joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bea7
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x468
push ebx
push esi
lea esi, [esp + 0x20]
call fcn.00401eb9
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
xor esi, esi
push esi
push esi
push 0x418
push dword [edi + 8]
mov byte [esp + 0x1f], 1
call ebx
cmp eax, esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
jbe 0x42bfcc
mov esi, 0x104
lea eax, [esp + 0x60]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x38], 0x20
push 0x43f
push dword [edi + 8]
mov dword [esp + 0x44], 0x8000003e
mov dword [esp + 0x5c], esi
call ebx
test byte [esp + 0x40], 8
je 0x42bfba
xor eax, eax
cmp dword [esp + 0x44], eax
je 0x42bfba
test byte [esp + 0x41], 1
je 0x42bf52
cmp byte [esp + 0xf], al
jne 0x42bfba
push eax
push eax
push 0x800
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_AppendMenuW]
jmp 0x42bfba
push eax
push dword [esp + 0x3c]
push 0x409
push dword [edi + 8]
call ebx
mov edx, dword [esp + 0x38]
push esi
push dword [edi + 4]
test eax, eax
push dword [edi]
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x278]
setne byte [esp + 0x1f]
call fcn.0042b2f0
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x268]
push ecx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], eax
call fcn.00428901
xor eax, eax
cmp byte [esp + 0xf], al
sete al
push eax
push dword [esp + 0x20]
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov byte [esp + 0xf], 0
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x14]
jb 0x42beec
push 0
push 0x5e
push 0x419
push dword [edi + 8]
call ebx
test eax, eax
jl 0x42bfee
lea ecx, [esp + 0x50]
push ecx
push eax
push 0x41d
push dword [edi + 8]
call ebx
mov eax, dword [esp + 0x58]
push dword [esp + 0x24]
mov esi, dword [ebp + 8]
push dword [esp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
call fcn.0040dbec
push 0
push 0x5e
push 0x402
push dword [edi + 8]
call ebx
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_DestroyMenu]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42c62f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
sub ecx, 0x2457
push esi
push edi
je 0x42c6af
sub ecx, 7
je 0x42c67f
dec ecx
je 0x42c672
sub ecx, 5
je 0x42c665
sub ecx, 4
je 0x42c658
xor al, al
jmp 0x42c6bd
push 1
xor eax, eax
push eax
push eax
push str.https:__www.facebook.com_NCHSoftware
jmp 0x42c6a5
add eax, 0x28b
push eax
push str.http:__www.linkedin.com_shareArticle_url_stitleNCHSoftwareminitrue
jmp 0x42c68a
add eax, 0x81
push eax
call fcn.0040f43c
jmp 0x42c6bb
add eax, 0x28b
push eax
push str.https:__www.facebook.com_sharer_sharer.php_u_s
mov esi, 0x104
lea edi, [ebp - 0x208]
call fcn.00417ed8
pop ecx
pop ecx
push 1
xor eax, eax
push eax
push eax
mov ecx, edi
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x42c6bb
push dword [eax + 0x56]
push dword [eax + 0x52]
push eax
call fcn.004023c7
mov al, 1
pop edi
pop esi
leave
ret
Function at 0x42c6cc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
xor ebx, ebx
push 0xff
lea eax, [ebp - 0xff]
push ebx
push eax
mov byte [ebp - 0x100], bl
call fcn.00444dd0
mov esi, dword [sym.imp.USER32.dll_GetKeyboardState]
add esp, 0xc
lea eax, [ebp - 0x100]
push eax
call esi
test eax, eax
mov edi, dword [sym.imp.USER32.dll_keybd_event]
je 0x42c71f
test byte [ebp - 0xee], 0x80
jne 0x42c71f
push ebx
push 1
push ebx
push 0x12
call edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [ebp - 0x100]
push eax
call esi
test eax, eax
je 0x42c746
test byte [ebp - 0xee], 0x80
jne 0x42c746
push ebx
push 3
push ebx
push 0x12
call edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42c7af
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.0044c310
push ebx
push esi
push edi
xor ebx, ebx
push ebx
mov edi, str.HelpOpens
push edi
mov esi, str.Software
push esi
call fcn.004015fa
inc eax
push eax
push edi
push esi
call fcn.004015c4
push dword [ebp + 8]
lea eax, [ebp - 0x104c]
mov word [ebp - 0x104c], bx
call fcn.0041820d
cmp word [ebp - 0x104c], bx
je 0x42c80d
push 1
push ebx
push ebx
lea eax, [ebp - 0x104c]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42d02d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
push dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
push edi
push edi
mov ebx, eax
push 0x1004
push ebx
mov dword [ebp - 0x3c], 0xd
call esi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x3c]
push eax
push edi
push 0x104d
push ebx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ecx
call esi
mov dword [ebp - 8], eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
cmp eax, edi
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x34], edi
je 0x42d0bc
lea ecx, [ebp + 0x10]
mov dword [ebp - 4], ecx
inc dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
push edi
push 0x104c
push ebx
call esi
add dword [ebp - 4], 4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp eax, edi
jne 0x42d09c
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42f082
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, 0x3e8
push edi
mov ebp, esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, 0x4ff
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [esp + 0x18], eax
xor eax, eax
push eax
push eax
push eax
call esi
mov edi, 0x102
jmp 0x42f0df
push dword [esp + 0x18]
call fcn.0042f039
test al, al
jne 0x42f0ed
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x10]
cmp eax, ebp
jbe 0x42f0d0
mov eax, ebp
add dword [esp + 0x10], eax
push ebx
sub ebp, eax
push ebp
xor eax, eax
push eax
push eax
push eax
call esi
cmp eax, edi
jne 0x42f0b3
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
xor al, al
jmp 0x42f0e5

Function at 0x42f8e9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
push ebx
push esi
push edi
push 0x459720
push str.Default_Mail_Account
push str.softwaremicrosoftiam
push SysReAllocString
lea eax, [ebp - 0x428]
call fcn.00401071
test al, al
jne 0x42f921
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
xor eax, eax
cmp word [ebp - 0x428], ax
je 0x42f918
lea ecx, [ebp - 0x220]
push ecx
push eax
push eax
push 0x1c
push eax
mov word [ebp - 0x220], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x220]
push eax
mov ebx, 0x104
push str._s_microsoft_windows_mail_local_folders__s
mov esi, ebx
lea edi, [ebp - 0x630]
call fcn.00417ed8
add esp, 0xc
mov eax, edi
push eax
xor esi, esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x838]
mov dword [ebp - 0x13], esi
mov dword [ebp - 0xf], esi
mov byte [ebp - 0x14], 1
mov dword [ebp - 0xb], esi
mov dword [ebp - 7], esi
call fcn.0041e87f
lea eax, [ebp - 0x18]
call fcn.0041f1bf
mov edi, eax
cmp edi, esi
jne 0x42f9ac
lea ecx, [ebp - 0x18]
call fcn.0041e7c0
jmp 0x42f918
push 0x479758
call fcn.0041f1ed
cmp eax, esi
je 0x42f99f
push ebx
mov ecx, eax
call fcn.0041f1a4
mov esi, dword [ebp + 8]
mov edx, eax
call fcn.00417e96
push 0x479770
mov eax, edi
call fcn.0041f1ed
test eax, eax
jne 0x42f9ed
xor bl, bl
lea ecx, [ebp - 0x18]
call fcn.0041e7c0
mov al, bl
jmp 0x42f91a
push ebx
mov ecx, eax
call fcn.0041f1a4
mov esi, dword [ebp + 0xc]
mov edx, eax
call fcn.00417e96
mov bl, 1
jmp 0x42f9de

Function at 0x42fa81
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push eax
push 1
push 0
push dword [ebp + 8]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42fae6
push ebx
lea eax, [ebp - 4]
push eax
push esi
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 0x208
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
pop ebx
jne 0x42fae6
mov eax, dword [ebp - 4]
shr eax, 1
cmp eax, 0x104
jb 0x42fadd
mov eax, 0x103
and word [esi + eax*2], 0
mov al, 1
jmp 0x42faff
mov eax, 0x459720
mov edx, esi
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x42faef
xor al, al
leave
ret 8
Function at 0x42fd4c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and word [eax], 0
mov eax, dword [ebp + 0xc]
and word [eax], 0
sub esp, 0xd50
push str.Outlook
push str.DefaultProfile
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows_Messaging_SubsystemProfiles
push SysReAllocString
lea eax, [ebp - 0x940]
call fcn.00401071
test al, al
je 0x42ff1a
push ebx
push esi
push edi
lea eax, [ebp - 0x940]
push eax
mov ebx, 0x104
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows_Messaging_SubsystemProfiles_s
mov esi, ebx
lea edi, [ebp - 0x738]
call fcn.00417ed8
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
push 8
xor esi, esi
push esi
mov eax, edi
push eax
push SysReAllocString
mov byte [ebp - 1], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42fe7b
push esi
push esi
push esi
lea edi, [ebp - 0x120]
stosd dword es:[edi], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x328]
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
push esi
jmp 0x42fe5d
inc dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push 1
push esi
lea eax, [ebp - 0x328]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42fe4b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x120]
push eax
push esi
push esi
push str.ED475418_B0D6_11D2_8C3B_00104B2A6676
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1c], esi
jne 0x42fe4b
cmp dword [ebp - 0x18], 4
jae 0x42fe68
push esi
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x328]
push eax
push dword [ebp - 0x10]
push dword [ebp - 8]
call edi
test eax, eax
je 0x42fdf8
jmp 0x42fe6c
mov byte [ebp - 1], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 1], 0
jne 0x42fe82
xor al, al
jmp 0x42ff17
movzx eax, byte [ebp - 0x11d]
movzx ecx, byte [ebp - 0x11e]
shl eax, 8
add eax, ecx
movzx ecx, byte [ebp - 0x11f]
shl eax, 8
add eax, ecx
movzx ecx, byte [ebp - 0x120]
shl eax, 8
add eax, ecx
push eax
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x738]
push eax
push str._s_s_08d
mov esi, ebx
lea edi, [ebp - 0x530]
call fcn.00417ed8
add esp, 0x10
push str.Email
mov eax, edi
push eax
lea esi, [ebp - 0xb48]
call fcn.0042fa81
mov edx, esi
mov esi, dword [ebp + 0xc]
push ebx
call fcn.00417e96
push str.SMTP_Server
mov eax, edi
push eax
lea esi, [ebp - 0xd50]
call fcn.0042fa81
test al, al
mov byte [ebp + 0xf], al
je 0x42ff14
mov edx, esi
mov esi, dword [ebp + 8]
push ebx
call fcn.00417e96
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x430fde
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor edi, edi
lea eax, [ebp + 8]
push eax
push edi
push edi
push edi
push 2
mov dword [ebp + 8], edi
call sub.iphlpapi.dll_GetAdaptersAddresses
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push edi
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
lea eax, [ebp + 8]
push eax
push esi
push edi
push edi
push 2
call sub.iphlpapi.dll_GetAdaptersAddresses
push 6
pop eax
cmp dword [esi + 0x34], eax
jbe 0x431033
mov dword [esi + 0x34], eax
xor eax, eax
cmp dword [esi + 0x34], edi
jbe 0x431047
mov cl, byte [esi + eax + 0x2c]
mov byte [eax + ebx], cl
inc eax
cmp eax, dword [esi + 0x34]
jb 0x43103a
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x43105b
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea esi, [ebp - 1]
call fcn.0040c15b
lea eax, [ebp - 8]
push eax
push 0x45a868
push 1
xor ebx, ebx
push ebx
push 0x45a858
mov dword [ebp - 8], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x4310df
lea edx, [ebp - 0xc]
push edx
mov dword [ebp - 0xc], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x34]
test eax, eax
mov eax, dword [ebp - 8]
je 0x4310bb
cmp eax, ebx
je 0x4310ac
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [ebp - 1], bl
je 0x4310b7
call dword [sym.imp.ole32.dll_CoUninitialize]
xor al, al
jmp 0x431107
test word [ebp - 0xc], 0x440
setne byte [ebp - 2]
cmp eax, ebx
je 0x4310cf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [ebp - 1], bl
je 0x4310da
call dword [sym.imp.ole32.dll_CoUninitialize]
mov al, byte [ebp - 2]
jmp 0x431107
cmp byte [ebp - 1], bl
je 0x4310ea
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x4310b7
mov eax, dword [ebp - 0x10]
shr eax, 5
not eax
and eax, 1
pop esi
pop ebx
leave
ret
Function at 0x43110b
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
movzx ebx, word [ebp + 8]
push esi
push 0x104
lea esi, [ebp - 0x104]
call fcn.00417e70
mov eax, esi
push 0x3a
push eax
call fcn.00440390
xor esi, esi
cmp eax, esi
pop ecx
pop ecx
je 0x43114a
mov byte [eax], 0
inc eax
push eax
call fcn.0043fc0c
pop ecx
movzx ebx, ax
lea eax, [ebp - 0x104]
push eax
mov word [edi], bx
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [edi + 6], eax
je 0x43116b
mov dword [edi + 2], 1
jmp 0x4311a6
lea eax, [ebp - 0x104]
push eax
mov dword [edi + 2], esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, esi
je 0x4311a6
mov ecx, dword [eax + 0xc]
cmp dword [ecx], esi
je 0x4311a6
mov ecx, dword [edi + 2]
mov edx, dword [eax + 0xc]
shl ecx, 2
add edx, ecx
cmp dword [edx], esi
je 0x4311a6
mov edx, dword [edx]
mov edx, dword [edx]
mov dword [ecx + edi + 6], edx
inc dword [edi + 2]
cmp dword [edi + 2], 4
jb 0x431186
pop esi
pop ebx
leave
ret 4
Function at 0x4311ac
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi]
sub esp, 0x320
cmp eax, 0xffffffff
push ebx
push edi
je 0x4311c5
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax]
test al, al
je 0x4311de
mov eax, dword [ebp + 8]
mov dword [eax], 1
jmp 0x431344
push 0
xor edi, edi
inc edi
push edi
push 2
call dword [sym.imp.WS2_32.dll_socket]
lea ecx, [ebp - 4]
push ecx
push 0x8004667e
push eax
mov dword [esi], eax
mov dword [ebp - 4], edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 4]
push eax
push 0x1001
mov ebx, 0xffff
push ebx
push dword [esi]
mov dword [ebp - 4], 0x40000
call edi
push 4
lea eax, [ebp - 4]
push eax
push 0x1002
push ebx
push dword [esi]
mov dword [ebp - 4], 0x80000
call edi
mov edi, dword [ebp + 0x10]
cmp dword [edi + 4], 0xffffffff
mov dword [ebp - 4], 2
je 0x431331
push 0x10
push edi
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x4312a0
mov eax, dword [edi + 4]
mov dword [ebp + 0x14], eax
movzx ecx, byte [ebp + 0x17]
push ecx
movzx ecx, byte [ebp + 0x16]
push ecx
movzx ecx, ah
movzx eax, al
push ecx
push eax
lea eax, [ebp - 0x320]
push str._d._d._d._d
push eax
call fcn.00401000
movzx eax, word [edi + 2]
add esp, 0x18
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov eax, dword [ebp + 8]
and dword [eax], 0
jmp 0x431344
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x431331
mov eax, dword [esi]
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x118]
xor edi, edi
xor ebx, ebx
push ecx
inc edi
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x21c], eax
push ebx
inc eax
push eax
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x220], edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], 0x30d40
call dword [sym.imp.WS2_32.dll_select]
cmp eax, ebx
jg 0x431315
jl 0x431331
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax]
test al, al
jne 0x43132e
mov eax, 0xc8
cmp dword [ebp + 0x14], eax
jbe 0x431331
sub dword [ebp + 0x14], eax
jmp 0x4312b1
lea eax, [ebp - 0x118]
push eax
push dword [esi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x431331
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x431344
mov dword [ebp - 4], edi
push dword [esi]
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
or dword [esi], 0xffffffff
mov dword [eax], ecx
pop edi
pop ebx
leave
ret 0x10
Function at 0x4313c7
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
push esi
push edi
mov ecx, ebx
call dword [eax]
test al, al
jne 0x43147f
mov esi, dword [ebp + 0x10]
xor edi, edi
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
call dword [sym.imp.WS2_32.dll_send]
cmp eax, dword [ebp + 0x18]
jge 0x43148a
cmp eax, edi
jge 0x431421
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x431427
mov eax, dword [ebp + 8]
mov dword [eax], 2
pop edi
pop esi
pop ebx
leave
ret 0x18
add dword [ebp + 0x14], eax
sub dword [ebp + 0x18], eax
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x110]
push eax
push edi
lea eax, [esi + 1]
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], 0x30d40
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x110], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, edi
jg 0x431471
jne 0x43146d
mov eax, 0xc8
cmp dword [ebp + 0x1c], eax
jle 0x431411
sub dword [ebp + 0x1c], eax
jmp 0x431471
cmp eax, edi
jl 0x431411
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
test al, al
je 0x4313e9
mov eax, dword [ebp + 8]
mov dword [eax], 1
jmp 0x43141a
mov eax, dword [ebp + 8]
mov dword [eax], edi
jmp 0x43141a

Function at 0x431491
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
push esi
mov ecx, ebx
call dword [eax]
test al, al
jne 0x431501
mov esi, dword [ebp + 0xc]
cmp esi, 0xffffffff
je 0x43150e
xor eax, eax
lea ecx, [ebp - 8]
push ecx
push eax
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [esi + 1]
push eax
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x10c], 1
mov dword [ebp - 4], 0x30d40
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x431509
jl 0x431509
mov eax, 0xc8
cmp dword [ebp + 0x10], eax
jbe 0x43150e
sub dword [ebp + 0x10], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
test al, al
je 0x4314ac
mov dword [edi], 1
jmp 0x431514
and dword [edi], 0
jmp 0x431514
mov dword [edi], 2
pop esi
mov eax, edi
pop ebx
leave
ret 0xc

Function at 0x43151c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x18]
xor eax, eax
cmp dword [ebp + 0x14], eax
push ebx
push edi
mov dword [ecx], eax
jne 0x431531
mov dword [esi], eax
jmp 0x431570
push dword [ebp + 0x1c]
mov ebx, dword [ebp + 0xc]
push ecx
mov eax, esp
push dword [ebp + 8]
lea edi, [ebp + 0x1c]
mov dword [eax], ebx
call fcn.00431491
mov eax, dword [ebp + 0x1c]
test eax, eax
jne 0x43152d
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x43156a
mov ecx, dword [ebp + 0x18]
and dword [esi], 0
mov dword [ecx], eax
jmp 0x431570
mov dword [esi], 2
pop edi
mov eax, esi
pop ebx
pop ebp
ret 0x18
Function at 0x4315cc
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and dword [esi], 0
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push dword [ebp + 0x18]
lea edi, [ebp + 0x18]
push ecx
mov eax, esp
push dword [ebp + 0xc]
mov dword [eax], ebx
call fcn.00431491
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x4315f8
mov eax, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x431668
mov edi, dword [sym.imp.WS2_32.dll_recv]
push 2
push 0x30
push dword [ebp + 0x14]
push ebx
call edi
test eax, eax
mov dword [ebp + 0x10], eax
jg 0x43161a
mov eax, dword [ebp + 8]
mov dword [eax], 2
jmp 0x431668
and dword [ebp + 0x18], 0
test eax, eax
mov dword [esi], eax
jbe 0x431658
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov cl, byte [edx + ecx]
test cl, cl
je 0x431648
movsx eax, cl
push eax
push 0x46f010
call fcn.00440390
test eax, eax
pop ecx
pop ecx
jne 0x431652
mov eax, dword [ebp + 0x10]
inc dword [ebp + 0x18]
cmp dword [ebp + 0x18], eax
jb 0x431624
jmp 0x431658
mov eax, dword [ebp + 0x18]
inc eax
mov dword [esi], eax
push 0
push dword [esi]
push dword [ebp + 0x14]
push ebx
call edi
mov eax, dword [ebp + 8]
and dword [eax], 0
pop edi
pop ebx
pop ebp
ret 0x14