joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003fb89
Capabilities:
Hash data using sha256

Disassembly:
mov ecx, dword [esi + 4]
mov eax, dword [esi]
lea edx, [eax + ecx]
cmp edx, ecx
push ebx
push edi
lea edi, [esi + 0x50]
mov dword [esi + 4], edx
jae 0x1003fba0
inc dword [esi + 8]
mov ebx, 0x80
mov byte [eax + edi], bl
inc dword [esi]
mov eax, dword [esi]
cmp eax, 0x70
jbe 0x1003fbda
mov ecx, ebx
sub ecx, eax
push ecx
add eax, edi
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push edi
mov eax, ebx
mov edx, edi
mov dword [esi], ebx
call fcn.1003d96b
pop ecx
push esi
call fcn.1003da4f
and dword [esi], 0
pop ecx
mov eax, dword [esi]
push 0x70
pop ecx
sub ecx, eax
push ecx
xor ebx, ebx
add eax, edi
push ebx
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
add esp, 0xc
mov ecx, eax
shl eax, 3
push edi
shr ecx, 0x1d
lea ecx, [ecx + edx*8]
mov dword [esi + 4], eax
push 0x70
pop eax
mov edx, edi
mov dword [esi + 8], ecx
call fcn.1003d96b
mov eax, dword [esi + 8]
pop ecx
mov dword [esi + 0xc0], eax
mov eax, dword [esi + 4]
push esi
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], ebx
call fcn.1003da4f
pop ecx
lea edi, [esi + 0x10]
push edi
push 0x40
pop eax
mov edx, edi
call fcn.1003d96b
pop ecx
push 0x40
push edi
push dword [esp + 0x14]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, esi
pop edi
pop ebx
jmp fcn.1003d9d4

Function at 0x1003fc5f
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push edi
push 0xf0000000
push 1
xor edi, edi
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1003fc84
push 0xffffffffffffff99
pop edi
jmp 0x1003fcc6
lea eax, [ebp - 0x20]
push eax
push 0x20
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x1003fc9a
push 0xffffffffffffff98
jmp 0x1003fc81
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [ebp - 0x20]
push 0x20
push eax
lea eax, [esi + 4]
call fcn.1003acf3
push 0x100
lea eax, [ebp - 0x120]
push eax
push esi
call fcn.1003fccb
add esp, 0x14
mov eax, edi
pop edi
leave
ret
Function at 0x1003fcf4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
lea edx, [eax + 0x20]
mov esi, edx
push 8
pop ebx
mov ecx, ebx
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x40]
mov esi, 0x4d34d34d
add ecx, esi
add dword [edx], ecx
mov edx, dword [edx]
cmp edx, dword [ebp - 0x2c]
mov ecx, 0x2cb2cb2d
sbb edx, edx
neg edx
sub edx, ecx
add dword [eax + 0x24], edx
mov edx, dword [eax + 0x24]
cmp edx, dword [ebp - 0x28]
mov edx, 0x34d34d34
sbb edi, edi
neg edi
add edi, edx
add dword [eax + 0x28], edi
mov edi, dword [eax + 0x28]
cmp edi, dword [ebp - 0x24]
mov dword [ebp - 0xc], ebx
sbb edi, edi
neg edi
add edi, esi
add dword [eax + 0x2c], edi
mov edi, dword [eax + 0x2c]
cmp edi, dword [ebp - 0x20]
sbb edi, edi
neg edi
sub edi, ecx
add dword [eax + 0x30], edi
mov edi, dword [eax + 0x30]
cmp edi, dword [ebp - 0x1c]
sbb edi, edi
neg edi
add edi, edx
add dword [eax + 0x34], edi
mov edx, dword [eax + 0x34]
cmp edx, dword [ebp - 0x18]
sbb edx, edx
neg edx
add edx, esi
add dword [eax + 0x38], edx
mov edx, dword [eax + 0x38]
cmp edx, dword [ebp - 0x14]
mov esi, eax
sbb edx, edx
neg edx
sub edx, ecx
add dword [eax + 0x3c], edx
mov ecx, dword [eax + 0x3c]
cmp ecx, dword [ebp - 0x10]
mov dword [ebp - 8], esi
sbb ecx, ecx
neg ecx
mov dword [eax + 0x40], ecx
lea ecx, [ebp - 0x2c]
sub ecx, eax
mov edx, dword [esi + 0x20]
add edx, dword [esi]
movzx edi, dx
mov esi, edx
shr esi, 0x10
mov dword [ebp - 4], esi
imul esi, edi
mov ebx, edi
imul ebx, edi
shr ebx, 0x11
add ebx, esi
mov esi, dword [ebp - 4]
imul esi, esi
shr ebx, 0xf
add ebx, esi
mov esi, edx
imul esi, edx
xor ebx, esi
mov esi, dword [ebp - 8]
mov dword [ecx + esi], ebx
add esi, 4
dec dword [ebp - 0xc]
mov dword [ebp - 8], esi
jne 0x1003fda4
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x10]
mov esi, ecx
rol esi, 0x10
add esi, edx
rol edi, 0x10
add edi, esi
mov esi, edx
rol esi, 8
add esi, dword [ebp - 0x28]
mov dword [eax], edi
add esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x28]
rol edi, 0x10
mov dword [eax + 4], esi
mov esi, dword [ebp - 0x24]
add edi, esi
rol edx, 0x10
add edx, edi
mov edi, dword [ebp - 0x20]
mov dword [eax + 8], edx
mov edx, esi
rol edx, 8
add edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x28]
rol edi, 0x10
rol esi, 0x10
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x1c]
add edi, edx
add esi, edi
mov dword [eax + 0x10], esi
mov esi, edx
rol esi, 8
add esi, dword [ebp - 0x18]
pop edi
add esi, dword [ebp - 0x20]
mov dword [eax + 0x14], esi
mov esi, dword [ebp - 0x18]
rol esi, 0x10
add esi, ecx
rol edx, 0x10
add edx, esi
rol ecx, 8
add ecx, dword [ebp - 0x18]
pop esi
add ecx, dword [ebp - 0x10]
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], ecx
pop ebx
leave
ret
Function at 0x1003fef4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ebx
push edi
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
shl eax, 0x10
mov ebx, edi
shr ebx, 0x10
or eax, ebx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x10
mov ebx, ecx
shl ebx, 0x10
or eax, ebx
mov dword [esi + 0xc], eax
mov eax, edx
shl eax, 0x10
mov ebx, ecx
shr ebx, 0x10
or eax, ebx
mov dword [esi + 0x14], eax
mov ebx, edx
shr ebx, 0x10
mov eax, edi
shl eax, 0x10
or eax, ebx
mov dword [esi + 0x1c], eax
mov eax, edi
rol eax, 0x10
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 4]
rol eax, 0x10
mov dword [esi + 0x28], eax
mov eax, ecx
rol eax, 0x10
mov ebx, edx
mov dword [esi + 0x30], eax
mov eax, edx
xor ebx, ecx
rol eax, 0x10
mov dword [esi + 0x38], eax
mov eax, 0xffff
and ebx, eax
xor ebx, ecx
mov dword [esi + 0x24], ebx
mov dword [esi + 8], edx
mov ebx, edi
xor ebx, edx
and ebx, eax
xor ebx, edx
mov edx, dword [ebp - 4]
xor edx, edi
and edx, eax
xor edx, edi
mov dword [esi + 0x34], edx
mov edx, dword [ebp - 4]
xor edx, ecx
and edx, eax
xor edx, dword [ebp - 4]
and dword [esi + 0x40], 0
push 4
mov dword [esi + 0x10], edi
mov dword [esi], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x3c], edx
pop edi
mov eax, esi
call fcn.1003fcf4
dec edi
jne 0x1003ffaa
pop edi
xor ecx, ecx
lea eax, [esi + 0x20]
pop ebx
lea edx, [ecx - 4]
and edx, 7
mov edx, dword [esi + edx*4]
xor dword [eax], edx
inc ecx
add eax, 4
cmp ecx, 8
jb 0x1003ffbb
push 8
lea eax, [esi + 0x20]
pop ecx
mov edx, dword [eax - 0x20]
mov dword [eax + 0x24], edx
mov edx, dword [eax]
mov dword [eax + 0x44], edx
add eax, 4
dec ecx
jne 0x1003ffd5
mov eax, dword [esi + 0x40]
mov dword [esi + 0x84], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x1003fffd
mov edx, esi
call fcn.1003fe6c
leave
ret
Function at 0x1003ffff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0x10
push ebx
push esi
push edi
mov ebx, eax
mov esi, ecx
jb 0x10040089
mov ecx, dword [ebp + 0xc]
shr ecx, 4
lea eax, [esi + 0x44]
mov dword [ebp - 4], ecx
call fcn.1003fcf4
movzx edx, word [esi + 0x5a]
mov ecx, dword [esi + 0x50]
shl ecx, 0x10
xor edx, ecx
xor edx, dword [eax]
mov ecx, dword [ebp + 8]
xor edx, dword [ebx]
sub dword [ebp + 0xc], 0x10
mov dword [ecx], edx
movzx edx, word [esi + 0x62]
mov edi, dword [esi + 0x58]
shl edi, 0x10
xor edx, edi
xor edx, dword [ebx + 4]
add ecx, 0x10
xor edx, dword [esi + 0x4c]
add ebx, 0x10
mov dword [ecx - 0xc], edx
movzx edx, word [esi + 0x4a]
mov edi, dword [esi + 0x60]
shl edi, 0x10
xor edx, edi
xor edx, dword [ebx - 8]
mov dword [ebp + 8], ecx
xor edx, dword [esi + 0x54]
mov dword [ecx - 8], edx
movzx edx, word [esi + 0x52]
mov edi, dword [esi + 0x48]
shl edi, 0x10
xor edx, edi
xor edx, dword [ebx - 4]
xor edx, dword [esi + 0x5c]
dec dword [ebp - 4]
mov dword [ecx - 4], edx
jne 0x1004001e
cmp dword [ebp + 0xc], 0
je 0x10040108
lea eax, [esi + 0x44]
call fcn.1003fcf4
mov ecx, dword [esi + 0x58]
mov edx, dword [esi + 0x50]
mov edi, ecx
mov eax, edx
shl eax, 0x10
shr edi, 0x10
xor eax, edi
xor eax, dword [esi + 0x44]
mov edi, dword [esi + 0x60]
mov dword [ebp - 0x14], eax
shl ecx, 0x10
mov eax, edi
shr eax, 0x10
xor eax, ecx
xor eax, dword [esi + 0x4c]
shl edi, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x48]
mov ecx, eax
shr ecx, 0x10
xor ecx, edi
xor ecx, dword [esi + 0x54]
shl eax, 0x10
shr edx, 0x10
xor eax, edx
xor eax, dword [esi + 0x5c]
mov dword [ebp - 0xc], ecx
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
mov dword [ebp - 8], eax
jbe 0x10040108
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
mov esi, ebx
sub esi, eax
sub edi, eax
lea eax, [ebp + ecx - 0x14]
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc ecx
cmp ecx, dword [ebp + 0xc]
mov byte [edi + eax], dl
jb 0x100400f6
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10043676
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1005bee0]
jne 0x10043680
repz ret
jmp fcn.100438be

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4010c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4258b6
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x42d414]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov eax, 0xf
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], ebx
mov byte [esi + 0x30], bl
mov dword [esp + 0x14], ebx
mov dword [esi + 0x60], eax
mov dword [esi + 0x5c], ebx
mov byte [esi + 0x4c], bl
mov byte [esp + 0x14], 1
call fcn.0040b2f0
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], ebx
xor eax, eax
mov dword [esi], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ebx
mov byte [esi + 0x70], bl
mov word [esi + 0x72], 2
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x401470
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x20
mov eax, dword [0x42d414]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push 0
push 1
push 2
mov dword [esp + 0x18], 0x25a207b9
mov word [esp + 0x1c], 0xddf3
mov word [esp + 0x1e], 0x4660
mov byte [esp + 0x20], 0x8e
mov byte [esp + 0x21], 0xe9
mov byte [esp + 0x22], 0x76
mov byte [esp + 0x23], 0xe5
mov byte [esp + 0x24], 0x8c
mov byte [esp + 0x25], 0x74
mov byte [esp + 0x26], 6
mov byte [esp + 0x27], 0x3e
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4014e2
xor al, al
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00419af5
add esp, 0x20
ret
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 4
lea ecx, [esp + 0x14]
push ecx
push 0x10
lea edx, [esp + 0x24]
push edx
push 0xc8000006
push esi
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.WS2_32.dll_WSAIoctl]
mov eax, dword [esp + 4]
push esi
mov dword [edi + 0x30], eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp dword [edi + 0x30], eax
pop esi
setne al
xor ecx, esp
call fcn.00419af5
add esp, 0x20
ret
Function at 0x401540
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, eax
call fcn.00401470
test al, al
jne 0x40155a
xor al, al
pop edi
pop esi
pop ebp
ret 0x10
cmp dword [edi + 4], 0xffffffff
lea esi, [edi + 4]
mov dword [esi + 0xc], edi
jne 0x401552
push 0
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x401552
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
push esi
push 0x4010b0
push 0
push 0
call fcn.00419bfe
add esp, 0x18
test eax, eax
je 0x4015a2
mov dword [esi + 8], eax
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push ebx
push edx
lea eax, [edi + 0x34]
push eax
mov dword [edi + 0x14], ecx
call fcn.0041adc0
add esp, 0xc
test ebp, ebp
mov dword [edi + 0x50], ebx
je 0x4015dc
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4015c7
sub eax, edx
push eax
push ebp
lea ecx, [edi + 0x54]
call fcn.0040ff50
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x401605
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4015f0
sub eax, edx
push eax
push esi
lea ecx, [edi + 0x70]
call fcn.0040ff50
pop edi
pop esi
mov al, 1
pop ebp
ret 0x10
Function at 0x401700
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 0xffffffffffffffff
push 0x425ecb
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x42d414]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
movzx ebx, word [edi + 0x34]
push 1
push 0
push 0
push 6
movzx ebp, bx
push 1
push ebp
mov byte [esp + 0x2f], 0
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40176e
push 1
push 0
push 0
push 0x11
push 2
push ebp
call dword [sym.imp.WS2_32.dll_WSASocketA]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x401775
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor al, al
jmp 0x4018e8
lea eax, [edi + 0x8c]
push eax
mov dword [esp + 0x2c], vtable.AutoLock.0
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebp, ebp
push 0x74
mov dword [esp + 0x3c], ebp
call fcn.00419cca
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebp
mov byte [esp + 0x38], 1
je 0x4017b7
push eax
call fcn.004010c0
mov ebp, eax
mov eax, dword [esp + 0x18]
push 0xffffffffffffffff
push 0
lea ecx, [edi + 0x54]
mov byte [esp + 0x40], 0
push ecx
lea ecx, [ebp + 0x2c]
mov dword [ebp], esi
mov dword [ebp + 4], eax
call fcn.0040fa40
push 0xffffffffffffffff
push 0
lea edx, [edi + 0x70]
push edx
lea ecx, [ebp + 0x48]
call fcn.0040fa40
mov word [ebp + 0x72], bx
lea eax, [edi + 0x24]
lea ebx, [esp + 0x40]
mov dword [esp + 0x20], eax
call fcn.0040a1d0
mov dword [eax], ebp
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [edi + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
push 1
push esi
push ecx
push esi
call ebx
test eax, eax
je 0x401857
mov eax, dword [esp + 0x18]
mov edx, dword [edi + 4]
push 1
push eax
push edx
push eax
call ebx
test eax, eax
je 0x401857
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [edi + 0x50]
push eax
push ecx
push edx
push esi
lea ebx, [edi + 0x34]
call fcn.00401f30
test al, al
je 0x401857
mov al, 1
jmp 0x4018e8
mov ebx, dword [esp + 0x1c]
push ebx
mov dword [esp + 0x2c], vtable.AutoLock.0
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 0x40]
mov dword [esp + 0x38], 2
mov ebp, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x24]
push ecx
mov esi, ebp
call fcn.0040a860
mov edi, dword [esp + 0x20]
test edi, edi
mov esi, dword [ebp + 4]
je 0x40189a
cmp edi, ebp
je 0x40189f
call fcn.0041a633
cmp dword [esp + 0x24], esi
je 0x4018dd
test edi, edi
jne 0x4018ae
call fcn.0041a633
mov edx, dword [esp + 0x24]
cmp edx, dword [edi + 4]
jne 0x4018bc
call fcn.0041a633
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4018cc
call fcn.00402db0
mov ecx, dword [esp + 0x24]
push ecx
push edi
lea edx, [esp + 0x48]
push edx
push ebp
call fcn.0040a270
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
Function at 0x402000
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x18
push esi
mov esi, eax
test esi, esi
jne 0x402035
mov ecx, ebx
call fcn.00401da0
mov ecx, dword [esp + 0x24]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
lea ecx, [esi + 0x44]
mov eax, 0x10000
mov dword [esi + 0x20], 4
call fcn.0040b110
mov eax, dword [esi + 0x48]
test eax, eax
je 0x402043
mov edx, dword [esi + 0x4c]
sub edx, eax
jne 0x402048
call fcn.0041a633
mov eax, dword [esi + 0x48]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x40205c
mov dword [esp + 0x10], eax
jmp 0x402065
mov ecx, dword [esi + 0x4c]
sub ecx, eax
mov dword [esp + 0x10], ecx
push 0
push esi
lea eax, [esi + 0x40]
push eax
mov dword [esp + 0x14], 0
lea edx, [esi + 0x24]
push edx
mov dword [eax], 0x1c
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
push 1
lea edx, [esp + 0x2c]
push edx
push edi
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
test eax, eax
je 0x4020c1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x4020c1
mov eax, dword [ebx + 4]
push esi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x4020c1
push esi
mov ecx, ebx
call fcn.00401e50
mov al, 1
pop esi
add esp, 0x18
ret 8

Function at 0x4020d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x18
push esi
mov esi, eax
test esi, esi
jne 0x402105
mov ecx, ebx
call fcn.00401da0
mov ecx, dword [esp + 0x24]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
lea ecx, [esi + 0x44]
mov eax, 0x10000
mov dword [esi + 0x20], 2
call fcn.0040b110
mov eax, dword [esi + 0x48]
test eax, eax
je 0x402113
mov edx, dword [esi + 0x4c]
sub edx, eax
jne 0x402118
call fcn.0041a633
mov eax, dword [esi + 0x48]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x40212c
mov dword [esp + 0x10], eax
jmp 0x402135
mov ecx, dword [esi + 0x4c]
sub ecx, eax
mov dword [esp + 0x10], ecx
push 0
push esi
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0x24]
push ecx
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x402183
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x402183
mov edx, dword [ebx + 4]
push esi
push edi
push 0
push edx
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x402183
push esi
mov ecx, ebx
call fcn.00401e50
mov al, 1
pop esi
add esp, 0x18
ret 8
Function at 0x402190
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov ecx, ebp
mov ebx, eax
call fcn.00401da0
test ebx, ebx
mov ecx, dword [esp + 0x34]
mov esi, eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], 1
jle 0x4021f0
lea edi, [esi + 0x44]
mov eax, ebx
mov ecx, edi
call fcn.0040b110
mov eax, dword [edi + 4]
test eax, eax
je 0x4021d9
mov edx, dword [edi + 8]
sub edx, eax
jne 0x4021de
call fcn.0041a633
mov eax, dword [esp + 0x2c]
mov ecx, dword [edi + 4]
push ebx
push eax
push ecx
call fcn.0041adc0
add esp, 0xc
mov eax, dword [esi + 0x48]
test eax, eax
lea ebx, [esi + 0x44]
je 0x402201
mov edx, dword [ebx + 8]
sub edx, eax
jne 0x402206
call fcn.0041a633
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 4]
test eax, eax
jne 0x40221a
mov dword [esp + 0x18], eax
jmp 0x402223
mov ecx, dword [ebx + 8]
sub ecx, eax
mov dword [esp + 0x18], ecx
mov edi, dword [esp + 0x28]
push 0
push esi
push 0
lea edx, [esp + 0x20]
push edx
push 1
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x402282
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x402282
mov dword [esi + 0x20], 2
call fcn.00409d00
mov ecx, dword [ebp + 4]
push esi
push edi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x402276
push esi
mov ecx, ebp
call fcn.00401e50
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret 0x14
Function at 0x402430
Capabilities:
Set socket configuration

Disassembly:
push 0xffffffffffffffff
push 0x4261c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x42d414]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [esp + 0x4c], 0
je 0x402479
mov esi, dword [esp + 0x48]
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
push eax
push ecx
mov ecx, ebx
call fcn.00401900
push esi
jmp 0x4025c7
lea eax, [ebx + 0x8c]
push eax
mov dword [esp + 0x24], vtable.AutoLock.0
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebp, dword [esp + 0x48]
add ebp, 0x18
push ebp
lea edx, [esp + 0x1c]
lea esi, [ebx + 0x24]
push edx
mov dword [esp + 0x44], 0
call fcn.0040a860
mov edi, dword [esp + 0x18]
test edi, edi
mov eax, dword [esi + 4]
mov dword [esp + 0x2c], eax
je 0x4024c2
cmp edi, esi
je 0x4024c7
call fcn.0041a633
mov ecx, dword [esp + 0x2c]
cmp dword [esp + 0x1c], ecx
je 0x4025af
mov edx, dword [esp + 0x44]
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
push 0
push 0
push 0x7010
push 0xffff
push edx
mov dword [esp + 0x60], 1
call esi
mov ecx, dword [esp + 0x44]
push 4
lea eax, [esp + 0x50]
push eax
push 1
push 6
push ecx
call esi
mov eax, dword [esp + 0x44]
push 4
lea edx, [esp + 0x50]
push edx
push 8
push 0xffff
push eax
call esi
test edi, edi
mov byte [esp + 0x44], 5
mov byte [esp + 0x45], 1
jne 0x402532
call fcn.0041a633
mov esi, dword [esp + 0x1c]
cmp esi, dword [edi + 4]
jne 0x402540
call fcn.0041a633
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx + 0x40]
neg edx
sbb dl, dl
and edx, 2
cmp esi, dword [edi + 4]
mov byte [esp + 0x46], dl
jne 0x40255b
call fcn.0041a633
mov eax, dword [ebp + 4]
mov ecx, dword [ebp]
push eax
mov eax, dword [esi + 0x18]
push ecx
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
push edx
push ecx
push ebx
mov eax, 3
call fcn.00402190
test al, al
je 0x402591
cmp esi, dword [edi + 4]
jne 0x402587
call fcn.0041a633
mov edx, dword [esi + 0x18]
mov dword [edx + 8], 1
cmp esi, dword [edi + 4]
jne 0x40259b
call fcn.0041a633
mov eax, dword [ebp + 4]
mov ecx, dword [ebp]
mov edx, dword [esi + 0x18]
mov edi, dword [edx]
push eax
push ecx
xor eax, eax
call fcn.004020d0
mov dword [esp + 0x3c], 0xffffffff
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x48]
push ecx
mov ecx, ebx
call fcn.00401e50
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc
Function at 0x402dd0
Capabilities:
Create thread
Get system information on windows

Disassembly:
mov eax, dword [esi + 0x18]
sub esp, 0x28
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esp + 0x30]
lea edx, [esp + 8]
push edx
mov dword [esi], ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x402dfe
mov eax, 1
test eax, eax
jle 0x402e3a
mov edi, eax
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x402f80
push 0
push 0
call fcn.00419bfe
add esp, 0x18
test eax, eax
mov dword [esp + 0x30], eax
je 0x402e35
cmp eax, 0xffffffff
je 0x402e35
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esi + 4]
call fcn.0040a570
sub edi, 1
jne 0x402e02
mov al, 1
pop edi
add esp, 0x28
ret 4