joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000585c
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.10002908
mov eax, dword [ebp - 8]
call fcn.10002908
mov eax, dword [ebp - 0xc]
call fcn.10002908
xor eax, eax
push ebp
push 0x1000598a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
push ebp
push 0x10005965
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.10002918
push eax
mov eax, dword [ebp - 4]
call fcn.10002918
push eax
mov eax, dword [0x1000a674]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
jne 0x100058d6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1000596f
push ebx
mov eax, dword [0x1000a674]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
test esi, esi
jne 0x100058f2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1000596f
push ebx
mov eax, dword [0x1000a674]
push eax
call sub.kernel32.dll_SizeofResource
mov edi, eax
push esi
call sub.kernel32.dll_LockResource
mov esi, eax
test esi, esi
jne 0x10005916
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1000596f
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp - 0xc]
call fcn.10002918
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10005943
mov byte [ebp - 0xd], 0
jmp 0x1000595b
push 0
lea eax, [ebp - 0x14]
push eax
push edi
push esi
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1000596f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10005991
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.100025c4
ret

Function at 0x1000599c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.10002908
mov eax, dword [ebp - 8]
call fcn.10002908
xor eax, eax
push ebp
push 0x10005a6e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor edx, edx
push ebp
push 0x10005a49
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
call fcn.10002918
push eax
mov eax, dword [ebp - 4]
call fcn.10002918
push eax
mov eax, dword [0x1000a674]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
jne 0x10005a08
pop dword fs:[0]
add esp, 8
jmp 0x10005a53
push eax
mov eax, dword [0x1000a674]
push eax
call sub.kernel32.dll_LoadResource
test eax, eax
jne 0x10005a24
pop dword fs:[0]
add esp, 8
jmp 0x10005a53
push eax
call sub.kernel32.dll_LockResource
test eax, eax
jne 0x10005a3a
pop dword fs:[0]
add esp, 8
jmp 0x10005a53
call fcn.10004200
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x10005a53
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10005a75
lea eax, [ebp - 8]
mov edx, 2
call fcn.100025c4
ret
Function at 0x10005b64
Capabilities:
Enumerate network shares

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
push esp
push ebx
push 0
push 1
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x10005be7
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0x7d00
mov eax, dword [esp + 8]
call fcn.100011b4
mov edi, eax
lea eax, [esp + 8]
push eax
push edi
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
jne 0x10005bd7
mov ebx, edi
cmp dword [esp + 4], 0
jbe 0x10005bd7
dec dword [esp + 4]
mov edx, ebx
mov eax, esi
call fcn.10005b64
mov eax, ebx
call esi
add ebx, 0x20
cmp dword [esp + 4], 0
ja 0x10005bbc
mov eax, dword [esp]
push eax
call sub.mpr.dll_WNetCloseEnum
mov eax, edi
call fcn.100011cc
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x10006518
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd4c
push ebx
xor ecx, ecx
mov dword [ebp - 0x2b4], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.10002908
mov eax, dword [ebp - 8]
call fcn.10002908
xor eax, eax
push ebp
push 0x10006740
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x2b0]
call fcn.10001800
mov edx, 1
lea eax, [ebp - 0x2b0]
call fcn.10001d98
call fcn.10001298
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x164]
call fcn.10001800
mov eax, dword [ebp - 8]
call fcn.10002918
mov edx, eax
lea eax, [ebp - 0x2b4]
call fcn.100026cc
mov eax, dword [ebp - 0x2b4]
call fcn.10003a58
test al, al
je 0x1000671a
mov edx, 1
lea eax, [ebp - 0x164]
call fcn.10001d7c
call fcn.10001298
xor eax, eax
mov dword [ebp - 0x18], eax
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0xb]
mov ecx, 3
lea eax, [ebp - 0x164]
call fcn.10001958
call fcn.10001298
cmp dword [ebp - 0x14], 0
je 0x100066de
cmp dword [ebp - 0x14], 3
jge 0x10006610
mov eax, 3
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
cmp edx, 2
jg 0x10006610
lea eax, [ebp + edx - 0xb]
mov byte [eax], 0
inc edx
inc eax
cmp edx, 3
jne 0x10006606
xor eax, eax
mov al, byte [ebp - 0xb]
mov edx, eax
shr edx, 2
mov dl, byte [edx + 0x100090e1]
mov byte [ebp - 0xf], dl
and eax, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0xa]
mov ecx, edx
shr ecx, 4
add eax, ecx
mov al, byte [eax + 0x100090e1]
mov byte [ebp - 0xe], al
and edx, 0xf
shl edx, 2
xor eax, eax
mov al, byte [ebp - 9]
mov ecx, eax
shr ecx, 6
add edx, ecx
mov dl, byte [edx + 0x100090e1]
mov byte [ebp - 0xd], dl
and eax, 0x3f
mov al, byte [eax + 0x100090e1]
mov byte [ebp - 0xc], al
cmp dword [ebp - 0x18], 0
je 0x10006695
cmp dword [ebp - 0x18], 2
jne 0x10006675
mov byte [ebp - 0xd], 0x3d
mov byte [ebp - 0xc], 0x3d
push 0
lea edx, [ebp - 0xf]
mov ecx, 4
lea eax, [ebp - 0x2b0]
call fcn.10001978
call fcn.10001298
jmp 0x100066af
push 0
lea edx, [ebp - 0xf]
mov ecx, 4
lea eax, [ebp - 0x2b0]
call fcn.10001978
call fcn.10001298
add ebx, 4
cmp ebx, 0x4c
jne 0x100065c3
push 0
mov ecx, 2
mov edx, 0x10006754
lea eax, [ebp - 0x2b0]
call fcn.10001978
call fcn.10001298
xor ebx, ebx
jmp 0x100065c3
push 0
mov edx, 0x10006754
mov ecx, 2
lea eax, [ebp - 0x2b0]
call fcn.10001978
call fcn.10001298
lea eax, [ebp - 0x2b0]
call fcn.10001998
call fcn.10001298
lea eax, [ebp - 0x164]
call fcn.10001998
call fcn.10001298
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10006747
lea eax, [ebp - 0x2b4]
call fcn.100025a0
lea eax, [ebp - 8]
mov edx, 2
call fcn.100025c4
ret
Function at 0x10006db4
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.10002908
xor eax, eax
push ebp
push 0x10006e6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.10002918
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax]
call fcn.10003a38
push dword [ebp - 0xc]
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 1]
call fcn.10003a38
push dword [ebp - 0x10]
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 2]
call fcn.10003a38
push dword [ebp - 0x14]
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 3]
call fcn.10003a38
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 4
call fcn.100027e0
mov eax, dword [ebp - 8]
call fcn.10002918
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10006e71
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.100025c4
ret
Function at 0x10008440
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x10008580
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, 0x10008598
call fcn.10003c48
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x1000860c
call fcn.10002964
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.10002924
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x10007a2c
push 0
push 0
call sub.kernel32.dll_CreateThread
mov edx, dword [0x1000913c]
mov dword [edx], eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x10008200
push 0
push 0
call sub.kernel32.dll_CreateThread
mov edx, dword [0x10009134]
mov dword [edx], eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x10007a5c
push 0
push 0
call sub.kernel32.dll_CreateThread
mov edx, dword [0x10009124]
mov dword [edx], eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x10008390
push 0
push 0
call sub.kernel32.dll_CreateThread
mov edx, dword [0x10009130]
mov dword [edx], eax
xor eax, eax
push ebp
push 0x1000855b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x10008610
mov eax, dword [ebp - 8]
call fcn.10002918
push eax
lea edx, [ebp - 0xc]
mov eax, 0x1000861c
call fcn.10003c48
mov eax, dword [ebp - 0xc]
call fcn.10002918
push eax
lea edx, [ebp - 0x10]
mov eax, 0x10008638
call fcn.10003c48
mov eax, dword [ebp - 0x10]
call fcn.10002918
push eax
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x10008565
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10008587
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.100025c4
ret
Function at 0x401f80
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call fcn.00403b10
cmp dword [esi + 8], eax
jne 0x402036
mov eax, dword [ebp + 8]
push ebx
mov bl, byte [esi + 0xc]
push edi
mov dword [esi + 8], eax
mov edi, eax
mov byte [ebp + 8], bl
call fcn.00403b10
cmp edi, eax
je 0x401fbc
push dword [ebp + 8]
push edi
call fcn.00403b20
mov edi, dword [esi + 8]
add esp, 8
cmp dword [esi + 4], 0
lea eax, [ebp + 8]
push 4
mov byte [esi + 0xc], bl
mov dword [ebp + 8], 1
push eax
jne 0x402001
push 1
push 6
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x402034
push 0x401400
push str.all_your_TCP_packets_will_be_buffered
push str.Failed_to_set_socket_option__TCP_NODELAY___
call fcn.00403c20
push eax
call fcn.004011b0
add esp, 8
jmp 0x402023
push 0x20
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x402034
push 0x401400
push str.Failed_to_enable_broadcast_on_UDP_socket
call fcn.00403c20
push eax
call fcn.004011b0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
pop edi
pop ebx
pop esi
pop ebp
ret 4

Function at 0x402040
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.00403b10
cmp dword [esi + 8], eax
jne 0x40212e
xor eax, eax
cmp dword [esi + 4], eax
push edi
setne al
push 0
inc eax
push eax
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
call fcn.00403b10
cmp edi, eax
jne 0x402084
push 0x401400
push str.Failed_to_create_socket
jmp 0x402117
call fcn.00403b10
cmp dword [esi + 8], eax
jne 0x40212d
push ebx
mov bl, byte [esi + 0xc]
mov dword [esi + 8], edi
mov byte [ebp - 4], bl
call fcn.00403b10
cmp edi, eax
je 0x4020b4
push dword [ebp - 4]
push edi
call fcn.00403b20
mov edi, dword [esi + 8]
add esp, 8
cmp dword [esi + 4], 0
lea eax, [ebp - 4]
mov byte [esi + 0xc], bl
pop ebx
push 4
mov dword [ebp - 4], 1
push eax
jne 0x4020fa
push 1
push 6
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x40212d
push 0x401400
push str.all_your_TCP_packets_will_be_buffered
push str.Failed_to_set_socket_option__TCP_NODELAY___
call fcn.00403c20
push eax
call fcn.004011b0
add esp, 8
jmp 0x40211c
push 0x20
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x40212d
push 0x401400
push str.Failed_to_enable_broadcast_on_UDP_socket
call fcn.00403c20
push eax
call fcn.004011b0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402390
Capabilities:
Connect socket
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x130], eax
call fcn.00401f50
lea esi, [edi + 0x18]
mov dword [edi + 0x10], 0
lea eax, [ebp - 0x10]
mov dword [edi + 0x14], 0
cmp esi, eax
je 0x4023ed
mov ecx, esi
call fcn.004022d0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov ecx, edi
call fcn.00402040
push dword [ebp - 0x130]
mov ecx, ebx
call fcn.00403450
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403a70
push dword [0x4091f4]
push dword [0x4091f0]
movups xmm0, xmmword [eax]
push dword [ebp + 0x14]
movups xmmword [ebp - 0x28], xmm0
push dword [ebp + 0x10]
call fcn.00403b50
add esp, 0x1c
mov ecx, edi
test al, al
je 0x402461
push 0x10
lea eax, [ebp - 0x28]
push eax
call fcn.00402140
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4024a0
call fcn.00403ab0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403f05
mov esp, ebp
pop ebp
ret 0x10
call fcn.00402150
mov bl, al
mov byte [ebp - 0x130], bl
test bl, bl
je 0x40247b
push 0
mov ecx, edi
call fcn.00402160
push 0x10
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.00402140
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x4024b5
push dword [ebp - 0x130]
mov ecx, edi
call fcn.00402160
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403f05
mov esp, ebp
pop ebp
ret 0x10
call fcn.00403ab0
mov esi, eax
test bl, bl
je 0x4025de
cmp esi, 1
jne 0x4025d5
mov ecx, edi
mov dword [ebp - 0x12c], 0
call fcn.00402140
inc dword [ebp - 0x12c]
lea ecx, [ebp + 0x10]
mov dword [ebp - 0x128], eax
call fcn.00403b70
push 0
push 0xf4240
push edx
push eax
call fcn.004041d0
lea ecx, [ebp + 0x10]
mov dword [ebp - 0x140], eax
call fcn.00403b70
push 0
push 0xf4240
push edx
push eax
call fcn.00404280
mov dword [ebp - 0x13c], eax
mov ecx, edi
lea eax, [ebp - 0x140]
push eax
push 0
lea eax, [ebp - 0x12c]
push eax
push 0
call fcn.00402140
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x4025ce
mov ecx, edi
call fcn.00402140
mov esi, eax
call fcn.00403b10
cmp esi, eax
je 0x40259c
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], 0x10
push eax
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.00402140
push eax
call dword [sym.imp.WS2_32.dll_getpeername]
cmp eax, 0xffffffff
je 0x40259c
push dword [ebp - 0x10]
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
lea ecx, [ebp - 0x138]
call fcn.00402d70
jmp 0x4025b2
mov eax, dword [0x4091d0]
mov dword [ebp - 0x138], eax
mov eax, dword [0x4091d4]
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x138]
push 0x4091d0
push eax
call fcn.004030f0
add esp, 8
test al, al
je 0x4025ce
xor esi, esi
jmp 0x4025d5
call fcn.00403ab0
mov esi, eax
push 1
mov ecx, edi
call fcn.00402160
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403f05
mov esp, ebp
pop ebp
ret 0x10
Function at 0x402690
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
mov dword [esi], 0
test eax, eax
jne 0x4026ce
push 0x401400
push str.Cannot_receive_data_from_the_network__the_destination_buffer_is_invalid_
call fcn.00403c20
push eax
call fcn.004011b0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, 4
pop esi
pop ebp
ret 0xc
push 0
push dword [ebp + 0xc]
push eax
call fcn.00402140
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4026ed
mov dword [esi], eax
xor eax, eax
pop esi
pop ebp
ret 0xc
jne 0x4026f9
mov eax, 3
pop esi
pop ebp
ret 0xc
call fcn.00403ab0
pop esi
pop ebp
ret 0xc

Function at 0x402760
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov edx, ecx
mov dword [ebp - 4], edx
push edi
mov edi, dword [ebp + 0xc]
test ebx, ebx
je 0x4027d7
test edi, edi
je 0x4027d7
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
mov dword [esi], 0
push 0
mov eax, edi
sub eax, ecx
push eax
lea eax, [ecx + ebx]
mov ecx, edx
push eax
call fcn.00402140
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x4027ba
mov ecx, dword [esi]
mov edx, dword [ebp - 4]
add ecx, eax
mov dword [esi], ecx
cmp ecx, edi
jb 0x402785
xor eax, eax
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.00403ab0
cmp eax, 1
jne 0x4027b1
cmp dword [esi], 0
je 0x4027b1
pop esi
pop edi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x401400
push str.Cannot_send_data_over_the_network__no_data_to_send_
call fcn.00403c20
push eax
call fcn.004011b0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
pop edi
mov eax, 4
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403370
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push str.255.255.255.255
push edi
mov dword [esi], 0
mov byte [esi + 4], 0
call fcn.004029d0
add esp, 8
test al, al
je 0x4033ab
pop edi
mov dword [esi], 0xffffffff
mov byte [esi + 4], 1
pop esi
mov esp, ebp
pop ebp
ret 4
push str.0.0.0.0
push edi
call fcn.004029d0
add esp, 8
test al, al
jne 0x40343c
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x4033c7
mov eax, dword [edi]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x4033e1
pop edi
mov dword [esi], eax
mov byte [esi + 4], 1
pop esi
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x14], 0x10
xorps xmm0, xmm0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x2c], 2
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp + 8], 0
jb 0x403402
mov edi, dword [edi]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
push edi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x403440
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x403440
mov eax, dword [ecx + 0x18]
push ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x10], xmm0
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
movups xmm0, xmmword [ebp - 0x10]
psrldq xmm0, 4
movd dword [esi], xmm0
mov byte [esi + 4], 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x403860
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x28]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebx], 0
call fcn.00402d90
mov ecx, dword [eax]
mov dword [esi], ecx
xor ecx, ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x18]
mov word [eax], cx
test edi, edi
jne 0x4038df
push 0x401400
push str.Cannot_receive_data_from_the_network__the_destination_buffer_is_invalid_
call fcn.00403c20
push eax
call fcn.004011b0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403f05
mov esp, ebp
pop ebp
ret 0x14
push 0
lea eax, [ebp - 0x30]
push 0
push eax
call fcn.00403a70
mov ecx, dword [ebp - 0x20]
add esp, 0xc
movups xmm0, xmmword [eax]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0xc]
movups xmmword [ebp - 0x14], xmm0
push edi
call fcn.00402140
push eax
call dword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
jns 0x403936
call fcn.00403ab0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403f05
mov esp, ebp
pop ebp
ret 0x14
push dword [ebp - 0x10]
mov dword [ebx], eax
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
lea ecx, [ebp - 0x28]
call fcn.00402d70
push dword [ebp - 0x12]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov word [ecx], ax
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403f05
mov esp, ebp
pop ebp
ret 0x14