joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d0bb0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp], 0
jne 0x4d0c92
cmp dword [ebp + 4], 0xffffffff
jne 0x4d0c92
push ebx
lea ebx, [ebp + 0x13c]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov cl, byte [ecx + ebp + 0x13b]
cmp cl, 0x5c
je 0x4d0c22
cmp cl, 0x2f
je 0x4d0c22
mov edi, 0x60f838
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
cmp edi, 1
pop ebx
jne 0x4d0c4e
push 1
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4d0c4e
pop edi
pop esi
mov eax, 0x2000000
pop ebp
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push edi
push ecx
push esi
call fcn.004cf550
add esp, 0x10
test eax, eax
jne 0x4d0c71
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
push eax
call fcn.004cfb20
add esp, 4
mov dword [ebp], eax
neg eax
sbb eax, eax
pop edi
and eax, 0xfffffe00
pop esi
add eax, 0x200
pop ebp
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 0x1000000
pop ebp
pop ecx
ret 0xc

Function at 0x4d1290
Capabilities:
Create directory

Disassembly:
sub esp, 0x208
push esi
mov esi, dword [esp + 0x214]
mov al, byte [esi]
test al, al
je 0x4d1362
push ebx
push ebp
push edi
mov ebx, esi
mov ecx, esi
cmp al, 0x2f
je 0x4d12b7
cmp al, 0x5c
jne 0x4d12b9
mov ebx, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4d12af
mov ebp, dword [esp + 0x21c]
cmp ebx, esi
mov edx, ebx
je 0x4d12fc
mov eax, ebx
lea edi, [esp + 0x10]
sub eax, esi
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [esp + eax + 0x10], 0
lea eax, [esp + 0x10]
push eax
push ebp
call fcn.004d1290
add esp, 8
lea edx, [ebx + 1]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
lea ebx, [esp + 0x114]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x118]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x208
ret
Function at 0x51f000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5863b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push ecx
push ebx
push edx
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
lea eax, [esp + 0x20]
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.0051fea0
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], edx
je 0x51f0ab
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x51f0a2
cmp al, 0xff
je 0x51f0a2
dec al
mov byte [ecx], al
jmp 0x51f0ab
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x51f0dc
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x51f0d3
cmp al, 0xff
je 0x51f0d3
dec al
mov byte [ecx], al
jmp 0x51f0dc
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x769441
Capabilities:
Check http status code

Disassembly:
xor ebx, 0x1606d739
mov byte [esp], cl
clc
xor ecx, 0x9017e353
mov dword [esp], 0x774dfd24
xor esi, 0x323698af
bt ebp, esi
test edi, eax
xor edx, 0xdc4ec0a4
pushfd
call fcn.0076c0a2
arpl cx, bx
lcall 0x99eb, 0xf32ad5a
out 0xf5, eax
cmp al, 0xc8
push esi
pushal
idiv dword [eax]
mov bh, 0x13
push 2
loop 0x76948b
add dl, byte [edx - 0x6a]
xchg byte [edx - 0x4e], bl
out dx, al
mov dl, 0x3e
out dx, al
sbb dl, byte [0x2dca25e2]
jmp 0xa7fd87e7
Function at 0x401336
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x4034c0
call fcn.00401978
push 1
call fcn.004014d6
pop ecx
test al, al
jne 0x4011df
push 7
call fcn.00401743
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004014a1
mov byte [ebp - 0x24], al
mov eax, dword [0x40433c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4011d8
test eax, eax
jne 0x401249
mov dword [0x40433c], ecx
push 0x403110
push 0x4030fc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40122c
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x401330
push 0x4030f8
push 0x4030f0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x40433c], 2
jmp 0x40124e
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00401633
pop ecx
call fcn.00401737
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x40127e
push esi
call fcn.004015a6
pop ecx
test al, al
je 0x40127e
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00401972
call esi
call fcn.0040173d
mov esi, eax
cmp dword [esi], edi
je 0x40129c
push esi
call fcn.004015a6
pop ecx
test al, al
je 0x40129c
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.00401858
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.0040188b
test al, al
jne 0x4012d5
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x4012de
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00401650
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x401330
call fcn.004019be
ret
call fcn.00401050
jmp 0x4011c0

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x6b176bf0
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..text_1
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x4ca04bff
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401150
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401169
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4011a4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4011a0
lea ebx, [ebx]
cmp esi, eax
jae 0x4011a4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401190
cmp esi, eax
jb 0x4011aa
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402350
Capabilities:
Check os version

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4023f4
push 0x94
mov edi, 1
call fcn.00550ce4
mov esi, eax
add esp, 4
test esi, esi
je 0x402467
push 0x94
push 0
push esi
call fcn.00557650
add esp, 0xc
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esi + 4]
cmp eax, 4
jne 0x4023b5
push esi
lea edi, [eax + 1]
call fcn.00550c07
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp eax, 5
jne 0x40245e
cmp dword [esi + 8], 0
jne 0x4023d5
push esi
lea edi, [eax + 1]
call fcn.00550c07
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp eax, 5
jne 0x40245e
cmp dword [esi + 8], edi
jne 0x40245e
push esi
lea edi, [eax + 2]
call fcn.00550c07
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp al, 4
jae 0x4023fd
pop edi
xor eax, eax
pop esi
ret
push 0x94
mov edi, 2
call fcn.00550ce4
mov esi, eax
add esp, 4
test esi, esi
je 0x402467
push 0x94
push 0
push esi
call fcn.00557650
add esp, 0xc
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esi + 4]
cmp eax, 4
jne 0x40245e
cmp dword [esi + 8], 0xa
jne 0x402451
push esi
lea edi, [eax - 1]
call fcn.00550c07
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp eax, 4
jne 0x40245e
cmp dword [esi + 8], 0x5a
jne 0x40245e
mov edi, eax
push esi
call fcn.00550c07
add esp, 4
mov eax, edi
pop edi
pop esi
ret

Function at 0x404d20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.00460edb
Function at 0x415cd0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x57f198
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e4a44]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x24], edi
mov eax, dword [esp + 0x2c]
cmp dword [eax - 0xc], edi
jne 0x415d40
add eax, 0xfffffff0
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415d2a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push edi
push eax
call fcn.00552839
add esp, 8
cmp eax, 0xffffffff
je 0x415d70
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x415e65
mov ecx, dword [esp + 0x2c]
mov ebp, dword [ecx - 0xc]
lea edx, [ebp + 1]
push edx
call fcn.00450d15
lea esi, [ebp + 2]
push esi
mov ebx, eax
call fcn.00450d15
push esi
push edi
push eax
mov dword [esp + 0x28], eax
call fcn.00557650
mov edx, dword [esp + 0x40]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
dec eax
add esp, 0x14
or eax, ecx
jge 0x415dbd
push 1
lea ecx, [esp + 0x30]
call fcn.00403000
mov edx, dword [esp + 0x2c]
mov ecx, edx
mov edx, ebx
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x415dc1
cmp byte [esp + 0x30], al
je 0x415df5
cmp ebp, edi
mov eax, ebp
jl 0x415df5
mov cl, byte [eax + ebx]
cmp cl, 0x5c
je 0x415df1
cmp cl, 0x2f
je 0x415df1
dec ebp
sub eax, 1
mov byte [eax + ebx + 1], 0
jns 0x415dd7
jmp 0x415df5
mov byte [eax + ebx], 0
test ebp, ebp
jl 0x415e36
mov ecx, dword [esp + 0x14]
mov edx, ecx
sub edx, ebx
mov esi, ebx
mov dword [esp + 0x18], edx
mov al, byte [esi]
cmp al, 0x5c
je 0x415e15
cmp al, 0x2f
je 0x415e15
test al, al
jne 0x415e26
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov al, byte [esi]
mov byte [ecx + edi + 1], 0
mov byte [edx + esi], al
inc edi
inc esi
cmp edi, ebp
jle 0x415e07
push ebx
call fcn.00450d0a
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00450d0a
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x415e71
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x417720
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x57f83b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5e4a44]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov dword [esi], vtable.CPsw.0
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00403050
add eax, 0x10
mov dword [esi + 4], eax
mov cx, word [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
xor edi, edi
mov dword [esp + 0x18], edi
push 0x4eb0
mov word [esi + 8], cx
lea ecx, [esi + 0x18]
push edi
push ecx
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x4ec8], edi
mov dword [esi + 0x4ecc], edi
call fcn.00557650
mov edx, dword [esi + 0xc]
add esp, 0x10
push 7
mov dword [edx], edi
mov ecx, dword [esi + 0x10]
push str.Unknown
call fcn.00402ef0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0x14

Function at 0x417810
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x4c
mov eax, dword [0x5e4a44]
xor eax, esp
mov dword [esp + 0x44], eax
cmp byte [esp + 0x54], 0
mov eax, dword [esp + 0x50]
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov byte [esp + 0x13], 0
je 0x417856
mov edx, 0xd2
cmp edx, dword [0x5e6a70]
sbb eax, eax
and eax, 0xfffffff0
add eax, 0x3c
or ecx, 0xffffffff
sub ecx, eax
add ebx, ecx
lea edi, [ebx + 6]
push edi
call fcn.00450d15
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x417917
push edi
push 0
push ebp
call fcn.00557650
add esp, 0xc
lea esi, [esp + 0x1c]
mov byte [esp + 0x50], 1
mov byte [esp + 0x51], 0
mov dword [esp + 0x20], ebp
mov byte [esp + 0x1c], 1
mov byte [esp + 0x1d], 1
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov byte [esp + 0x52], 1
call fcn.004198e0
push ebx
call fcn.00419880
cmp byte [esp + 0x52], 0
je 0x4178d7
cmp byte [esp + 0x1d], 0
je 0x4178d7
cmp ebx, dword [esp + 0x2c]
ja 0x4178d7
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
push ebx
push edx
push eax
call fcn.00558100
add esp, 0xc
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x4ecc]
push 0
push edi
push ebp
push edx
call dword [sym.imp.WS2_32.dll_send]
mov bl, 1
cmp eax, 0xffffffff
jne 0x4178f7
mov bl, byte [esp + 0x13]
push ebp
call fcn.00450d0a
add esp, 4
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.005509f8
add esp, 0x4c
ret 8
mov ecx, dword [esp + 0x54]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005509f8
add esp, 0x4c
ret 8
Function at 0x418b20
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x58375b
mov eax, dword fs:[0]
push eax
mov eax, 0x9e60
call fcn.0055a0b0
mov eax, dword [0x5e4a44]
xor eax, esp
mov dword [esp + 0x9e58], eax
push ebp
push esi
mov eax, dword [0x5e4a44]
xor eax, esp
push eax
lea eax, [esp + 0x9e6c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x9e84]
mov esi, dword [esp + 0x9e7c]
mov ebp, dword [esp + 0x9e80]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov dword [edi + 0x14], 0x7d1
call fcn.00415ad0
xor eax, eax
mov dword [esp + 0x9e74], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov eax, dword [0x5f4e64]
mov ecx, eax
inc eax
mov dword [esp + 0x38], ecx
push esi
lea ecx, [esp + 0x9e50]
mov dword [0x5f4e64], eax
call fcn.00402bc0
push ebx
lea ecx, [esp + 0x9e54]
call fcn.00402bc0
push ebp
lea ecx, [esp + 0x9e58]
call fcn.00402bc0
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x9e5c]
call fcn.00402bc0
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x9e60]
call fcn.00402bc0
mov edx, dword [esp + 0x14]
push edx
lea ecx, [esp + 0x9e64]
call fcn.00402bc0
push 0x4eb0
lea esi, [edi + 0x18]
push 0
push esi
call fcn.00557650
add esp, 0xc
push 0x4eb0
push esi
lea ecx, [esp + 0x24]
call fcn.00439d50
mov edx, dword [esp + 0x9dbc]
mov eax, 0xd2
cmp eax, dword [0x5e6a70]
lea esi, [esp + 0x1c]
sbb ecx, ecx
and ecx, 0xfffffff0
add ecx, 0x3c
sub ecx, dword [esp + 0x9dc4]
mov dword [esp + 0x9e74], 0xffffffff
lea eax, [ecx + edx + 1]
mov dword [edi + 0x4ec8], eax
call fcn.0043a960
mov ecx, edi
call fcn.00417e90
mov ecx, dword [esp + 0x9e6c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x9e58]
xor ecx, esp
call fcn.005509f8
add esp, 0x9e6c
ret 0xc
Function at 0x41a940
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x582874
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x5e4a44]
xor eax, esp
mov dword [esp + 0x19c], eax
push ebx
mov eax, dword [0x5e4a44]
xor eax, esp
push eax
lea eax, [esp + 0x1a8]
mov dword fs:[0], eax
push 1
mov ecx, 0x5f5210
mov dword [esp + 0x14], 0x5f5210
call fcn.0046a73c
mov dword [esp + 0x1b0], 0
push 0x5f52f8
mov dword [0x5f5210], 0x5b0144
call fcn.0040b270
mov ecx, 0x5f57d8
call fcn.00404da0
lea eax, [esp + 0x14]
mov ebx, 2
push eax
push ebx
mov byte [esp + 0x1b8], bl
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x41aa5f
push 0x5aff78
lea ecx, [esp + 0xc]
call fcn.004024e0
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
mov byte [esp + 0x1b8], 3
call fcn.00419f40
mov ecx, dword [0x5f5808]
mov eax, dword [eax]
add esp, 8
push 0x10
push ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41aa31
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1b0], bl
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41aa58
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 1
call fcn.0055408d
cmp byte [esp + 0x14], bl
je 0x41aaf9
push 0x5aff8c
lea ecx, [esp + 0xc]
call fcn.004024e0
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
mov byte [esp + 0x1b8], 4
call fcn.00419f40
mov ecx, dword [0x5f5808]
mov eax, dword [eax]
add esp, 8
push 0x10
push ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41aac5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1b0], bl
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41aaec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 1
call fcn.0055408d
mov eax, 0x5f5210
mov ecx, dword [esp + 0x1a8]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x19c]
xor ecx, esp
call fcn.005509f8
add esp, 0x1ac
ret
Function at 0x41c9e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57f658
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x5e4a44]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
call fcn.00454925
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41ca1f
push 0x80004005
call fcn.004010d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 4], eax
mov dword [esp + 0x10], 0
call fcn.00454925
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41ca50
push 0x80004005
call fcn.004010d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov byte [esp + 0x10], 1
call fcn.00454925
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41ca7e
push 0x80004005
call fcn.004010d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [esp + 0x10], 2
call fcn.00454925
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41caac
push 0x80004005
call fcn.004010d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
mov byte [esp + 0x10], 3
call fcn.00454925
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41cada
push 0x80004005
call fcn.004010d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x24], eax
mov byte [esp + 0x10], 4
call fcn.00454925
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41cb08
push 0x80004005
call fcn.004010d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x28], eax
mov byte [esp + 0x10], 5
call fcn.00454925
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41cb36
push 0x80004005
call fcn.004010d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x2c], eax
mov byte [esp + 0x10], 6
call fcn.00454925
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41cb64
push 0x80004005
call fcn.004010d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x30], eax
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x10], 7
call fcn.0041cba0
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 8