joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40af22
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x48dcc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str..txt
push 0x4923d8
push 0x47acc8
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0044f950
add esp, 0x14
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40af9d
push 0
lea eax, [ebp - 0x10c]
push eax
push 0x20
push str.6e0b49916f3348e097fcd72b4090fb15
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044e6cf
leave
ret

Function at 0x40b60a
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [edi + 0x6bc]
test eax, eax
je 0x40b626
mov ecx, 0xb0
push ecx
push eax
push ecx
push edi
call fcn.0044e72f
add esp, 0x10
ret
push esi
push 0
lea esi, [edi + 0x6c4]
push 0
push dword [esi]
call fcn.00450190
push dword [esi]
push 1
push 0xb0
push edi
call fcn.004518c7
add esp, 0x1c
pop esi
ret

Function at 0x40b64c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, eax
mov ecx, dword [edi + 0x6bc]
test ecx, ecx
je 0x40b682
mov eax, dword [edi + 0x30]
mov ebx, dword [edi + 0x34]
add eax, ecx
push ebx
mov dword [ebp - 4], eax
call fcn.0043fb4f
push ebx
push dword [ebp - 4]
mov esi, eax
push ebx
push esi
call fcn.0044e72f
add esp, 0x14
jmp 0x40b6af
push 0
push dword [edi + 0x30]
push dword [edi + 0x6c4]
call fcn.00450190
mov ebx, dword [edi + 0x34]
push ebx
call fcn.0043fb4f
push dword [edi + 0x6c4]
mov esi, eax
push 1
push ebx
push esi
call fcn.004518c7
add esp, 0x20
xor eax, eax
test ebx, ebx
jbe 0x40b6ce
mov dl, byte [esi + eax]
mov ecx, eax
shr ecx, 1
add ecx, esi
mov byte [ecx], dl
mov dl, byte [esi + eax + 1]
add eax, 4
mov byte [ecx + 1], dl
cmp eax, ebx
jb 0x40b6b5
push ebx
push esi
lea eax, [edi + 0x2bc]
call fcn.0040b71f
mov edi, dword [esi]
push edi
mov dword [ebp - 4], eax
call fcn.0043fb4f
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
push edi
lea ecx, [esi + 8]
push ecx
push edi
push eax
call fcn.0044e72f
mov eax, dword [ebp + 0xc]
add esp, 0x14
mov dword [eax], edi
mov ecx, ebx
mov eax, esi
test ebx, ebx
je 0x40b70e
mov byte [eax], 0
inc eax
dec ecx
jne 0x40b707
push esi
call fcn.0043fb5a
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40bf87
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x598]
sub esp, 0x618
mov eax, dword [0x48dcc0]
xor eax, ebp
mov dword [ebp + 0x594], eax
push esi
push edi
push 0x3ff
xor esi, esi
lea eax, [ebp - 0x73]
mov edi, ecx
push esi
push eax
mov dword [ebp - 0x80], edi
mov byte [ebp - 0x74], 0
call fcn.00451d90
push edi
lea eax, [ebp - 0x74]
push 0x400
push eax
call fcn.004504d4
add esp, 0x18
push 5
push esi
push esi
lea eax, [ebp - 0x74]
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x7c], eax
cmp eax, 0x20
ja 0x40c0c4
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x78]
push eax
push 1
push esi
push str..htm
push accept
call ebx
cmp eax, esi
jne 0x40c0c3
lea eax, [ebp - 0x78]
push eax
lea edi, [ebp + 0x38c]
call fcn.0040be12
cmp eax, esi
jne 0x40c0c3
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str._shellopencommand
mov eax, edi
push eax
call esi
lea eax, [ebp - 0x78]
push eax
push 1
push 0
mov eax, edi
push eax
push accept
call ebx
test eax, eax
jne 0x40c0c3
lea eax, [ebp - 0x78]
push eax
call fcn.0040be12
test eax, eax
jne 0x40c0c3
mov eax, edi
push str.__1_
push eax
call fcn.00451a42
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x40c0a0
lea eax, [ebp + 0x38c]
push 0x47c7b0
push eax
call fcn.00451a42
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x40c0a0
lea eax, [ebp + 0x38c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebp + eax + 0x38b]
jmp 0x40c0a3
mov byte [edi], 0
push 0x47c7b4
push edi
call esi
push dword [ebp - 0x80]
push edi
call esi
push 5
lea eax, [ebp + 0x38c]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x7c], eax
pop ebx
mov ecx, dword [ebp + 0x594]
mov eax, dword [ebp - 0x7c]
pop edi
xor ecx, ebp
pop esi
call fcn.0044e6cf
add ebp, 0x598
leave
ret

Function at 0x40c9c5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x790]
sub esp, 0x810
mov eax, dword [0x48dcc0]
xor eax, ebp
mov dword [ebp + 0x78c], eax
push esi
push edi
push 0x7ff
lea eax, [ebp - 0x73]
push 0
push eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x7c], 0xffff
mov byte [ebp - 0x74], 0
call fcn.00451d90
mov esi, dword [esi]
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push edi
push esi
mov dword [ebp - 0x80], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ca30
cmp dword [ebp - 0x78], 4
mov edi, dword [ebp - 0x74]
je 0x40ca33
mov edi, dword [ebp - 0x7c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x78c]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0044e6cf
add ebp, 0x790
leave
ret
Function at 0x40ca53
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x48dcc0]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0x14
mov eax, 0x468b6a
call fcn.00455f58
mov eax, dword [ebp + 0x80c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x810]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ebx
call fcn.00402711
lea eax, [ebp - 0x18]
push eax
push 1
push ebx
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], 1
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40cb14
push 0x7ff
lea eax, [ebp + 1]
push ebx
push eax
mov byte [ebp], bl
call fcn.00451d90
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x10], 0x800
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40cb0b
cmp dword [ebp - 0x14], 1
jne 0x40cb0b
lea eax, [ebp]
push eax
mov ecx, esi
mov byte [ebp + 0x7ff], bl
call fcn.0040232d
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0044e6cf
add ebp, 0x804
leave
ret 8
Function at 0x40cde9
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x40
mov eax, 0x469d3f
call fcn.00455f58
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x20], 0x10
mov ecx, dword [ebp + 0xc]
mov eax, reloc.WS2_32.dll_bind
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
jae 0x40ce11
lea ecx, [ebp + 0xc]
lea edx, [ebp - 0x14]
push edx
push 0x20019
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edi, edi
inc edi
test eax, eax
jne 0x40cec6
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x40cec6
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
push 0x580
push 0x28e44000
lea esi, [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
call fcn.0040cdc1
push 0x1792
push 0xf8648000
lea esi, [ebp - 0x2c]
call fcn.0040cdc1
push 0x2f25
push 0xf0c90000
lea esi, [ebp - 0x24]
call fcn.0040cdc1
mov esi, dword [sym.imp.KERNEL32.dll_CompareFileTime]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1c]
push eax
call esi
cmp eax, edi
jne 0x40cecb
mov dword [ebp - 0x10], edi
mov esi, dword [ebp - 0x10]
jmp 0x40cf1b
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call esi
cmp eax, edi
jne 0x40cee2
mov dword [ebp - 0x10], 2
jmp 0x40cec6
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
call esi
cmp eax, edi
jne 0x40cef9
mov dword [ebp - 0x10], 3
jmp 0x40cf0f
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
call esi
cmp eax, 0xffffffff
jne 0x40cec6
mov dword [ebp - 0x10], 4
call fcn.0040cc05
test al, al
jne 0x40cec6
push 4
pop esi
push ebx
push edi
lea ecx, [ebp + 8]
call fcn.004026c6
mov eax, esi
call fcn.00456030
ret 0x1c
Function at 0x40eed2
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
call fcn.0040aa55
cmp byte [esi + 0x94], 0
jne 0x40ef00
cmp byte [esi + 0x95], 0
jne 0x40ef00
call fcn.0040f1be
test al, al
jne 0x40ef00
push edi
mov edi, esi
call fcn.0040ef08
pop edi
pop esi
ret
mov ecx, esi
pop esi
jmp fcn.0040a35b

Function at 0x40f2bf
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [0x4924dc]
push esi
push edi
mov esi, 0x4924e0
mov edi, 0x4924e1
xor edx, edx
sub esi, ecx
lea eax, [ecx + 2]
sub edi, ecx
mov cl, byte [eax - 2]
mov byte [edx*4 + 0x4924e0], cl
mov cl, byte [eax - 1]
mov byte [edx*4 + 0x4924e1], cl
mov cl, byte [eax]
mov byte [esi + eax], cl
mov cl, byte [eax + 1]
mov byte [edi + eax], cl
inc edx
add eax, 4
cmp edx, 4
jb 0x40f2df
cmp edx, 0x2c
jae 0x40f39f
lea eax, [edx*4 + 0x4924d0]
push ebx
lea esi, [eax + 0xc]
lea edi, [ebp - 4]
movsd dword es:[edi], dword [esi]
test dl, 3
jne 0x40f36c
movzx esi, byte [ebp - 2]
mov bl, byte [esi + 0x47a3a0]
movzx ecx, byte [ebp - 4]
movzx esi, byte [ebp - 1]
mov dword [ebp - 8], ecx
movzx ecx, byte [ebp - 3]
mov cl, byte [ecx + 0x47a3a0]
mov byte [ebp - 3], bl
mov bl, byte [esi + 0x47a3a0]
movzx esi, byte [ebp - 8]
mov byte [ebp - 2], bl
mov bl, byte [esi + 0x47a3a0]
mov esi, edx
shr esi, 2
xor cl, byte [esi + 0x47a5a0]
mov byte [ebp - 1], bl
mov byte [ebp - 4], cl
jmp 0x40f36f
mov cl, byte [ebp - 4]
mov bl, byte [eax]
xor bl, cl
mov cl, byte [eax + 1]
xor cl, byte [ebp - 3]
mov byte [eax + 0x10], bl
mov byte [eax + 0x11], cl
mov cl, byte [eax + 2]
xor cl, byte [ebp - 2]
add eax, 4
mov byte [eax + 0xe], cl
mov cl, byte [eax - 1]
xor cl, byte [ebp - 1]
inc edx
mov byte [eax + 0xf], cl
cmp edx, 0x2c
jb 0x40f318
pop ebx
pop edi
pop esi
leave
ret
Function at 0x40f703
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ecx, dword [0x492590]
push esi
push edi
push 4
pop edi
push 4
mov eax, ecx
pop esi
movzx edx, byte [eax]
mov dl, byte [edx + 0x47a4a0]
mov byte [eax], dl
add eax, 4
dec esi
jne 0x40f713
inc ecx
dec edi
jne 0x40f70e
pop edi
pop esi
ret

Function at 0x40f779
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x492590]
push esi
movzx eax, al
push edi
shl eax, 4
push 4
add eax, 0x4924e0
pop edi
push 4
pop esi
mov dl, byte [eax]
xor byte [ecx], dl
inc eax
inc ecx
dec esi
jne 0x40f3bc
dec edi
jne 0x40f3b9
pop edi
pop esi
ret
push ebx
mov al, 0xa
call 0x40f3a3
mov bl, 9
call fcn.0040f72b
call fcn.0040f703
mov al, bl
call 0x40f3a3
call fcn.0040f3cb
dec bl
jne 0x40f783
call fcn.0040f72b
call fcn.0040f703
xor al, al
pop ebx
jmp 0x40f3a3

Function at 0x40fdee
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x48dcc0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x40fe35
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x40fe2f
shr eax, 8
cmp al, 2
jne 0x40fe2f
call fcn.00410159
jmp 0x40fe38
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 2
pop eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044e6cf
leave
ret
Function at 0x40ff78
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x14], ebx
xor esi, esi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp esi, ebx
jne 0x410073
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0xc], ebx
call fcn.0041a826
mov esi, eax
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x10]
push eax
movsd dword es:[edi], dword [esi]
push 0x3e8
push ebx
movsd dword es:[edi], dword [esi]
push ebx
push dword [ebp + 8]
movsd dword es:[edi], dword [esi]
call fcn.00419782
mov esi, eax
add esp, 0x18
cmp esi, ebx
jne 0x410066
cmp dword [ebp - 0x10], ebx
jne 0x41002b
lea eax, [ebp - 0x44]
push eax
call fcn.0041a826
sub esp, 0xc
mov edi, esp
lea esi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov esi, eax
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041a84b
add esp, 0x20
cmp edx, ebx
jg 0x41002b
jl 0x410003
cmp eax, 0xa
ja 0x41002b
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jle 0x41002e
cmp dword [ebp - 4], 0xa
jge 0x41001d
mov ecx, dword [ebp - 4]
xor eax, eax
dec ecx
inc eax
shl eax, cl
jmp 0x410022
mov eax, 0x3e8
push eax
call fcn.00410385
pop ecx
jmp 0x41002e
mov dword [ebp - 4], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.0041a75a
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
jne 0x410066
cmp dword [ebp - 0xc], ebx
jne 0x410066
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.00418b4c
pop ecx
pop ecx
cmp eax, ebx
je 0x410066
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], ebx
je 0x40ff8e
cmp esi, ebx
je 0x410085
xor eax, eax
cmp esi, 3
setne al
dec eax
and eax, 0xfffffff0
add eax, 0x2b
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411d54
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x411d70
cmp dword [esi + 0x6c], 0
je 0x411d70
push 2
push 3
push esi
call fcn.00422b7c
add esp, 0xc
push dword [esp + 0xc]
call fcn.0042333a
pop ecx
test esi, esi
je 0x411d8e
cmp dword [esi + 0x6c], 0
je 0x411d8e
push 3
push esi
call fcn.00422bb5
pop ecx
pop ecx
pop esi
ret

Function at 0x41aa2e
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x41aa5d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x41ab69
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x1e0]
push edi
xor edi, edi
test ecx, ecx
je 0x41ab8f
push dword [esi + 0x16c]
push dword [esp + 0x10]
push dword [esp + 0x10]
push eax
push esi
call ecx
add esp, 0x14
mov edi, eax
jmp 0x41abc8
test eax, eax
jl 0x41abc8
cmp eax, 2
jg 0x41abc8
push dword [esi + 0x168]
imul eax, eax, 3
push 1
add eax, 0x46c788
push 2
push eax
call fcn.0044f495
push dword [esi + 0x168]
push 1
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.0044f495
add esp, 0x20
mov eax, edi
pop edi
ret

Function at 0x41b06d
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebx + 0x470]
mov ecx, dword [ebx + eax*4 + 0x1a8]
push esi
lea esi, [eax + 0x1d]
shl esi, 4
add esi, ebx
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [edx + 0x40], 3
mov dword [ebp - 4], ecx
je 0x41b110
cmp dword [ebx + eax*4 + 0x1c0], 0x41ae37
jne 0x41b110
xor eax, eax
cmp dword [esi], eax
je 0x41b0ae
cmp edi, eax
je 0x41b110
push eax
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
call fcn.004103a8
add esp, 0x14
cmp eax, 0xffffffff
je 0x41b110
test al, 1
je 0x41b110
cmp dword [esi], 0
jne 0x41b0f1
mov eax, dword [ebx]
mov eax, dword [eax + 0x388]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [section..data]
and dword [esi + 8], 0
and dword [esi + 0xc], 0
mov edi, dword [esi + 4]
pop ecx
mov dword [esi], eax
test eax, eax
je 0x41b10c
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x41b110
add dword [esi + 8], eax
jmp 0x41b110
and dword [esi + 4], 0
pop edi
pop esi
leave
ret
Function at 0x41b114
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebx + eax*4 + 0x1a8]
call fcn.0041b06d
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov esi, dword [ebp + 0x18]
and dword [esi], 0
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x41b18b
push edi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x41b165
and dword [ebp + 8], 0
mov dword [esi], 0x51
jmp 0x41b18a
push edi
push ebx
call fcn.0041fc3e
push eax
push str.Send_failure:__s
push dword [ebx]
call fcn.0041acea
mov eax, dword [ebx]
mov dword [eax + 0x47e4], edi
add esp, 0x14
mov dword [esi], 0x37
pop edi
mov eax, dword [ebp + 8]
pop esi
pop ebx
pop ebp
ret

Function at 0x41cbd9
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
xor eax, eax
xor edi, edi
cmp dword [esi + 0x574], edi
push 4
setne al
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 8
push 0xffff
push ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x41cc19
push ebx
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.0041ac80
add esp, 0xc
jmp 0x41cc84
push dword [esi + 0x578]
mov dword [ebp - 0x14], 1
call fcn.0041e042
imul eax, eax, 0x3e8
push dword [esi + 0x57c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
call fcn.0041e042
imul eax, eax, 0x3e8
pop ecx
pop ecx
push edi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push 0xc
lea eax, [ebp - 0x14]
push eax
push 0x98000004
push ebx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x41cc84
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push ebx
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.0041ac80
add esp, 0x10
pop edi
leave
ret
Function at 0x41d1ba
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x48dcc0]
xor eax, ebp
mov dword [ebp + 0x8c], eax
push esi
mov esi, dword [ebp + 0x98]
cmp dword [esi + 0x94], 2
mov eax, dword [esi]
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x7c], eax
je 0x41d329
push ebx
xor ebx, ebx
push edi
cmp dword [esi + 0x3c8], ebx
jne 0x41d320
cmp dword [esi + 0x438], ebx
jne 0x41d320
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp + 0x9c]
mov edi, 0x80
mov dword [ebp - 0x80], edi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x41d248
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
push esi
call fcn.0041fc3e
push eax
push edi
push str.getpeername___failed_with_errno__d:__s
jmp 0x41d310
push edi
lea eax, [ebp + 0xc]
push ebx
push eax
mov dword [ebp - 0x80], edi
call fcn.00451d90
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x9c]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x41d28c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
push esi
call fcn.0041fc3e
push eax
push edi
push str.getsockname___failed_with_errno__d:__s
jmp 0x41d310
lea ebx, [esi + 0x10a]
lea edi, [esi + 0x138]
lea esi, [ebp - 0x74]
call fcn.0041d176
test eax, eax
jne 0x41d2c6
call fcn.004521da
mov esi, eax
call fcn.004521da
push dword [esi]
mov edi, eax
push dword [ebp - 0x78]
call fcn.0041fc3e
push eax
push dword [edi]
push str.ssrem_inet_ntop___failed_with_errno__d:__s
jmp 0x41d310
mov esi, dword [ebp - 0x78]
push 0x2e
lea eax, [esi + 0x60]
push ebx
push eax
call fcn.00452230
lea edi, [esi + 0x16c]
lea ebx, [esi + 0x13c]
add esp, 0xc
lea esi, [ebp + 0xc]
call fcn.0041d176
test eax, eax
jne 0x41d31d
call fcn.004521da
mov esi, eax
call fcn.004521da
push dword [esi]
mov edi, eax
push dword [ebp - 0x78]
call fcn.0041fc3e
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push dword [ebp - 0x7c]
call fcn.0041acea
add esp, 0x18
jmp 0x41d327
mov esi, dword [ebp - 0x78]
push esi
call fcn.0041d105
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp + 0x8c]
xor ecx, ebp
pop esi
call fcn.0044e6cf
add ebp, 0x90
leave
ret

Function at 0x41d33f
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi]
push 4
xor eax, eax
lea ecx, [ebp + 8]
push ecx
inc eax
push eax
push 6
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x41d383
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.0041fc3e
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.0041ac80
add esp, 0x14
jmp 0x41d390
push str.TCP_NODELAY_set_n
push esi
call fcn.0041ac80
pop ecx
pop ecx
pop edi
pop esi
pop ebp
ret
Function at 0x41d394
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor eax, eax
push 2
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 4
pop esi
cmp dword [0x48f6a8], eax
jne 0x41d3dd
push 3
push esi
push eax
push 6
call fcn.0041de2e
add esp, 0x10
test eax, eax
je 0x41d3d3
mov dword [0x48f6a8], esi
jmp 0x41d421
mov dword [0x48f6a8], 1
cmp dword [0x48f6a8], esi
je 0x41d421
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
mov edi, 0x1001
push edi
mov esi, 0xffff
push esi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x41d40f
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x41d420
push 4
lea eax, [ebp - 8]
push eax
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
pop edi
pop esi
leave
ret

Function at 0x41d4a2
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1f0], 0
je 0x41d4c0
push eax
call fcn.0041179d
pop ecx
test eax, eax
jne 0x41d4dc
xor eax, eax
pop ebp
ret
mov eax, dword [eax + 0x1a8]
cmp eax, 0xffffffff
je 0x41d4bc
push 2
push 1
lea ecx, [ebp + 0xb]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
jmp 0x41d4b8
xor eax, eax
inc eax
pop ebp
ret
Function at 0x41df3c
Capabilities:
Get common file path

Disassembly:
push ecx
and dword [esp], 0
push esi
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x41e034
push ebx
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadLibraryExA
push esi
call edi
mov ebp, dword [esp + 0x18]
push 0x47ad50
push ebp
mov ebx, eax
call fcn.004543b0
pop ecx
pop ecx
test eax, eax
je 0x41df90
test ebx, ebx
je 0x41df87
push 8
jmp 0x41dfa5
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x41dfaa
test ebx, ebx
je 0x41dfb0
push str.AddDllDirectory
push esi
call edi
test eax, eax
je 0x41dfb0
push 0x800
push 0
push ebp
call ebx
mov dword [esp + 0x10], eax
jmp 0x41e02d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, eax
test edi, edi
je 0x41e02d
push ebp
call fcn.00451f40
lea eax, [eax + edi + 1]
push eax
call dword [section..data]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x41e025
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x41e025
push 0x47cc4c
push esi
call fcn.00451f40
pop ecx
add eax, esi
push eax
call fcn.004520a0
pop ecx
pop ecx
push ebp
push esi
call fcn.00451f40
pop ecx
add eax, esi
push eax
call fcn.004520a0
pop ecx
pop ecx
test ebx, ebx
je 0x41e01a
push 8
push 0
push esi
call ebx
jmp 0x41e021
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x10], eax
push esi
call dword [0x48d004]
pop ecx
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret