joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415ca0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42b1ab
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1050
call fcn.00420b50
mov eax, dword [0x43d288]
xor eax, esp
mov dword [esp + 0x104c], eax
push esi
push edi
mov eax, dword [0x43d288]
xor eax, esp
push eax
lea eax, [esp + 0x1060]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], ax
mov dword [esp + 0x1068], eax
cmp byte [0x43f460], al
je 0x415d75
push str.wthttp.log
mov edx, 0x43f56c
lea ecx, [esp + 0x14]
call fcn.004030d0
mov esi, eax
add esp, 4
lea eax, [esp + 0x28]
cmp eax, esi
je 0x415d60
cmp dword [esp + 0x3c], 8
jb 0x415d3f
push dword [esp + 0x28]
call fcn.0041ac27
add esp, 4
xor eax, eax
mov dword [esp + 0x3c], 7
push esi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
call fcn.00402fd0
cmp dword [esp + 0x24], 8
jb 0x415d85
push dword [esp + 0x10]
call fcn.0041ac27
add esp, 4
jmp 0x415d85
push 0xa
push str.wthttp.log
lea ecx, [esp + 0x30]
call fcn.00404040
cmp dword [esp + 0x3c], 8
lea eax, [esp + 0x28]
push 0
cmovae eax, dword [esp + 0x2c]
push 0x80
push 4
push 0
push 1
push 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x415e46
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x4c]
movzx eax, word [esp + 0x4a]
push edi
push ecx
push eax
movzx eax, word [esp + 0x54]
push eax
movzx eax, word [esp + 0x50]
push eax
movzx eax, word [esp + 0x56]
push eax
movzx eax, word [esp + 0x5e]
push eax
lea eax, [esp + 0x70]
push str.__02d._02d._d__02d:_02d:_02d___s_n
push eax
call fcn.004163b0
add esp, 0x24
xor eax, eax
cmp byte [esp + eax + 0x54], 0
je 0x415e2b
cmp byte [esp + eax + 0x55], 0
je 0x415e2a
cmp byte [esp + eax + 0x56], 0
je 0x415e25
cmp byte [esp + eax + 0x57], 0
je 0x415e20
add eax, 4
cmp eax, 0x1000
jb 0x415df8
jmp 0x415e2b
add eax, 3
jmp 0x415e2b
add eax, 2
jmp 0x415e2b
inc eax
push 0
lea ecx, [esp + 0x54]
push ecx
push eax
lea eax, [esp + 0x60]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x3c], 8
jb 0x415e59
push dword [esp + 0x28]
call fcn.0041ac27
add esp, 4
mov ecx, dword [esp + 0x1060]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x104c]
xor ecx, esp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret
Function at 0x4162e0
Capabilities:
Create mailslot
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43d288]
xor eax, ebp
mov dword [ebp - 4], eax
push 1
lea eax, [ebp - 0x18]
mov dword [0x43f450], edx
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push 0xffffffffffffffff
push 0x80
push str..mailslotWTHTTPLogging
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
mov dword [0x43e370], eax
cmp eax, 0xffffffff
jne 0x416368
push str..mailslotWTHTTPLogging
push str.ERROR:_failed_to_create_mailslot___s_.
call fcn.00415f40
add esp, 8
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x416230
call fcn.0041dabb
add esp, 0xc
test eax, eax
jne 0x41639a
push str.ERROR:__beginthread____failed.
call fcn.00415f40
add esp, 4
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret
Function at 0x4167b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b1e8
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x43d288]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x30], 0
call fcn.00416750
test al, al
je 0x4168de
lea eax, [ebp - 0x94]
push eax
lea ecx, [edi + 8]
call fcn.00417c80
push eax
mov edx, 0x43f59c
lea ecx, [ebp - 0x2c]
call fcn.004030d0
add esp, 4
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
push 0
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.0041b2c5
add esp, 8
cmp eax, 0xffffffff
jne 0x41688f
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.0041dc1d
add esp, 4
test eax, eax
jne 0x4168ad
movzx eax, byte [edi + 0xd]
lea ecx, [ebp - 0x50]
push eax
movzx eax, byte [edi + 0xc]
push eax
movzx eax, byte [edi + 0xb]
push eax
movzx eax, byte [edi + 0xa]
push eax
movzx eax, byte [edi + 9]
push eax
movzx eax, byte [edi + 8]
push eax
sub esp, 8
call fcn.004028b0
push str.WTware_HTTP
lea eax, [ebp - 0x50]
push eax
push str.__s__Created._Source:__s.
call fcn.00417a40
add esp, 0xc
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.00403030
cmp dword [ebp - 0x18], 8
jb 0x416905
push dword [ebp - 0x2c]
call fcn.0041ac27
add esp, 4
jmp 0x416905
call fcn.0041aa5e
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x42
push str.e:workcommon_terminalID.h
push str.ERROR
call fcn.004161a0
add esp, 0x10
mov ecx, esi
call fcn.00404d70
lea ecx, [ebp - 0x2c]
call fcn.004030a0
jmp 0x416905
call fcn.0041aa5e
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x3e
push str.e:workcommon_terminalID.h
push str.ERROR
call fcn.004161a0
add esp, 0x10
mov ecx, esi
call fcn.00404d70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret 4
Function at 0x417150
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x43d288]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
push str..mailslotWTDHCPLogging
mov edi, ecx
mov dword [ebp - 0x50], 0x100
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4172c2
push 0
call fcn.0041dc7f
add esp, 4
push eax
call fcn.0041dc6f
add esp, 4
lea eax, [ebp - 0x48]
push 0x40
push 0
push eax
call fcn.00426a30
add esp, 0xc
mov byte [ebp - 0x48], 0x37
mov edx, str..mailslotWTDHCPReceiver_
lea ecx, [ebp - 0x48]
call fcn.00416560
call fcn.0041dc4e
mov edx, eax
lea ecx, [ebp - 0x6c]
call fcn.00404910
cmp dword [eax + 0x14], 0x10
jb 0x4171de
mov eax, dword [eax]
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00416560
cmp dword [ebp - 0x58], 0x10
jb 0x4171f9
push dword [ebp - 0x6c]
call fcn.0041ac27
add esp, 4
lea edx, [ebp - 0x47]
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x4c]
call fcn.00403cd0
test al, al
je 0x41729f
lea eax, [ebp - 0x54]
push 0
push eax
lea ecx, [ebp - 0x48]
call fcn.00404f30
push eax
lea eax, [ebp - 0x48]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x50]
push edi
mov edi, dword [ebp - 0x4c]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41728a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x47]
push eax
push str.Error_reading_from_mailslot__s._Error__d
push 0x104
push str.....common_terminalID.cpp
push str.ERROR
call fcn.004161a0
add esp, 0x18
push edi
call esi
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret
push edi
call esi
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret
call fcn.0041aa5e
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0xfa
push str.....common_terminalID.cpp
push str.ERROR
call fcn.004161a0
add esp, 0x14
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret
Function at 0x417750
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b0f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x43d288]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push 0
push edi
call fcn.0041b2c5
add esp, 8
cmp eax, 0xffffffff
jne 0x417796
xor al, al
jmp 0x417830
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0xffffffff
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x14], eax
sub esp, 8
mov dword [ebp - 4], 0
mov ecx, eax
push edi
call fcn.00404440
test al, al
je 0x41780d
mov eax, dword [ebp - 0x1c]
cmp eax, 0xffffffff
je 0x417810
mov eax, dword [ebp - 0x14]
push 0xf
push esi
push dword [eax]
call fcn.0041b892
mov edx, eax
add esp, 0xc
test edx, edx
jle 0x41780d
xor ecx, ecx
test edx, edx
jle 0x417802
mov al, byte [esi + ecx]
cmp al, 0xa
je 0x417800
cmp al, 7
je 0x417800
cmp al, 0xd
je 0x417800
inc ecx
cmp ecx, edx
jl 0x4177e1
mov eax, dword [ebp - 0x1c]
mov bl, 1
mov byte [esi + edx], 0
jmp 0x417812
mov edx, ecx
mov eax, dword [ebp - 0x1c]
mov bl, 1
mov byte [esi + edx], 0
jmp 0x417812
mov eax, dword [ebp - 0x1c]
xor bl, bl
cmp eax, 0xffffffff
je 0x41782e
cmp byte [ebp - 0x18], 0
push eax
je 0x417826
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x41782e
call fcn.0041b71d
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret

Function at 0x417850
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b0f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x43d288]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push 0
push edi
call fcn.0041b2c5
add esp, 8
cmp eax, 0xffffffff
jne 0x417896
xor al, al
jmp 0x417930
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0xffffffff
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x14], eax
sub esp, 8
mov dword [ebp - 4], 0
mov ecx, eax
push edi
call fcn.00404440
test al, al
je 0x41790d
mov eax, dword [ebp - 0x1c]
cmp eax, 0xffffffff
je 0x417910
mov eax, dword [ebp - 0x14]
push 0x1f
push esi
push dword [eax]
call fcn.0041b892
mov edx, eax
add esp, 0xc
test edx, edx
jle 0x41790d
xor ecx, ecx
test edx, edx
jle 0x417902
mov al, byte [esi + ecx]
cmp al, 0xa
je 0x417900
cmp al, 7
je 0x417900
cmp al, 0xd
je 0x417900
inc ecx
cmp ecx, edx
jl 0x4178e1
mov eax, dword [ebp - 0x1c]
mov bl, 1
mov byte [esi + edx], 0
jmp 0x417912
mov edx, ecx
mov eax, dword [ebp - 0x1c]
mov bl, 1
mov byte [esi + edx], 0
jmp 0x417912
mov eax, dword [ebp - 0x1c]
xor bl, bl
cmp eax, 0xffffffff
je 0x41792e
cmp byte [ebp - 0x18], 0
push eax
je 0x417926
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x41792e
call fcn.0041b71d
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret
Function at 0x417a40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42b31b
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x43d288]
xor eax, esp
mov dword [esp + 0x430], eax
push edi
mov eax, dword [0x43d288]
xor eax, esp
push eax
lea eax, [esp + 0x440]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x18]
push eax
movzx eax, word [esp + 0x1a]
push eax
movzx eax, word [esp + 0x1c]
push eax
movzx eax, word [esp + 0x18]
push eax
movzx eax, word [esp + 0x1e]
push eax
movzx eax, word [esp + 0x26]
push eax
lea eax, [esp + 0x4c]
push str.__02d._02d._d__02d:_02d:_02d_
push eax
call fcn.004050a0
lea ecx, [esp + 0x54]
add esp, 0x20
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417ac6
lea eax, [ebp + 0xc]
sub ecx, edx
push eax
push dword [ebp + 8]
mov eax, 0x400
sub eax, ecx
push eax
lea eax, [esp + 0x40]
add eax, ecx
push eax
call fcn.0041cbca
push str.wtc_terminal.log
mov edx, 0x43f56c
lea ecx, [esp + 0x30]
call fcn.004030d0
add esp, 0x14
push 0
push 0x80
push 4
push 0
mov dword [esp + 0x458], 0
lea eax, [esp + 0x2c]
cmp dword [esp + 0x40], 8
push 1
cmovae eax, dword [esp + 0x30]
push 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x417b9e
xor ecx, ecx
cmp byte [esp + ecx + 0x34], 0
je 0x417b6c
cmp byte [esp + ecx + 0x35], 0
je 0x417b6b
cmp byte [esp + ecx + 0x36], 0
je 0x417b66
cmp byte [esp + ecx + 0x37], 0
je 0x417b61
add ecx, 4
cmp ecx, 0x400
jb 0x417b38
jmp 0x417b6c
add ecx, 3
jmp 0x417b6c
add ecx, 2
jmp 0x417b6c
inc ecx
push 0
lea eax, [esp + 0xc]
push eax
push ecx
lea eax, [esp + 0x40]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0xc]
push eax
push 1
push 0x43a22c
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x417bbe
call fcn.0041aa5e
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x61
push str.e:workwthttp.._common_fileio.h
push str.ERROR
call fcn.004161a0
add esp, 0x14
cmp dword [esp + 0x30], 8
jb 0x417bd1
push dword [esp + 0x1c]
call fcn.0041ac27
add esp, 4
mov ecx, dword [esp + 0x440]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret
Function at 0x418610
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10d0
call fcn.00420b50
mov eax, dword [0x43d288]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x93]
push edi
push 0x7f
push 0
push eax
mov edi, edx
mov byte [ebp - 0x94], 0
mov ebx, ecx
call fcn.00426a30
mov al, byte [0x43a570]
add esp, 0xc
movq xmm0, qword [str._r_nHost:]
mov byte [ebp - 0xc], al
lea eax, [ebp - 0x14]
movq qword [ebp - 0x14], xmm0
push eax
push esi
call fcn.0041dcd0
add esp, 8
test eax, eax
je 0x418683
push ecx
lea edx, [eax + 8]
lea ecx, [ebp - 0x94]
call fcn.0041a250
add esp, 4
cmp byte [ebp - 0x94], 0
jne 0x4186e9
lea eax, [ebp - 0x1098]
mov dword [ebp - 0x1098], 0x10
push eax
lea eax, [ebp - 0x10a8]
xorps xmm0, xmm0
push eax
mov eax, dword [edi + 8]
movdqu xmmword [ebp - 0x10a8], xmm0
push dword [eax]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4186e9
mov eax, dword [ebp - 0x10a4]
lea ecx, [ebp - 0x10bc]
mov dword [ebp - 0x10ac], eax
lea eax, [ebp - 0x10ac]
push eax
call fcn.00401390
mov edx, eax
lea ecx, [ebp - 0x94]
call fcn.0041a2c0
lea ecx, [ebp - 0x94]
call fcn.0041a310
mov edx, dword [0x451f60]
lea ecx, [ebp - 0x10cc]
call fcn.00401600
lea edx, [ebp - 0x10cc]
lea ecx, [ebp - 0x94]
call fcn.004164d0
push str.text_html__charsetUTF_8
push 0x43a578
push 0xc8
push str.HTTP_1.1__d__s_r_nServer:_WTware_HTTP_server_v.6.2.20_r_nContent_Type:__s_r_nConnection:_close_r_n_r_n
push edi
push ebx
call fcn.00417e70
push str._html__n_head__n_title_WTware_HTTP_server_v.6.2.20__title__n_style_TYPE_text_css___n.column__float:_left__twidth:_50_____n.row:after__content:___display:_table__clear:_both___n__style__n__head__n_body_bgcolor_ffffff___n_h1_WTware_HTTP_server_v.6.2.20__h1__n_div_class_row___n_div_class_column___n
push edi
push ebx
call fcn.00417e70
add esp, 0x24
lea ecx, [ebp - 0x1094]
call fcn.0041a360
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x1094]
push eax
push edi
push ebx
call fcn.00417e70
push str.__div__div_class_column___n_img_width_50____src_ie.png___n_img_width_50____src_chr1.png___n_img_width_50____src_chr2.png___n__div___div__n
push edi
push ebx
call fcn.00417e70
add esp, 0x1c
push str._hr__n_a_href_http:__wtware.com_doc.html__WTware__a__thin_client_OS._n__body__n__html__n
push edi
push ebx
call fcn.00417e70
mov ecx, dword [ebp - 8]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret
Function at 0x419620
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x43d288]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x14]
push eax
push 1
push 0
push 0x431674
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4197c3
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 4
push eax
push 0
push 0
push str.HTTP_port
push dword [ebp - 0x14]
call esi
test eax, eax
je 0x41968f
push str.No_port_for_HTTP_in_registry._Use_port_789.
call fcn.00415f40
add esp, 4
mov dword [ebp - 0xc], 0x315
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 4
push eax
push 0
push 0
push str.HTTP_port_2
push dword [ebp - 0x14]
call esi
test eax, eax
je 0x4196c4
push str.No_second_port_for_HTTP_in_registry.
call fcn.00415f40
add esp, 4
lea eax, [ebp - 8]
mov dword [0x451f60], 0
push eax
push 0x451f60
push 0
push 0
push str.HTTPS_port
push dword [ebp - 0x14]
mov dword [ebp - 8], 4
call esi
test eax, eax
jne 0x419705
push dword [0x451f60]
push str.HTTPS_at_port__d.
call fcn.00415f40
add esp, 8
jmp 0x41971c
push str.No_port_for_HTTPS_in_registry.
call fcn.00415f40
add esp, 4
mov dword [0x451f60], 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x41974c
call fcn.0041aa5e
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x269
push str...ip.cpp
push str.ERROR
call fcn.004161a0
add esp, 0x14
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.00419940
test al, al
jne 0x41977e
call fcn.0041aa5e
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x26b
push str...ip.cpp
push str.ERROR
call fcn.004161a0
add esp, 0x14
push 0
push 0
push 0x4193e0
call fcn.0041dabb
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4197b2
push str.ERROR:__beginthread____failed.
call fcn.00415f40
add esp, 4
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret
call fcn.0041aa5e
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x249
push str...ip.cpp
push str.ERROR
call fcn.004161a0
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
xor al, al
pop esi
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret
Function at 0x419dd0
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x43d288]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [0x450f90]
push edi
mov edi, dword [ebp + 8]
add esi, 0xfffffff8
test di, di
je 0x419f53
movzx ebx, di
lea ecx, [ebp - 0x28]
push ebx
push esi
call fcn.00401390
push eax
push str.Bind_at__s:_d.
call fcn.00415f40
add esp, 0xc
cmp dword [esi + 4], 0xffffffff
je 0x419e3c
call fcn.0041aa5e
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x18d
push str.e:workwthttp.._common_filterSockets.h
push str.ERROR
call fcn.004161a0
add esp, 0x14
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x419e69
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Create_socket_failed:__d.
call fcn.00415f40
add esp, 8
jmp 0x419f76
xorps xmm0, xmm0
mov eax, 2
movdqu xmmword [ebp - 0x18], xmm0
mov word [ebp - 0x18], ax
mov eax, dword [esi]
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x18]
push 0x10
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x419f0e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.bind____failed:__d.
call fcn.00415f40
add esp, 8
lea ecx, [ebp - 0x28]
push esi
call fcn.00401390
push eax
push str.ERROR__Error_occured_while_binding_socket_for_interface_IP_s.
call fcn.00415f40
push ebx
push str.ERROR__Port__d_already_used_by_another_application.
call fcn.00415f40
push str.ERROR__Only_one_application_can_use_TCP_or_UDP_port.
call fcn.00415f40
add esp, 0x14
push str.ERROR__To_determine_application_that_uses_port__run_Command_Prompt
call fcn.00415f40
add esp, 4
push str.ERROR__as_Administrator_and_execute_following_command:
call fcn.00415f40
add esp, 4
push str.netstat__abnp_tcp
call fcn.00415f40
add esp, 4
mov ecx, esi
call fcn.00417d10
jmp 0x419f76
push bind
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x419f3e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.listen____failed:__d.
call fcn.00415f40
add esp, 8
mov ecx, esi
call fcn.00417d10
jmp 0x419f76
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret 4
call fcn.0041aa5e
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x188
push str.e:workwthttp.._common_filterSockets.h
push str.ERROR
call fcn.004161a0
add esp, 0x14
mov ecx, dword [ebp - 8]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret 4