp, 0xc
xor eax, eax
test ecx, ecx
jbe 0x43c4cd
mov edx, dword [esi]
lea esp, [esp]
cmp dword [esp + eax*4 + 0x10], edx
je 0x43c4cd
add eax, 1
cmp eax, ecx
jb 0x43c4c0
cmp eax, ecx
jne 0x43c4e1
cmp ecx, 0x40
jae 0x43c4e1
mov ecx, dword [esi]
mov dword [esp + eax*4 + 0x10], ecx
add dword [esp + 0xc], 1
mov edx, dword [esp + 0x130]
lea eax, [esp + 4]
push eax
push 0
mov dword [esp + 0xc], edx
mov edx, dword [esi]
lea ecx, [esp + 0x14]
push ecx
push 0
add edx, 1
push edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.WS2_32.dll_select]
xor ecx, ecx
test eax, eax
setg cl
mov al, cl
mov ecx, dword [esp + 0x120]
pop esi
xor ecx, esp
call fcn.0048de34
add esp, 0x120
ret 0xc

Function at 0x43c530
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
test esi, esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
jle 0x43c55d
mov ebp, dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebx]
push 0
push esi
push edi
push eax
call ebp
test eax, eax
jle 0x43c566
sub esi, eax
add edi, eax
test esi, esi
jg 0x43c548
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
Function at 0x43d0b0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x110
push ebp
mov ebp, dword [esp + 0x118]
push esi
push edi
mov esi, ecx
mov edi, ebp
push 0x100
lea eax, [esp + 0x20]
push 0
push eax
mov dword [esp + 0x24], 0
call fcn.0048ea70
mov ecx, dword [esp + 0x24]
add esp, 0xc
xor eax, eax
test ecx, ecx
jbe 0x43d0fd
mov edx, dword [esi]
lea esp, [esp]
cmp dword [esp + eax*4 + 0x1c], edx
je 0x43d0fd
add eax, 1
cmp eax, ecx
jb 0x43d0f0
cmp eax, ecx
jne 0x43d111
cmp ecx, 0x40
jae 0x43d111
mov ecx, dword [esi]
mov dword [esp + eax*4 + 0x1c], ecx
add dword [esp + 0x18], 1
mov edx, dword [esp + 0x128]
lea eax, [esp + 0x10]
push eax
push 0
mov dword [esp + 0x18], edx
mov edx, dword [esi]
push 0
lea ecx, [esp + 0x24]
push ecx
add edx, 1
push edx
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x43d1a1
mov eax, dword [esp + 0x124]
mov ecx, dword [esi]
push 0
push eax
push edi
push ecx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x43d1a1
sub dword [esp + 0x124], eax
add edi, eax
mov eax, edi
sub eax, ebp
cmp eax, 4
jl 0x43d0c4
cmp byte [esp + 0x12c], 0
mov cl, byte [ebp + 3]
mov dl, byte [ebp + 2]
mov byte [esp + 0xc], cl
mov byte [esp + 0xd], dl
je 0x43d194
not cl
not dl
mov byte [esp + 0xc], cl
mov byte [esp + 0xd], dl
movzx edx, word [esp + 0xc]
cmp eax, edx
jl 0x43d0c4
pop edi
pop esi
pop ebp
add esp, 0x110
ret 0x10

Function at 0x43da10
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x1128
call fcn.00490820
mov eax, dword [0x4de57c]
xor eax, esp
mov dword [esp + 0x1124], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
lea eax, [esp + 0xc]
push eax
push 0x1000
lea ecx, [esp + 0x18]
push ecx
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x43db27
xor ebx, ebx
xor esi, esi
test dword [esp + 0xc], 0xfffffffc
jbe 0x43db27
jmp 0x43da70
mov eax, dword [esp + esi*4 + 0x10]
push 0x104
lea edx, [esp + 0x1030]
push edx
push eax
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x43db15
lea eax, [esp + 0x102c]
mov dword [esp + 0x1028], 0xf
mov dword [esp + 0x1024], ebx
mov byte [esp + 0x1014], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x43dab3
sub eax, edx
push eax
lea ecx, [esp + 0x1030]
push ecx
lea ecx, [esp + 0x1018]
call fcn.00401e90
lea edx, [esp + 0x1010]
push edx
call fcn.0043d900
add esp, 4
push 0xa
push ebx
push str.HOOKDISKID
lea ecx, [esp + 0x101c]
call fcn.00437450
test eax, eax
jge 0x43db4b
cmp dword [esp + 0x1028], 0x10
jb 0x43db15
mov eax, dword [esp + 0x1014]
push eax
call fcn.0048d433
add esp, 4
mov ecx, dword [esp + 0xc]
add esi, 1
shr ecx, 2
cmp esi, ecx
jb 0x43da70
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x1124]
xor ecx, esp
call fcn.0048de34
add esp, 0x1128
ret
cmp dword [esp + 0x1028], 0x10
jb 0x43db65
mov edx, dword [esp + 0x1014]
push edx
call fcn.0048d433
add esp, 4
mov ecx, dword [esp + 0x1130]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0048de34
add esp, 0x1128
ret
Function at 0x43db80
Capabilities:
Enumerate services

Disassembly:
push 0xffffffffffffffff
push 0x4b8368
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4de57c]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
push 0x10000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
xor ebx, ebx
push 0xf003f
push ebx
mov esi, eax
push ebx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push ebx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0x10000
push esi
push 3
push 0x30
push eax
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
cmp dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
jbe 0x43dcba
mov dword [esp + 0x14], esi
jmp 0x43dc03
xor ebx, ebx
push 7
push str.SbieSvc
lea ecx, [esp + 0x30]
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], 0
call fcn.00401e90
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
mov eax, edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x43dc30
mov edi, dword [esp + 0x3c]
sub eax, esi
mov esi, eax
cmp edi, esi
mov ecx, edi
jb 0x43dc49
mov ecx, esi
mov ebp, dword [esp + 0x40]
cmp ebp, 0x10
mov eax, dword [esp + 0x2c]
jae 0x43dc5a
lea eax, [esp + 0x2c]
push ecx
push edx
push eax
call fcn.00419fd0
add esp, 0xc
cmp eax, ebx
jne 0x43dc7b
cmp edi, esi
jae 0x43dc72
or eax, 0xffffffff
jmp 0x43dc79
xor eax, eax
cmp edi, esi
setne al
cmp eax, ebx
sete bl
cmp ebp, 0x10
mov dword [esp + 0x4c], 0xffffffff
jb 0x43dc98
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0048d433
add esp, 4
test bl, bl
jne 0x43dcd7
mov eax, dword [esp + 0x1c]
add dword [esp + 0x14], 0x24
add eax, 1
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
jb 0x43dc01
mov esi, dword [esp + 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor al, al
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x43f8f0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x514
mov eax, dword [0x4de57c]
xor eax, esp
mov dword [esp + 0x510], eax
push ebx
push esi
mov esi, dword [esp + 0x520]
mov ebx, ecx
push edi
mov edi, dword [ebx]
cmp edi, 0xffffffff
je 0x43fabf
cmp dword [ebx + 4], 0
je 0x43fabf
push ebp
push 0x100
lea eax, [esp + 0x24]
push 0
push eax
mov dword [esp + 0x28], 0
call fcn.0048ea70
push 0x3ff
lea ecx, [esp + 0x131]
push 0
mov ebp, 1
push ecx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], 0
mov byte [esp + 0x138], 0
call fcn.0048ea70
mov ecx, dword [esp + 0x34]
add esp, 0x18
xor eax, eax
test ecx, ecx
jbe 0x43f98c
lea esp, [esp]
cmp dword [esp + eax*4 + 0x20], edi
je 0x43f98c
add eax, ebp
cmp eax, ecx
jb 0x43f980
cmp eax, ecx
jne 0x43f99d
cmp ecx, 0x40
jae 0x43f99d
mov dword [esp + eax*4 + 0x20], edi
add dword [esp + 0x1c], ebp
lea edx, [esp + 0x10]
push edx
push 0
push 0
lea eax, [esp + 0x28]
push eax
push 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x43f9d4
mov edx, dword [ebx]
push 0
push 0x400
lea ecx, [esp + 0x128]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 5
je 0x43f9f1
xor al, al
pop ebp
mov ecx, dword [esp + 0x51c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048de34
add esp, 0x514
ret 4
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x120]
push eax
push 5
push 0x98
call fcn.00478c50
mov ecx, dword [str.lykjLdy173]
push ecx
mov ecx, dword [ebx + 4]
call fcn.00478db0
mov edx, dword [ebx + 4]
mov eax, dword [edx + 0x28]
push 0
push eax
mov ecx, esi
call fcn.00403350
mov eax, dword [esi + 4]
test eax, eax
jne 0x43fa32
xor edi, edi
jmp 0x43fa37
mov edi, dword [esi + 8]
sub edi, eax
test eax, eax
je 0x43fa42
mov ecx, dword [esi + 8]
sub ecx, eax
jne 0x43fa47
call fcn.0048ed51
mov edx, dword [ebx + 4]
mov eax, dword [esi + 4]
push edi
add edx, 0x30
push edx
push eax
call fcn.004904b0
add esp, 0xc
mov ecx, esi
xor edi, edi
call fcn.00402e30
test eax, eax
jbe 0x43faab
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x43fa78
mov eax, dword [esi + 8]
sub eax, ecx
cmp edi, eax
jb 0x43fa7d
call fcn.0048ed51
mov ebp, dword [esi + 4]
test ebp, ebp
je 0x43fa8d
mov eax, dword [esi + 8]
sub eax, ebp
cmp edi, eax
jb 0x43fa92
call fcn.0048ed51
mov cl, byte [edi + ebp]
mov edx, dword [esi + 4]
not cl
mov byte [edi + edx], cl
mov ecx, esi
add edi, 1
call fcn.00402e30
cmp edi, eax
jb 0x43fa68
mov ecx, dword [ebx + 4]
push 0x98
call fcn.00478bb0
mov al, 1
jmp 0x43f9d6
xor al, al
jmp 0x43f9d7