joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54bcc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x146000]
push edi
jmp 0x54bcda
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x54bce1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54bcd0
mov eax, 1
add ebx, ebx
jne 0x54bcf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x54bd04
jne 0x54bd23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54bd23
dec eax
add ebx, ebx
jne 0x54bd10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x54bce8
add ebx, ebx
jne 0x54bd1f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x54bd75
xor ecx, ecx
sub eax, 3
jb 0x54bd3b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x54bdaa
sar eax, 1
mov ebp, eax
jmp 0x54bd46
add ebx, ebx
jne 0x54bd46
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54bd14
inc ecx
add ebx, ebx
jne 0x54bd54
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54bd14
add ebx, ebx
jne 0x54bd61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x54bd56
jne 0x54bd72
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x54bd56
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x54bd94
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x54bd86
jmp 0x54bcd6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x54bd94
add edi, ecx
jmp 0x54bcd6
pop esi
mov edi, esi
mov ecx, 0x298
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x54bdb2
cmp byte [edi], 1
jne 0x54bdb2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x54bdb7
lea edi, [esi + 0x149000]
mov eax, dword [edi]
or eax, eax
je 0x54be2f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15e554]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x15e608]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x54bde4
mov ecx, edi
jns 0x54be13
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15e60c]
or eax, eax
je 0x54be29
mov dword [ebx], eax
add ebx, 4
jmp 0x54be01
call dword [esi + 0x15e61c]
mov ebp, dword [esi + 0x15e610]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x54be63
sub esp, 0xffffff80
jmp 0x4037bf
Function at 0x4011f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40414d], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.trast
push str.bask
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401238
xor eax, eax
jmp 0x401253
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4025a0
Capabilities:
Terminate process

Disassembly:
mov ecx, 0x404240
push ecx
jmp fcn.004025ab
Function at 0x4017d0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x431008], 0x8088405
inc edx
mov dword [ebx + 0x431008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402288
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4355a4
mov esi, section.DATA
mov edi, 0x435030
cmp byte [ebx + 0x28], 0
jne 0x4022b7
cmp dword [edi], 0
je 0x4022b7
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x4022a6
cmp dword [0x431004], 0
je 0x4022c6
call dword [0x43106c]
cmp byte [ebx + 0x28], 2
jne 0x4022d6
cmp dword [esi], 0
jne 0x4022d6
xor eax, eax
mov dword [ebx + 0xc], eax
call dword [0x431034]
cmp byte [ebx + 0x28], 1
jbe 0x4022e7
cmp dword [esi], 0
je 0x402309
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x402309
call dword [0x431024]
mov edx, dword [ebx + 0x10]
mov eax, dword [edx + 0x10]
cmp eax, dword [edx + 4]
je 0x402309
test eax, eax
je 0x402309
push eax
call fcn.00401094
call dword [0x431038]
cmp byte [ebx + 0x28], 1
jne 0x402318
call dword [ebx + 0x24]
cmp byte [ebx + 0x28], 0
je 0x402323
call fcn.00402258
cmp dword [ebx], 0
jne 0x40233f
cmp dword [0x43501c], 0
je 0x402337
call dword [0x43501c]
mov eax, dword [esi]
push eax
call fcn.0040112c
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x4022c6

Function at 0x4023c8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004011a4
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x435034], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x402390
push eax
push esi
push ebx
call fcn.0040111c
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x403e98
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x403f55
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0xa
push 0x403f68
mov eax, dword [0x435680]
push eax
call fcn.00403778
mov esi, eax
test esi, esi
je 0x403f3a
push esi
mov eax, dword [0x435680]
push eax
call fcn.00403900
mov edi, eax
push esi
mov eax, dword [0x435680]
push eax
call fcn.004038b8
test eax, eax
je 0x403f3a
push eax
call fcn.004038c0
mov ebx, eax
lea eax, [ebp - 8]
mov edx, edi
call fcn.004028dc
lea eax, [ebp - 8]
call fcn.00402804
mov ecx, edi
mov edx, ebx
call fcn.00403cb8
lea ecx, [ebp - 0xc]
mov edx, 0x403f74
mov eax, dword [ebp - 8]
call fcn.00403dd0
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.004024ac
lea eax, [ebp - 8]
call fcn.00402804
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403f5c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00402438
ret
Function at 0x4043a4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4044ae
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x4043f7
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call fcn.00403808
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.00402500
jmp 0x404495
call fcn.004037a0
mov ebx, eax
mov eax, ebx
call fcn.00404358
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.00404378
mov ebx, eax
test esi, esi
je 0x40441f
dec esi
test esi, esi
jl 0x40441f
cmp edi, ebx
jne 0x4043fe
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.00402540
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.0040280c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004025b8
cmp eax, 2
jl 0x404495
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x404495
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004025b8
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x404495
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004025b8
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.0040280c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4044b5
lea eax, [ebp - 0x110]
call fcn.00402414
ret

Function at 0x405958
Capabilities:
Get file attributes

Disassembly:
call fcn.0040409c
push eax
call fcn.004037e0
inc eax
je 0x40596c
dec eax
and al, 0x10
sete al
ret

Function at 0x40610c
Capabilities:
Capture screenshot

Disassembly:
push ebx
mov ebx, eax
call fcn.004060e4
je 0x40613e
mov eax, ebx
push edx
call fcn.0040504c
pop edx
cmp eax, edx
je 0x40613e
test edx, edx
mov eax, ebx
jne 0x406130
pop ebx
inc edx
jmp fcn.0040503c
mov byte [ebx + 0x49], dl
xor edx, edx
call fcn.0040503c
xchg ebx, eax
cmp eax, 0
pop ebx
jne fcn.0040615c
ret
Function at 0x40615c
Capabilities:
Capture screenshot

Disassembly:
push eax
call fcn.004060e4
pop eax
je 0x40634d
pushal
mov ebx, eax
call dword [ebx + 0x34]
xor eax, eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x56], eax
mov dword [ebx + 0x5a], eax
mov esi, dword [ebx + 0x1c]
mov edi, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x41]
jecxz 0x406196
mov eax, dword [ebx + 0x3d]
mov esi, dword [eax + 4]
mov edi, dword [eax + 8]
test edi, edi
jge 0x4061b5
neg edi
jmp 0x4061b5
mov ecx, dword [ebx + 0x20]
jecxz 0x4061b5
add esp, 0xffffffe8
push esp
push 0x18
push ecx
call fcn.004039d0
xchg ecx, eax
jecxz 0x4061b2
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x18
push 0
call fcn.00403958
push eax
cmp byte [ebx + 0x3c], 1
jne 0x406265
push 0
call fcn.00403b08
push eax
push dword [ebx + 0x18]
push dword [ebx + 0x1c]
push eax
call fcn.00403950
xchg ebp, eax
push 0
call fcn.00403bf8
pop edx
push edx
push ebp
push edx
call fcn.00403a08
push eax
push dword [ebx + 0x18]
push dword [ebx + 0x1c]
push 0
push 0
mov eax, dword [ebx + 0x2c]
call fcn.00405324
push eax
call fcn.00403998
mov edx, esp
push eax
push eax
push edx
push dword [esp + 0x20]
call fcn.00403ad8
call fcn.004039a8
add esp, 0x10
mov ecx, dword [ebx + 0x41]
jecxz 0x406242
push dword [esp + 4]
call fcn.00403a08
push 0
push dword [ebx + 0x3d]
push dword [ebx + 0x41]
push dword [ebx + 0x18]
push 0
push ebp
push dword [esp + 0x18]
call fcn.00403a30
jmp 0x406256
mov edx, dword [esp + 4]
push edx
mov eax, ebx
xor ecx, ecx
push ecx
call fcn.00405f90
call fcn.00403a08
mov eax, ebx
call fcn.00405f20
mov dword [ebx + 0x20], ebp
jmp 0x40633a
movzx eax, byte [ebx + 0x49]
xchg ecx, eax
mov cl, byte [ecx + 0x431158]
movzx eax, byte [0x43109c]
jecxz 0x406269
xor ebp, ebp
mov eax, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x18]
call fcn.00405e70
push eax
cmp byte [ebx + 0x49], 5
jne 0x406292
call fcn.00405f08
pop eax
push eax
call fcn.00406148
mov edx, dword [ebx + 0x18]
mul edx
push eax
push eax
push 0
call fcn.00403870
push eax
push 0
push dword [esp + 0xc]
push eax
mov eax, dword [ebx + 0x18]
cmp eax, edi
jle 0x4062b8
mov eax, edi
push eax
push 0
mov eax, ebx
call fcn.00404a24
push eax
push dword [esp + 0x24]
call fcn.004039c0
mov edx, dword [ebx + 0x18]
cmp edx, edi
jle 0x4062d5
mov edx, edi
cmp eax, edx
je 0x40631c
call fcn.00403878
xor eax, eax
push eax
mov edx, esp
mov ecx, dword [esp + 8]
push eax
push eax
push edx
push 0
push ecx
push dword [esp + 0x20]
call fcn.00403968
xor esi, 0xffffffff
xchg ebp, eax
push ebp
push dword [esp + 0x10]
call fcn.00403a08
push eax
mov edx, dword [esp + 0x10]
xor ecx, ecx
push ecx
mov eax, ebx
call fcn.00405f90
push dword [esp + 0x10]
call fcn.00403a08
mov eax, ebx
call fcn.00405f20
pop dword [ebx + 0x41]
pop dword [ebx + 0x45]
pop dword [ebx + 0x3d]
mov dword [ebx + 0x20], ebp
test esi, esi
mov byte [ebx + 0x72], 0
jge 0x40633a
inc byte [ebx + 0x72]
mov ecx, dword [ebx + 0x4a]
jecxz 0x406347
pop edx
push edx
push edi
xchg esi, ecx
xchg ebx, eax
call esi
call fcn.004039a0
popal
ret
Function at 0x40e3e4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4356c4
cmp dword [edi], 0
jne 0x40e460
push 0x40
push 0x1000
push 0x1000
push 0
call fcn.00403920
mov esi, eax
mov eax, dword [0x4356c0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x43179c
mov ecx, 2
call fcn.004012b8
mov edx, 0x40e3bc
lea eax, [esi + 5]
call fcn.0040e3dc
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0040e3dc
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x40e435
mov dword [0x4356c0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40f5c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x435878
cmp dword [edi], 0
jne 0x40f63c
push 0x40
push 0x1000
push 0x1000
push 0
call fcn.00403920
mov esi, eax
mov eax, dword [0x435874]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x431810
mov ecx, 2
call fcn.004012b8
mov edx, 0x40f598
lea eax, [esi + 5]
call fcn.0040f5b8
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0040f5b8
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x40f611
mov dword [0x435874], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40fd5c
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0040fc80
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00401c7c
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call fcn.0040de5c
mov edx, 0x40fdc0
call fcn.0040f768
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x40fdb2
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00401c7c
pop esi
pop ebx
ret
Function at 0x40fde4
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040fb50
xor eax, eax
push ebp
push 0x40fe63
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00402414
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x40fe1d
call fcn.00402020
jmp 0x40fe6a
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call fcn.0040de64
test eax, eax
jne 0x40fe4d
push dword [ebp - 0x14]
call fcn.0040de7c
mov edx, eax
mov eax, ebx
call fcn.00402540
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fe6a
mov eax, dword [ebp - 4]
call fcn.0040fb5c
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40fe70
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.004027b0
push eax
call fcn.0040debc
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.004017b0
test ebx, ebx
je 0x40febb
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret

Function at 0x40ff80
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x410051
push 0
push 1
push 2
call fcn.0040deb4
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
je 0x410051
xor eax, eax
push ebp
push 0x410034
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00401c7c
cmp byte [ebp + 8], 0
je 0x410010
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0040ff00
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.0040fd5c
jmp 0x41002a
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0040f8a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x410051
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x410234
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040fb50
xor eax, eax
push ebp
push 0x4103a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x410393
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x41027f
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x410289
call fcn.00402020
jmp 0x4103b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0040e9a0
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 8]
mov ebx, eax
test ebx, ebx
jle 0x410388
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call fcn.0040deac
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x41033a
call fcn.0040deec
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x410327
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00401c7c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.004101ec
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x4103bc]
cmp dl, byte [eax + 0x28]
je 0x41038f
call fcn.00402020
jmp 0x4103b0
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0040e9c0
jmp 0x41038f
cmp ecx, ebx
jge 0x410356
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0040e9c0
jmp 0x410289
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0040e9a0
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0040e9d4
cmp edx, dword [esp + 4]
jne 0x410377
cmp eax, dword [esp]
pop edx
pop eax
jne 0x410289
push ebp
call fcn.004101ec
pop ecx
jmp 0x41038f
push ebp
call fcn.004101ec
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4103b0
mov eax, dword [ebp - 4]
call fcn.0040fb5c
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4103d8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040fb50
xor eax, eax
push ebp
push 0x410482
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x410412
call fcn.00402020
jmp 0x410489
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call fcn.0040deac
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x41046c
call fcn.0040deec
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x41046c
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00401c7c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x41046c
call fcn.00402020
jmp 0x410489
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410489
mov eax, dword [ebp - 4]
call fcn.0040fb5c
ret
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4104b0
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040fb50
xor eax, eax
push ebp
push 0x41057f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x4104ff
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4104ff
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call fcn.0040de84
jmp 0x410569
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x41050f
call fcn.00402020
jmp 0x410586
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call fcn.0040de9c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x410569
call fcn.0040deec
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x410569
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00401c7c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x410569
call fcn.00402020
jmp 0x410586
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410586
mov eax, dword [ebp - 4]
call fcn.0040fb5c
ret
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret