joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4084a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x586f0c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x58a3d0], 0
mov dword [ebp - 0x230], str.getaddrinfo
mov dword [ebp - 0x22c], 0x401154
mov dword [ebp - 0x228], str.getnameinfo
mov dword [ebp - 0x224], 0x401258
mov dword [ebp - 0x220], str.freeaddrinfo
mov dword [ebp - 0x21c], fcn.004010a0
je 0x408513
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x58002c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf32e
mov esp, ebp
pop ebp
ret 4
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x408622
push ebx
push esi
push edi
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.004bfbb3
push str.ws2_32
lea ecx, [ebp - 0x110]
push 0x10c
push ecx
call fcn.004c01ff
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea edx, [ebp - 0x110]
push edx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40858f
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x4085db
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x110]
push 0x10c
push ecx
call fcn.004bfbb3
push str.wship6
lea edx, [ebp - 0x110]
push 0x10c
push edx
call fcn.004c01ff
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call edi
mov esi, eax
test esi, esi
je 0x40861f
push str.getaddrinfo
push esi
call ebx
test eax, eax
je 0x408647
xor edi, edi
lea ecx, [ecx]
mov ecx, dword [ebp + edi*8 - 0x230]
push ecx
push esi
call ebx
mov dword [ebp + edi*8 - 0x22c], eax
test eax, eax
je 0x408647
inc edi
cmp edi, 3
jl 0x4085e0
mov edx, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x21c]
mov dword [0x58002c], edx
mov dword [0x580034], eax
mov dword [fcn.004010a0], ecx
pop edi
pop esi
pop ebx
movzx edx, word [ebp + 8]
mov ecx, dword [ebp - 4]
mov eax, dword [edx*8 + 0x58002c]
xor ecx, ebp
mov dword [0x58a3d0], 1
call fcn.004bf32e
mov esp, ebp
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40861f
Function at 0x4097e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x58a208], 0
je 0x4097fa
push str.Terminating_subprocesses_n
call fcn.00401113
add esp, 4
mov eax, dword [0x58a574]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x409823
push 0x24b
push str.ncat_exec_win.c
push str.WaitForSingleObject_subprocesses_mutex__INFINITE___WAIT_OBJECT_0
call fcn.004becc9
add esp, 0xc
cmp dword [0x58a208], 1
jle 0x409840
mov ecx, dword [0x58a570]
push ecx
push str.max_index__d_n
call fcn.00401113
add esp, 8
push esi
xor esi, esi
cmp dword [0x58a570], esi
jle 0x4098a4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push edi
mov edi, dword [esi*4 + 0x58a3e0]
test edi, edi
je 0x409899
lea edx, [ebp - 4]
push edx
push edi
call ebx
cmp dword [ebp - 4], 0x103
jne 0x40988e
cmp dword [0x58a208], 1
jle 0x409885
push esi
push str.kill_index__d_n
call fcn.00401113
add esp, 8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esi*4 + 0x58a3e0], 0
inc esi
cmp esi, dword [0x58a570]
jl 0x409853
pop edi
pop ebx
mov eax, dword [0x58a574]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop esi
test eax, eax
jne 0x4098cc
push 0x25e
push str.ncat_exec_win.c
push str.ReleaseMutex_subprocesses_mutex____0
call fcn.004becc9
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x409d80
Capabilities:
Check mutex on windows

Disassembly:
cmp dword [0x58a574], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
jne 0x409db8
push 0
push 0
push 0
call esi
mov dword [0x58a574], eax
test eax, eax
jne 0x409db8
push 0x20a
push str.ncat_exec_win.c
push str.subprocesses_mutex___NULL
call fcn.004becc9
add esp, 0xc
cmp dword [0x58a580], 0
jne 0x409de9
push 0
push 0
push 0
call esi
mov dword [0x58a580], eax
test eax, eax
jne 0x409de9
push 0x20e
push str.ncat_exec_win.c
push str.pseudo_sigchld_mutex___NULL
call fcn.004becc9
add esp, 0xc
mov eax, dword [0x58a574]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x409e12
push 0x211
push str.ncat_exec_win.c
push str.WaitForSingleObject_subprocesses_mutex__INFINITE___WAIT_OBJECT_0
call fcn.004becc9
add esp, 0xc
call fcn.00409640
mov esi, eax
cmp esi, 0xffffffff
jne 0x409e36
cmp dword [0x58a204], 0
je 0x409e81
push str.No_free_process_slots_for_termination_handler._n
call fcn.00401113
add esp, 4
jmp 0x409e81
cmp dword [0x58a208], 1
mov dword [esi*4 + 0x58a3e0], ebx
jle 0x409e55
push esi
push ebx
push str.Register_subprocess__p_at_index__d._n
call fcn.00401113
add esp, 0xc
cmp dword [0x58a578], 0
jne 0x409e81
push fcn.004097e0
call fcn.004c0d87
push 0x409910
push 2
call fcn.004c0881
add esp, 0xc
mov dword [0x58a578], 1
mov ecx, dword [0x58a574]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x409ea9
push 0x226
push str.ncat_exec_win.c
push str.ReleaseMutex_subprocesses_mutex____0
call fcn.004becc9
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x409f00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x58a298], 0
push ebx
push esi
push edi
mov esi, eax
je 0x409f5b
call fcn.004095c0
mov dword [ebp - 4], eax
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409f20
sub eax, edx
mov edx, eax
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409f30
sub eax, edi
lea ebx, [eax + edx + 0x20]
push ebx
call fcn.00415f00
mov edi, eax
mov eax, dword [ebp - 4]
push esi
push eax
push str._s__C__s
push ebx
push edi
call fcn.00416f20
add esp, 0x18
jmp 0x409f5d
mov edi, esi
cmp dword [0x58a208], 0
je 0x409f74
push edi
push str.Executing:__s_n
call fcn.00401113
add esp, 8
mov ecx, dword [ebp + 8]
push edi
call fcn.004092c0
add esp, 4
mov ebx, eax
mov dword [ebp - 4], ebx
cmp edi, esi
je 0x409f92
push edi
call fcn.004be321
add esp, 4
cmp ebx, 0xffffffff
je 0x409fcf
mov ecx, dword [ebp + 8]
mov ebx, dword [ecx]
call fcn.00409d80
cmp eax, 0xffffffff
jne 0x409fd9
cmp dword [0x58a204], 0
je 0x409fbc
push str.Couldnt_register_subprocess_with_termination_handler__not_executing._n
call fcn.00401113
add esp, 4
mov esi, dword [ebp + 8]
mov edx, dword [esi]
push 2
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.004095e0
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a690
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.004bf520
mov eax, dword [0x586f0c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x2000
lea eax, [ebp - 0x2004]
push eax
push 0
mov dword [ebp - 0x200c], 0
call fcn.004d5697
add esp, 0xc
mov dword [ebp - 0x2008], eax
test eax, eax
jg 0x40a79c
jns 0x40a703
cmp dword [0x58a204], 0
je 0x40a701
call fcn.004bdedf
mov ecx, dword [eax]
push ecx
call fcn.004bf45d
push eax
push str.Error_reading_from_stdin:__s_n
call fcn.00401113
mov eax, dword [ebp - 0x2008]
add esp, 0xc
test eax, eax
jne 0x40a721
cmp dword [0x58a208], 0
je 0x40a721
push str.EOF_on_stdin_n
call fcn.00401113
mov eax, dword [ebp - 0x2008]
add esp, 4
mov edx, dword [0x58a710]
xor ecx, ecx
test edx, edx
je 0x40a784
lea ecx, [ecx]
cmp dword [ecx*4 + 0x58a714], 0
je 0x40a757
inc ecx
cmp ecx, edx
jb 0x40a730
mov dword [0x58a814], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf32e
mov esp, ebp
pop ebp
ret
push esi
lea esi, [edx - 1]
cmp ecx, esi
jae 0x40a77c
nop
mov edx, dword [ecx*4 + 0x58a718]
mov dword [ecx*4 + 0x58a714], edx
mov edx, dword [0x58a710]
inc ecx
lea esi, [edx - 1]
cmp ecx, esi
jb 0x40a760
dec edx
mov dword [0x58a710], edx
pop esi
mov dword [0x58a814], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf32e
mov esp, ebp
pop ebp
ret
cmp dword [0x58a24c], 0
je 0x40a7cd
push 0x58a818
lea eax, [ebp - 0x200c]
push eax
lea ecx, [ebp - 0x2008]
push ecx
lea edx, [ebp - 0x2004]
push edx
call fcn.0040122b
mov eax, dword [ebp - 0x2008]
add esp, 0x10
mov ecx, dword [0x58a234]
test ecx, ecx
je 0x40a7e6
push ecx
call fcn.00401195
mov eax, dword [ebp - 0x2008]
add esp, 4
mov ecx, dword [ebp - 0x200c]
push eax
test ecx, ecx
je 0x40a824
push ecx
push 0x58a5e0
push 0x58a5f8
call fcn.00401221
mov eax, dword [ebp - 0x200c]
push eax
call fcn.004be321
mov eax, dword [ebp - 0x2008]
add esp, 0x14
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf32e
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x2004]
push ecx
push 0x58a5e0
push 0x58a5f8
call fcn.00401221
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x2008]
xor ecx, ebp
add esp, 0x10
call fcn.004bf32e
mov esp, ebp
pop ebp
ret
Function at 0x40b600
Capabilities:
Send data
Send data on socket

Disassembly:
jmp fcn.00407150
cmp dword [0x58a250], 0
jne 0x40b612
cmp dword [0x58a254], 0
je 0x40b61f
push str.Invalid_option_combination:_allow_deny_with_connect.
call fcn.0040119a
add esp, 4
cmp dword [0x58a28c], 0xffffffff
je 0x40b635
push str.Invalid_option_combination:____max_conns_with_connect.
call fcn.0040119a
add esp, 4
cmp dword [0x58a238], 0
je 0x40b64b
push str.Invalid_option_combination:____chat_with_connect.
call fcn.0040119a
add esp, 4
cmp dword [0x58a21c], 0
je 0x40b661
push str.Invalid_option_combination:____keep_open_with_connect.
call fcn.0040119a
add esp, 4
jmp 0x40105a

Function at 0x40b680
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
jmp 0x40b2f0
jmp fcn.00405b10
jmp fcn.0040eb00
cmp dword [0x58a260], 0
je 0x40b2fe
jmp 0x40126c
cmp dword [0x58a22c], 0
je 0x40b311
mov ecx, 0x11
jmp fcn.0040aba0
cmp dword [0x58a230], 0
je 0x40b328
push 0x84
call fcn.0040b020
add esp, 4
ret
push 6
call fcn.0040b020
add esp, 4
ret
cmp word [0x58a180], 0
jne 0x40b694
cmp word [0x58a080], 0
je 0x40b6a1
push str.Invalid_option_combination:___proxy_and__l.
call fcn.0040119a
add esp, 4
cmp dword [0x58a248], 0
je 0x40b6b7
push str.An_idle_timeout_only_works_in_connect_mode.
call fcn.0040119a
add esp, 4
cmp dword [0x58a214], 0
je 0x40b6d6
cmp dword [0x58a294], 0
je 0x40b6d6
push str.Invalid_option_combination:___broker_and__e.
call fcn.0040119a
add esp, 4
cmp dword [0x58a2a0], 0
je 0x40b6f5
cmp dword [0x58a228], 0
je 0x40b6f5
push str.Invalid_option_combination:___telnet_has_no_effect_with___proxy_type.
call fcn.0040119a
add esp, 4
cmp dword [0x58a28c], 0xffffffff
je 0x40b726
cmp dword [0x58a21c], 0
jne 0x40b71d
cmp dword [0x58a214], 0
jne 0x40b71d
push str.Warning:_Maximum_connections_ignored__since_it_does_not_take_effect_without__k_or___broker._n
call fcn.004010eb
add esp, 4
cmp dword [0x58a28c], 0xffffffff
jne 0x40b730
mov dword [0x58a28c], 0x64
mov ax, word [0x58a2b8]
test ax, ax
jne 0x40b787
mov eax, dword [0x58a210]
mov word [0x58a2b8], ax
cmp eax, 2
jne 0x40b757
mov dword [0x58a2bc], 0
jmp 0x40b787
mov ecx, dword [0x53cb18]
mov edx, dword [0x53cb1c]
mov dword [0x58a2c0], ecx
mov ecx, dword [0x53cb20]
mov dword [0x58a2c4], edx
mov edx, dword [0x53cb24]
mov dword [0x58a2c8], ecx
mov dword [0x58a2cc], edx
push esi
push edi
mov ecx, 0x20
mov esi, 0x58a2b8
mov edi, 0x58a100
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
cmp ax, 2
setne cl
pop edi
pop esi
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
cmp dword [0x58a214], 0
mov dword [0x58a07c], ecx
je 0x40b7c0
jmp 0x4011ef
mov eax, dword [0x58a2a0]
test eax, eax
je 0x40b803
mov ecx, str.http
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b7f0
test dl, dl
je 0x40b7ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b7f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b7d0
xor eax, eax
jmp 0x40b7f5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40b803
mov dword [0x58a260], 1
jmp 0x401145
Function at 0x40e1a0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov eax, dword [0x586f0c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [edi + 4]
mov dword [ebp - 0x298], 0x80
mov ecx, str.http
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e1e8
test dl, dl
je 0x40e1e4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e1e8
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e1c8
xor eax, eax
jmp 0x40e1ed
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40e21c
cmp dword [0x58a204], 0
je 0x40e208
push esi
push str.Unknown_scheme_in_URI:__s._n
call fcn.00401113
add esp, 8
mov eax, 0x190
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf32e
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0xc], 0xffffffff
jne 0x40e24c
cmp dword [0x58a204], 0
je 0x40e238
push str.Unknown_port_in_URI._n
call fcn.00401113
add esp, 4
mov eax, 0x190
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf32e
mov esp, ebp
pop ebp
ret
mov eax, dword [0x58a210]
push eax
movzx eax, word [edi + 0xc]
lea ecx, [ebp - 0x298]
push ecx
mov ecx, dword [edi + 8]
lea edx, [ebp - 0x84]
push edx
push eax
push ecx
call fcn.00401109
add esp, 0x14
test eax, eax
jne 0x40e2a6
cmp dword [0x58a208], eax
je 0x40e292
mov edx, dword [edi + 0xc]
mov eax, dword [edi + 8]
push edx
push eax
push str.Cant_resolve_name__s:_d._n
call fcn.00401113
add esp, 0xc
mov eax, 0x1f8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf32e
mov esp, ebp
pop ebp
ret
movzx ecx, word [0x58a200]
cmp dword [edi + 0xc], ecx
jne 0x40e2f7
lea edx, [ebp - 0x84]
push edx
call fcn.004010e6
add esp, 4
test eax, eax
je 0x40e2f7
cmp dword [0x58a204], 0
je 0x40e2e3
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push str.Proxy_loop_detected:__s:_d_n
call fcn.00401113
add esp, 0xc
mov eax, 0x193
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf32e
mov esp, ebp
pop ebp
ret
movzx edx, word [ebp - 0x84]
push 6
push 1
push edx
call fcn.00401217
add esp, 0xc
mov esi, eax
mov eax, dword [ebp - 0x298]
push eax
lea ecx, [ebp - 0x84]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40e367
cmp dword [0x58a208], 0
je 0x40e34a
lea edx, [ebp - 0x84]
push edx
call fcn.0040121c
push eax
push str.Cant_connect_to__s._n
call fcn.00401113
add esp, 0xc
push esi
call fcn.004011d1
add esp, 4
mov eax, 0x1f8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf32e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x294]
push esi
push eax
call fcn.00401230
push ebx
lea ecx, [ebp - 0x294]
mov edx, edi
call fcn.0040d390
lea ecx, [ebp - 0x294]
push ecx
mov esi, eax
call fcn.004011cc
mov ecx, dword [ebp - 4]
add esp, 0x10
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004bf32e
mov esp, ebp
pop ebp
ret
Function at 0x40ea80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push 4
call fcn.004c11f5
add esp, 4
push 0
push 0
mov esi, eax
mov eax, dword [ebp + 8]
push esi
push 0x40ea50
push 0
push 0
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x40ead5
cmp dword [0x58a204], eax
je 0x40eac9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_in_CreateThread:__d_n
call fcn.00401113
add esp, 8
push esi
call fcn.004be321
add esp, 4
pop esi
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
ret
Function at 0x410310
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x586f0c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
movzx eax, word [edi]
cmp eax, 2
jne 0x41039f
mov eax, dword [edi + 4]
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
push eax
call esi
and eax, 0xff000000
cmp eax, 0x7f000000
je 0x410389
mov ecx, dword [edi + 4]
push ecx
call esi
test eax, eax
jne 0x41040f
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf32e
mov esp, ebp
pop ebp
ret
cmp eax, 0x17
jne 0x41040f
lea edx, [edi + 8]
lea ecx, [eax - 7]
mov eax, 0x53cb18
mov esi, edx
sub esi, eax
mov ebx, dword [esi + eax]
cmp ebx, dword [eax]
jne 0x4103db
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x4103b3
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf32e
mov esp, ebp
pop ebp
ret
mov eax, 0x53cb28
mov ecx, 0x10
sub edx, eax
mov esi, dword [edx + eax]
cmp esi, dword [eax]
jne 0x41040f
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x4103e7
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf32e
mov esp, ebp
pop ebp
ret
push 0x80
lea edx, [ebp - 0x84]
push edx
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x4104b4
movzx eax, word [edi]
mov dword [ebp - 0x124], eax
mov eax, dword [0x58a3d4]
test eax, eax
jne 0x410447
push eax
call fcn.00401032
mov dword [0x58a3d4], eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x128]
push edx
push 0
lea ecx, [ebp - 0x84]
push ecx
call eax
mov esi, eax
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
test esi, esi
jne 0x4104b4
mov esi, dword [ebp - 0x108]
test esi, esi
je 0x4104b4
movzx ebx, word [edi]
cmp dword [esi + 4], ebx
jne 0x4104ad
mov eax, dword [esi + 0x10]
cmp eax, 0x80
ja 0x4104f5
mov edx, dword [esi + 0x18]
push eax
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.004bdfc0
add esp, 0xc
cmp ebx, 2
jne 0x4104c7
mov ecx, dword [edi + 4]
cmp ecx, dword [ebp - 0x100]
je 0x410505
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x410477
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf32e
mov esp, ebp
pop ebp
ret
cmp ebx, 0x17
jne 0x4104ad
lea eax, [ebp - 0xfc]
lea ecx, [ebx - 7]
mov edx, edi
mov ebx, eax
sub edx, ebx
jmp 0x4104e0
cmp ecx, 4
jb 0x410505
mov ebx, dword [edx + eax + 8]
cmp ebx, dword [eax]
jne 0x4104ad
sub ecx, 4
add eax, 4
jmp 0x4104e0
push 0x80
push eax
push str.getaddrinfo_returned_oversized_address___u____u_
call fcn.0040119a
mov ecx, dword [ebp - 0x108]
push ecx
call fcn.004011ea
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004bf32e
mov esp, ebp
pop ebp
ret
Function at 0x411450
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push edi
mov edi, eax
xor eax, eax
cmp edi, 0x11
sete al
push edi
inc eax
push eax
push ecx
call fcn.00416120
add esp, 0xc
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x41148a
push str.Socket_troubles
call fcn.004c2358
add esp, 4
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push eax
call fcn.00416180
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 4
cmp dword [esi + 0x120], 0
mov dword [esi + 0x128], edi
je 0x411513
mov eax, dword [esi]
push 4
lea edx, [ebp - 4]
push edx
push 4
push 0xffff
push eax
mov dword [ebp - 4], 1
call ebx
mov ecx, dword [esi + 0x120]
mov edx, dword [esi]
push ecx
lea edi, [esi + 0xa0]
push edi
push edx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x411513
mov eax, dword [ebp + 8]
cmp dword [eax + 0x6e8], 0
jle 0x411513
mov ecx, dword [esi + 0x13c]
mov edx, dword [esi + 0x120]
push ecx
push edx
push edi
call fcn.004160c0
add esp, 8
push eax
mov eax, dword [ebp + 8]
push str.Bind_to__s_failed__IOD__li_
push eax
call fcn.00413290
add esp, 0x10
mov eax, dword [esi + 0x150]
test eax, eax
je 0x41155c
cmp dword [ebp + 0xc], 2
jne 0x41155c
mov ecx, dword [esi + 0x14c]
mov edx, dword [esi]
push eax
push ecx
push 1
push 0
push edx
call ebx
cmp eax, 0xffffffff
jne 0x41155c
mov eax, dword [ebp + 8]
cmp dword [eax + 0x6e8], 0
jle 0x41155c
mov ecx, dword [esi + 0x13c]
push ecx
mov edx, eax
push str.Setting_of_IP_options_failed__IOD__li_
push edx
call fcn.00413290
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, 0x6f0
cmp dword [eax], 0
je 0x41159e
push 4
push eax
mov eax, dword [esi]
push 0x20
push 0xffff
push eax
call ebx
cmp eax, 0xffffffff
jne 0x41159e
mov eax, dword [ebp + 8]
cmp dword [eax + 0x6e8], 0
jle 0x41159e
mov ecx, dword [esi + 0x13c]
push ecx
push str.Setting_of_SO_BROADCAST_failed__IOD__li_
push eax
call fcn.00413290
add esp, 0xc
mov eax, dword [esi]
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x411630
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebx + 0xc4]
push edi
mov edi, dword [ebp + 0x14]
movzx eax, word [edi]
push eax
mov eax, dword [ebp + 0x10]
push ecx
call fcn.00411450
add esp, 8
cmp eax, 0xffffffff
jne 0x41167b
mov dword [ebx + 0xd0], 1
mov dword [ebx + 8], 2
call sub.WS2_32.dll_WSAGetLastError
pop edi
pop esi
mov dword [ebx + 0xbc], eax
pop ebx
pop ebp
ret
movzx eax, word [edi]
cmp ax, 2
jne 0x41168a
mov edx, dword [ebp + 0x1c]
push edx
jmp 0x4116ab
cmp ax, 0x17
je 0x4116a7
push 0x95
push str.src_nsock_connect.c
push str.sin__sin_family__AF_INET6
call fcn.004becc9
add esp, 0xc
mov eax, dword [ebp + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov ebx, dword [ebp + 0x18]
mov word [edi + 2], ax
cmp ebx, 0x80
jbe 0x4116d7
push 0x9d
push str.src_nsock_connect.c
push str.sslen___sizeof_iod__peer_
call fcn.004becc9
add esp, 0xc
push ebx
lea ecx, [esi + 0x20]
push edi
push ecx
call fcn.004bdfc0
mov edx, dword [esi]
add esp, 0xc
push ebx
push edi
push edx
mov dword [esi + 0x124], ebx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x41172e
call sub.WS2_32.dll_WSAGetLastError
cmp dword [ebp + 0x10], 0x11
je 0x411714
cmp eax, 0x2734
je 0x41172e
cmp eax, 0x2733
je 0x41172e
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0xd0], 1
mov dword [ecx + 8], 2
mov dword [ecx + 0xbc], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x411b80
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x586f0c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x94], ecx
mov ecx, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x90], 0x80
test ebx, ebx
jne 0x411beb
push 0x193
push str.src_nsock_connect.c
push str.socklen___0
call fcn.004becc9
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x88]
add esp, 0xc
mov edx, dword [esi + 0x124]
test edx, edx
je 0x411d03
test edi, edi
je 0x411c1d
cmp ebx, edx
jae 0x411c03
mov edx, ebx
push edx
lea edx, [esi + 0x20]
push edx
push edi
call fcn.004bdfc0
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x88]
add esp, 0xc
test eax, eax
je 0x411c29
mov edx, dword [esi + 0x128]
mov dword [eax], edx
mov eax, dword [ebp - 0x94]
test eax, eax
je 0x411c39
movsx edx, word [esi + 0x20]
mov dword [eax], edx
test ecx, ecx
je 0x411cce
mov esi, dword [esi]
test esi, esi
js 0x411ce4
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x84]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x411c8a
mov edx, dword [ebp - 0x88]
push ebx
push 0
push edx
call fcn.004bfd10
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf32e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x90]
test eax, eax
jg 0x411cb1
push 0x1a6
push str.src_nsock_connect.c
push str.slen___0
call fcn.004becc9
mov eax, dword [ebp - 0x90]
add esp, 0xc
cmp eax, ebx
jae 0x411cb7
mov ebx, eax
mov ecx, dword [ebp - 0x88]
push ebx
lea eax, [ebp - 0x84]
push eax
push ecx
call fcn.004bdfc0
add esp, 0xc
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf32e
mov esp, ebp
pop ebp
ret
push ebx
push 0
push ecx
call fcn.004bfd10
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bf32e
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x411d17
test edi, edi
jne 0x411d17
test eax, eax
jne 0x411d17
cmp dword [ebp - 0x94], eax
je 0x411cce
xor esi, esi
test edi, edi
je 0x411d34
push ebx
push esi
push edi
call fcn.004bfd10
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x88]
add esp, 0xc
test ecx, ecx
je 0x411d4a
push ebx
push 0
push ecx
call fcn.004bfd10
mov eax, dword [ebp - 0x8c]
add esp, 0xc
test eax, eax
je 0x411d54
mov dword [eax], 0xffffffff
mov eax, dword [ebp - 0x94]
test eax, eax
je 0x411d64
mov dword [eax], 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bf32e
mov esp, ebp
pop ebp
ret