joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fbc3
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x41fd0b
xor ecx, ecx
cmp word [eax], cx
je 0x41fd0b
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x41fc1c
cmp eax, 3
jne 0x41fc56
cmp word [esp + 0xa], 0x3a
jne 0x41fc56
cmp eax, 2
jne 0x41fc3a
lea eax, [esp + 8]
push 0x5152dc
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x41fd0b
push 0xfffffffffffffffe
pop edi
jmp 0x41fd0b
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x41fc6b
cmp ax, bx
jne 0x41fc75
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x41fc5e
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x41fcb4
test byte [esp + 0x21c], 0x10
je 0x41fc9b
push 0xfffffffffffffffe
pop edi
jmp 0x41fcab
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x41fd09
cmp word [esp + 0x10], bp
jne 0x41fcc2
cmp word [esp + 0x12], bp
je 0x41fce1
cmp word [esp + 0x10], bx
jne 0x41fcd0
cmp word [esp + 0x12], bx
je 0x41fce1
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x41fd09
cmp word [esp + 0x12], ax
jne 0x41fd09
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x41fcf6
test al, 0x10
je 0x41fd09
jmp 0x41fd06
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x41fd09
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x41fd1a
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x41fd43
test byte [esp + 8], 2
je 0x41fd37
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x41fd45
xor eax, eax
ret 8
Function at 0x429a90
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebx, 0x1505
add ecx, esi
mov eax, ecx
push edi
xor edi, edi
sub eax, esi
cmp ecx, esi
sbb ebp, ebp
not ebp
and ebp, eax
jbe 0x429ad4
mov al, byte [esi]
push eax
call fcn.00435be0
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, ebp
jb 0x429ab3
pop edi
pop esi
pop ebp
movzx eax, bl
pop ebx
ret
Function at 0x42c990
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x42c9aa
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x515ed4
push esi
call dword [sym.imp.MSVCRT.dll_strpbrk]
add esp, 8
test eax, eax
je 0x42c9f3
test ebp, ebp
je 0x42c9e4
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x42ca19
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42ca19
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x42cacf
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42ca36
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [0x52d8bc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x42cac5
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x42cac5
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42ca68
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42ca80
sub ecx, edx
add ecx, ebx
sub ecx, esi
lea ecx, [ecx]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x42ca90
test ebp, ebp
je 0x42cabc
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x52d8c0]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x52d8c0]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x42cc60
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x22c
test byte [esp + 0x230], 2
je 0x42ccab
lea eax, [esp + 0x9c]
push eax
push 0x202
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
test eax, eax
jne 0x42cc9f
mov eax, dword [esp + 0x9c]
cmp al, 2
jne 0x42cc99
shr eax, 8
cmp al, 2
je 0x42ccab
call dword [sym.imp.WSOCK32.DLL_WSACleanup]
mov eax, 2
add esp, 0x22c
ret
call fcn.00446620
test eax, eax
jne 0x42cd80
push str.iphlpapi.dll
call fcn.0042c990
add esp, 4
mov dword [0x530988], eax
test eax, eax
je 0x42cce3
push str.if_nametoindex
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42cce3
mov dword [0x530984], eax
push esi
push 0x9c
lea eax, [esp + 8]
push 0
push eax
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
mov dword [esp + 4], 0x9c
mov dword [esp + 8], 6
mov dword [esp + 0xc], 0
push 3
push 2
push 0
push 0
mov dword [esp + 0x24], 2
call esi
push 3
push 1
push edx
push eax
call esi
push 3
push 0x20
push edx
push eax
call esi
push 3
push 0x10
push edx
push eax
call esi
push 1
push 8
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
pop esi
test eax, eax
je 0x42cd77
push 0x531454
mov byte [0x53145c], 1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
add esp, 0x22c
ret
mov byte [0x53145c], 0
xor eax, eax
add esp, 0x22c
ret

Function at 0x42cf00
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x2c8], 2
je fcn.0042ceb0
mov al, 1
ret

Function at 0x42d040
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x5e0], 0
je 0x42d084
push 1
push edi
call fcn.0042e240
push dword [edi + 0x574]
mov eax, dword [edi + 0x5e0]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.0042e240
add esp, 0x24
mov eax, esi
pop edi
pop esi
ret
mov eax, dword [esp + 0x10]
cmp eax, 2
ja 0x42d0bd
push dword [edi + 0x570]
mov esi, dword [sym.imp.MSVCRT.dll_fwrite]
lea eax, [eax + eax*2]
push 1
add eax, 0x515f58
push 2
push eax
call esi
push dword [edi + 0x570]
push 1
push dword [esp + 0x30]
push dword [esp + 0x30]
call esi
add esp, 0x20
pop edi
xor eax, eax
pop esi
ret

Function at 0x42d2c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.WSOCK32.DLL_recv]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x42d2f1
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov eax, dword [esp + 0x10]
mov dword [eax], ecx
xor eax, eax
ret
Function at 0x42d420
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x80
push ebx
push ebp
mov ebp, dword [esp + 0x8c]
push esi
push eax
push ebp
mov esi, dword [ebp + eax*4 + 0x1a4]
call fcn.0042d8d0
add esp, 8
push 0
push dword [esp + 0xa0]
push dword [esp + 0xa0]
push esi
call dword [sym.imp.WSOCK32.DLL_send]
mov ebx, dword [esp + 0xa0]
mov esi, eax
mov dword [ebx], 0
cmp esi, 0xffffffff
jne 0x42d4c7
push edi
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x42d494
pop edi
pop esi
pop ebp
mov dword [ebx], 0x51
xor eax, eax
pop ebx
add esp, 0x80
ret
push pe_nt_image_headers32
lea eax, [esp + 0x14]
push eax
push edi
call fcn.004471e0
push eax
push str.Send_failure:__s
push dword [ebp]
call fcn.0042d0d0
mov eax, dword [ebp]
add esp, 0x18
mov dword [eax + 0xc54], edi
mov eax, esi
mov dword [ebx], 0x37
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret

Function at 0x42d8d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 8]
mov eax, ecx
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
shl eax, 4
mov ebp, dword [ebx + ecx*4 + 0x1a4]
lea esi, [ebx + 0x1c8]
add esi, eax
mov eax, dword [ebx + 0x2c0]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x42d986
cmp dword [ebx + ecx*4 + 0x1b8], 0x42d350
jne 0x42d986
cmp dword [esi], 0
je 0x42d91c
test edi, edi
je 0x42d986
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.004353e0
add esp, 0x10
cmp eax, 0xffffffff
je 0x42d986
test al, 1
je 0x42d986
cmp dword [esi], 0
jne 0x42d96f
mov eax, dword [ebx]
mov eax, dword [eax + 0x8d0]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x52d8bc]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
jne 0x42d96f
pop edi
mov dword [esi + 4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebp
call dword [sym.imp.WSOCK32.DLL_recv]
test eax, eax
jle 0x42d986
add dword [esi + 8], eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x434240
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
push ebx
mov ebx, dword [esp + 0x190]
cmp dword [ebx + 0x90], 3
jne 0x434418
cmp byte [ebx + 0x289], 0
push ebp
push esi
push edi
jne 0x43440c
cmp byte [ebx + 0x2a1], 0
jne 0x43440c
mov esi, dword [esp + 0x1a0]
lea eax, [esp + 0x10]
mov ebp, dword [ebx]
push eax
lea eax, [esp + 0x11c]
mov dword [esp + 0x14], pe_nt_image_headers32
push eax
push esi
call dword [sym.imp.WSOCK32.DLL_getpeername]
test eax, eax
je 0x4342d4
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x18]
push pe_nt_image_headers32
push eax
push esi
call fcn.004471e0
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebp
call fcn.0042d0d0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
push pe_nt_image_headers32
lea eax, [esp + 0x9c]
mov dword [esp + 0x18], pe_nt_image_headers32
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x9c]
push eax
push esi
call dword [sym.imp.WSOCK32.DLL_getsockname]
test eax, eax
je 0x43433e
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x18]
push pe_nt_image_headers32
push eax
push esi
call fcn.004471e0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebp
call fcn.0042d0d0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
lea eax, [ebx + 0x138]
push eax
lea esi, [ebx + 0x10a]
push esi
push dword [esp + 0x18]
lea eax, [esp + 0x124]
push eax
call fcn.00433660
add esp, 0x10
test al, al
jne 0x43439f
mov esi, dword [sym.imp.MSVCRT.dll__errno]
call esi
mov edi, eax
call esi
mov esi, eax
lea eax, [esp + 0x18]
push pe_nt_image_headers32
push eax
push dword [edi]
call fcn.004471e0
push eax
push dword [esi]
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebp
call fcn.0042d0d0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
lea edi, [ebx + 0x5c]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
lea eax, [ebx + 0x16c]
push eax
lea eax, [ebx + 0x13c]
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0xa4]
movsw word es:[edi], word [esi]
push eax
call fcn.00433660
add esp, 0x10
test al, al
jne 0x43440c
mov esi, dword [sym.imp.MSVCRT.dll__errno]
call esi
mov edi, eax
call esi
mov esi, eax
lea eax, [esp + 0x18]
push pe_nt_image_headers32
push eax
push dword [edi]
call fcn.004471e0
push eax
push dword [esi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebp
call fcn.0042d0d0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
push ebx
call fcn.00433f20
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
Function at 0x434d70
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
xor eax, eax
push edi
mov edi, dword [esp + 0x20]
push 4
cmp byte [esi + 0xa9f], al
setne al
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WSOCK32.DLL_setsockopt]
test eax, eax
jns 0x434dba
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.0042d190
add esp, 0xc
pop edi
pop esi
add esp, 0x10
ret
push dword [esi + 0xa3c]
mov dword [esp + 0x10], 1
call fcn.004335e0
push dword [esi + 0xa40]
imul eax, eax, 0x3e8
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], eax
call fcn.004335e0
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0xc
lea eax, [esp + 0x24]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.DLL_WSAIoctl]
test eax, eax
je 0x434e31
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.0042d190
add esp, 0x10
pop edi
pop esi
add esp, 0x10
ret

Function at 0x434e40
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x84
mov eax, dword [esp + 0x88]
push esi
push 4
mov dword [esp + 8], 1
mov esi, dword [eax]
lea eax, [esp + 8]
push eax
push 1
push 6
push dword [esp + 0xa0]
call dword [sym.imp.WSOCK32.DLL_setsockopt]
test eax, eax
jns 0x434ea1
push pe_nt_image_headers32
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
push eax
call fcn.004471e0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.0042d190
add esp, 0x18
pop esi
add esp, 0x84
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.0042d190
add esp, 8
pop esi
add esp, 0x84
ret
Function at 0x43fbd0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1000
call fcn.00402030
push dword [esp + 0x1004]
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x43fc1d
push 0x1000
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x43fc1d
lea eax, [esp]
push eax
call dword [0x52d8c8]
add esp, 4
add esp, 0x1000
ret
xor eax, eax
add esp, 0x1000
ret
Function at 0x4466c0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebp
xor ebp, ebp
mov dword [esp + 4], ebp
mov dword [eax], ebp
lea eax, [esp + 8]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.DLL_getaddrinfo]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x446853
push ebx
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x44683d
push esi
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x44670f
lea ebx, [eax + 0xe]
jmp 0x44671b
cmp eax, 0x17
jne 0x4467ca
lea ebx, [eax + 5]
cmp dword [edi + 0x18], 0
je 0x4467ca
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4467ca
cmp eax, ebx
jb 0x4467ca
push 0x20
call dword [0x52d8bc]
mov esi, eax
add esp, 4
test esi, esi
je 0x446832
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x52d8bc]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x446821
push ebx
push dword [edi + 0x18]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x4467b5
push eax
call dword [0x52d8c8]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x446807
test ebp, ebp
jne 0x4467bb
mov ebp, esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4467c6
mov dword [eax + 0x1c], esi
mov dword [esp + 0x10], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x446702
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
pop esi
test eax, eax
je 0x4467e9
push eax
call dword [sym.imp.WS2_32.DLL_freeaddrinfo]
test ebx, ebx
je 0x446839
push ebp
call fcn.00446680
mov eax, dword [esp + 0x2c]
add esp, 4
xor ebp, ebp
mov dword [eax], ebp
mov eax, ebx
pop edi
pop ebx
pop ebp
add esp, 0xc
ret
push dword [esi + 0x18]
mov ebx, 8
call dword [0x52d8c0]
push esi
call dword [0x52d8c0]
add esp, 8
jmp 0x4467d9
push esi
mov ebx, 8
call dword [0x52d8c0]
add esp, 4
jmp 0x4467d9
mov ebx, 8
jmp 0x4467d9
test ebp, ebp
jne 0x446849
mov ebx, 0x2af9
push ebx
call dword [sym.imp.WSOCK32.DLL_WSASetLastError]
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], ebp
mov eax, ebx
pop ebx
pop ebp
add esp, 0xc
ret
Function at 0x44ae90
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration
Start tcp server

Disassembly:
sub esp, 0x30
push esi
mov esi, dword [sym.imp.WSOCK32.DLL_socket]
push edi
push 6
push 1
push 2
mov dword [esp + 0x18], 0x10
mov dword [esp + 0x14], 1
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x44aec2
pop edi
or eax, eax
pop esi
add esp, 0x30
ret
xor eax, eax
mov dword [esp + 0x10], eax
push ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, 2
push 0x7f000001
mov word [esp + 0x18], ax
call dword [sym.imp.WSOCK32.DLL_htonl]
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x18], eax
xor eax, eax
push 4
mov word [esp + 0x1a], ax
lea eax, [esp + 0x10]
push eax
push 4
push 0xffff
push edi
mov dword [ebx + 4], 0xffffffff
mov dword [ebx], 0xffffffff
call dword [sym.imp.WSOCK32.DLL_setsockopt]
cmp eax, 0xffffffff
je 0x44b057
push 0x10
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WSOCK32.DLL_bind]
cmp eax, 0xffffffff
je 0x44b057
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WSOCK32.DLL_getsockname]
cmp eax, 0xffffffff
je 0x44b057
push 1
push edi
call dword [sym.imp.WSOCK32.DLL_listen]
cmp eax, 0xffffffff
je 0x44b057
push 0
push 1
push 2
call esi
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x44b057
push 0x10
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.WSOCK32.DLL_connect]
cmp eax, 0xffffffff
je 0x44b057
push 0
push 0
push edi
call dword [sym.imp.WSOCK32.DLL_accept]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x44b057
push ebx
push 0x51ba20
lea eax, [esp + 0x2c]
push 0xc
push eax
call fcn.0043e810
lea esi, [esp + 0x34]
add esp, 0x10
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x44afc4
push 0
sub esi, ecx
lea eax, [esp + 0x28]
push esi
push eax
push dword [ebx]
call dword [sym.imp.WSOCK32.DLL_send]
cmp eax, esi
jne 0x44b057
push 0
push 0xc
lea eax, [esp + 0x38]
push eax
push dword [ebx + 4]
call dword [sym.imp.WSOCK32.DLL_recv]
cmp eax, esi
jne 0x44b057
lea ecx, [esp + 0x24]
lea edx, [esp + 0x30]
sub esi, 4
jb 0x44b015
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x44b01a
add ecx, 4
add edx, 4
sub esi, 4
jae 0x44b004
cmp esi, 0xfffffffc
je 0x44b047
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x44b057
cmp esi, 0xfffffffd
je 0x44b047
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x44b057
cmp esi, 0xfffffffe
je 0x44b047
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x44b057
cmp esi, 0xffffffff
je 0x44b047
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x44b057
push edi
call dword [sym.imp.WSOCK32.DLL_closesocket]
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x30
ret
mov esi, dword [sym.imp.WSOCK32.DLL_closesocket]
push edi
call esi
push dword [ebx]
call esi
push dword [ebx + 4]
call esi
pop ebx
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x30
ret
Function at 0x46ef90
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
movzx edx, byte [esi + 9]
mov ebx, dword [esi + 0x38]
mov eax, dword [esi + 0x34]
movzx ecx, byte [edx + ebx + 5]
mov ebp, dword [eax + 0x28]
movzx eax, byte [edx + ebx + 6]
movzx edi, byte [edx + ebx + 7]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x10], ebp
movzx eax, byte [esi + 0xa]
dec ecx
and ecx, 0xffff
add eax, edx
inc ecx
add ebp, 0xfffffffc
mov dword [esp + 0x14], ecx
movzx ecx, word [esi + 0x18]
movzx esi, byte [edx + ebx + 1]
shl esi, 8
lea eax, [eax + ecx*2]
add eax, 8
mov dword [esp + 0x18], eax
movzx eax, byte [edx + ebx + 2]
or esi, eax
mov eax, dword [esp + 0x14]
add edi, eax
test esi, esi
jle 0x46f089
cmp esi, eax
jge 0x46f013
push 0x52b284
push 0x10374
jmp 0x46f0b9
cmp esi, ebp
jg 0x46f04e
jmp 0x46f020
movzx eax, byte [esi + ebx]
movzx ecx, byte [ebx + esi + 1]
movzx edx, byte [ebx + esi + 2]
shl eax, 8
or eax, ecx
shl edx, 8
movzx ecx, byte [ebx + esi + 3]
or edx, ecx
lea ecx, [esi + 3]
add ecx, edx
add edi, edx
cmp eax, ecx
jbe 0x46f05a
mov esi, eax
cmp eax, ebp
jle 0x46f020
push 0x52b284
push 0x10379
jmp 0x46f0b9
test eax, eax
je 0x46f06a
push 0x52b284
push 0x10383
jmp 0x46f0b9
mov ecx, dword [esp + 0x10]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x46f08d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
mov dword [esp + 4], 0x10387
jmp fcn.004abc10
mov ecx, dword [esp + 0x10]
cmp edi, ecx
jg 0x46f0af
mov eax, dword [esp + 0x18]
cmp edi, eax
jl 0x46f0af
mov ecx, dword [esp + 0x20]
sub edi, eax
movzx eax, di
pop edi
pop esi
pop ebp
mov dword [ecx + 0x14], eax
xor eax, eax
pop ebx
add esp, 0xc
ret
push 0x52b284
push 0x10393
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.00466a50
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x470420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
mov al, byte [esi]
test al, al
je 0x47045e
cmp al, 3
jb 0x470440
push esi
call fcn.00470670
add esp, 4
test eax, eax
jne 0x470579
mov al, byte [esi]
cmp al, 1
jne 0x47044d
mov eax, 0x65
pop esi
ret
cmp al, 2
jne 0x47045e
cmp dword [esi + 4], 0
mov byte [esi], 0
jge 0x47045e
xor eax, eax
pop esi
ret
mov edx, dword [esi + 0x74]
push ebx
push edi
cmp byte [edx + 8], 0
jne 0x4704a8
movzx ecx, word [esi + 0x46]
mov eax, dword [edx + 0x40]
mov ax, word [eax + ecx*2]
mov ch, al
mov cl, ah
movzx eax, word [edx + 0x1a]
movzx ecx, cx
and ecx, eax
mov eax, dword [edx + 0x38]
mov eax, dword [ecx + eax]
bswap eax
push eax
push esi
call fcn.00494150
add esp, 8
test eax, eax
jne 0x470577
push esi
call fcn.004942c0
add esp, 4
pop edi
pop ebx
pop esi
ret
cmp word [esi + 0x46], 0
jne 0x470542
mov dl, byte [esi + 0x44]
test dl, dl
je 0x470569
and byte [esi + 1], 0xf9
xor eax, eax
mov ecx, dword [esi + 0x74]
mov word [esi + 0x32], ax
movsx eax, dl
dec dl
mov ax, word [esi + eax*2 + 0x46]
mov word [esi + 0x46], ax
movsx eax, dl
mov byte [esi + 0x44], dl
mov eax, dword [esi + eax*4 + 0x78]
mov dword [esi + 0x74], eax
mov edx, dword [ecx + 0x48]
test byte [edx + 0x1c], 0x20
je 0x47052e
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov edi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov ebx, dword [edi]
cdq
push edx
push eax
push 0
push ecx
call fcn.004021f0
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x470537
push edx
call fcn.004c6f10
add esp, 4
cmp word [esi + 0x46], 0
je 0x4704b3
mov eax, 0xffff
add word [esi + 0x46], ax
mov eax, dword [esi + 0x74]
cmp byte [eax + 2], 0
je 0x470575
cmp byte [eax + 8], 0
jne 0x470575
push 0
push esi
call fcn.004a9160
add esp, 8
pop edi
pop ebx
pop esi
ret
pop edi
pop ebx
mov byte [esi], 1
mov eax, 0x65
pop esi
ret
xor eax, eax
pop edi
pop ebx
pop esi
ret