joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4121be
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x60
mov eax, 0x44fe01
call fcn.0043c7da
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x54], ebx
lea edi, [ebp - 0x50]
stosd dword es:[edi], eax
lea eax, [ebp - 0x54]
push eax
push 1
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x60]
mov esi, edx
push eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x60], ecx
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x41223c
call dword [sym.imp.kernel32.dll_GetLastError]
push ebx
push eax
lea esi, [ebp - 0x30]
call fcn.0043475f
push eax
lea eax, [ebp - 0x4c]
push str.decryption_failed__sysError
push eax
mov dword [ebp - 4], ebx
call fcn.0043475f
add esp, 0x14
lea esi, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.0043475f
push 0x466a80
mov eax, esi
push eax
call fcn.0043475f
mov edi, dword [ebp - 0x58]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov esi, dword [ebp - 0x54]
mov eax, edi
call fcn.0040d4f9
push dword [ebp - 0x54]
mov eax, dword [edi]
push dword [ebp - 0x50]
push eax
call fcn.0043475f
add esp, 0xc
push dword [ebp - 0x50]
call dword [sym.imp.kernel32.dll_LocalFree]
mov eax, edi
call fcn.0043c85d
ret

Function at 0x4122e5
Capabilities:
Encode data using base64 via winapi

Disassembly:
push 0x6c
mov eax, 0x44fdcc
call fcn.0043c7da
mov eax, dword [ebp + 8]
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], ecx
cmp dword [ebp + 0xc], ecx
jne 0x412314
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ecx
mov byte [edi], cl
jmp 0x41240d
mov esi, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
lea edx, [ebp - 0x68]
push edx
push ecx
mov ebx, 0x40000001
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x68], ecx
push eax
call esi
test eax, eax
jne 0x412372
call dword [sym.imp.kernel32.dll_GetLastError]
push 0
push eax
lea esi, [ebp - 0x64]
call fcn.0043475f
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x48]
push str.binary2string__phase1__failed__sysError
push eax
call fcn.0043475f
add esp, 0x14
mov byte [ebp - 4], 1
lea esi, [ebp - 0x78]
call fcn.0043475f
push 0x466a80
mov eax, esi
push eax
call fcn.0043475f
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x68]
lea ecx, [ebp - 0x2c]
call fcn.00412690
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x41239f
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x68]
push ecx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x6c]
call esi
test eax, eax
jne 0x4123e1
call dword [sym.imp.kernel32.dll_GetLastError]
push 0
push eax
lea esi, [ebp - 0x48]
call fcn.0043475f
push eax
lea eax, [ebp - 0x64]
push str.binary2string__phase2__failed__sysError
push eax
mov byte [ebp - 4], 3
call fcn.0043475f
add esp, 0x14
mov byte [ebp - 4], 4
jmp 0x41235d
mov eax, dword [ebp - 0x68]
lea ecx, [ebp - 0x2c]
call fcn.00412690
and dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
lea esi, [ebp - 0x2c]
mov byte [edi], 0
call fcn.00405ca7
push 0
push 1
mov ecx, esi
call fcn.00405e00
mov eax, edi
call fcn.0043c85d
ret
Function at 0x412415
Capabilities:
Decode data using base64 via winapi

Disassembly:
push 0x98
mov eax, 0x44fd7c
call fcn.0043c7da
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x84], ebx
mov ecx, dword [edi + 0x10]
mov dword [ebp - 0x88], eax
cmp ecx, ebx
jne 0x41244b
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
jmp 0x412585
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x84], ebx
jb 0x41245b
mov eax, dword [edi]
jmp 0x41245d
mov eax, edi
push ebx
push ebx
lea edx, [ebp - 0x84]
push edx
push ebx
push 1
push ecx
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x4124b6
call dword [sym.imp.kernel32.dll_GetLastError]
push ebx
push eax
lea esi, [ebp - 0x48]
call fcn.0043475f
push eax
lea eax, [ebp - 0x80]
push str.string2binary__phase1__failed__sysError
push eax
mov dword [ebp - 4], ebx
call fcn.0043475f
add esp, 0x14
lea esi, [ebp - 0x94]
mov byte [ebp - 4], 1
call fcn.0043475f
push 0x466a80
mov eax, esi
push eax
call fcn.0043475f
mov esi, dword [ebp - 0x84]
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
call fcn.0040d4f9
mov dword [ebp - 4], 2
cmp dword [edi + 0x14], 0x10
mov eax, dword [edi + 0x10]
jb 0x4124eb
mov edi, dword [edi]
push ebx
push ebx
lea ecx, [ebp - 0x84]
push ecx
push dword [ebp - 0x98]
push 1
push eax
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x412549
call dword [sym.imp.kernel32.dll_GetLastError]
push ebx
push eax
lea esi, [ebp - 0x64]
call fcn.0043475f
push eax
lea eax, [ebp - 0x2c]
push str.string2binary__phase2__failed__sysError
push eax
mov byte [ebp - 4], 3
call fcn.0043475f
add esp, 0x14
lea esi, [ebp - 0xa4]
mov byte [ebp - 4], 4
call fcn.0043475f
push 0x466a80
mov eax, esi
jmp 0x4124b0
mov esi, dword [ebp - 0x84]
lea eax, [ebp - 0x98]
call fcn.0040d4f9
mov eax, dword [ebp - 0x88]
lea edi, [ebp - 0x98]
call fcn.004126ab
cmp dword [ebp - 0x98], ebx
je 0x41257f
push dword [ebp - 0x98]
call fcn.0043475f
pop ecx
mov eax, dword [ebp - 0x88]
call fcn.0043c85d
ret
Function at 0x413970
Capabilities:
Create process on windows

Disassembly:
push 0x2c
mov eax, 0x451ab4
call fcn.0043c7da
cmp dword [0x475304], 1
mov ebx, ecx
jg 0x4139cb
lea eax, [ebp - 0x30]
push str.Executor.exec__:
lea edi, [ebx + 0x38]
push eax
call fcn.00410c44
pop ecx
pop ecx
and dword [ebp - 4], 0
push str.Executor::startExecution
push 0x93
push str.c:_workspace_8_2_build_windows_i586_cygwin_jdk8u181_11358_install_src_windows_common_Executor.cpp
push 1
mov edx, eax
mov ecx, 0x475304
call fcn.0041299a
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.00405e00
push 0x44
pop esi
push esi
lea edi, [ebx + 0x7c]
push 0
push edi
call fcn.004360a0
add esp, 0xc
push 0x10
lea eax, [ebx + 0x6c]
push 0
push eax
mov dword [edi], esi
call fcn.004360a0
add esp, 0xc
cmp dword [ebx + 0xc0], 1
jne 0x413a0f
or dword [ebx + 0xa8], 1
xor eax, eax
mov word [ebx + 0xac], ax
mov dword [ebx + 0x60], 0x8000000
cmp byte [ebx + 0xcd], 0
je 0x413a1f
mov esi, ebx
call fcn.00413eb0
lea eax, [ebx + 0x38]
mov edx, dword [eax + 0x14]
cmp edx, 0x10
jb 0x413a2e
mov esi, dword [eax]
jmp 0x413a30
mov esi, eax
mov ecx, dword [eax + 0x10]
add ecx, esi
cmp edx, 0x10
jb 0x413a3c
mov eax, dword [eax]
push dword [ebp - 0x35]
xor edx, edx
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
call fcn.0040fc91
mov dword [ebp - 4], 1
lea eax, [ebp - 0x31]
lea esi, [ebp - 0x24]
mov byte [ebp - 0x31], 0
call fcn.0040a801
cmp dword [ebx + 0x14], 0x10
jb 0x413a75
mov ecx, dword [ebx]
jmp 0x413a77
mov ecx, ebx
lea eax, [ebx + 0x6c]
push eax
push edi
push dword [ebx + 0x68]
push dword [ebx + 0x64]
push dword [ebx + 0x60]
push dword [ebx + 0x5c]
push dword [ebx + 0x58]
push dword [ebx + 0x54]
push dword [ebp - 0x24]
push ecx
call dword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
setne bl
cmp dword [ebp - 0x24], 0
je 0x413aac
push dword [ebp - 0x24]
call fcn.0043475f
pop ecx
mov al, bl
call fcn.0043c85d
ret
Function at 0x4196c8
Capabilities:
Get common file path

Disassembly:
push 0x38
mov eax, 0x44f396
call fcn.0043c7da
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x30], eax
mov esi, 0x104
lea eax, [ebp - 0x40]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
call fcn.004140ac
mov dword [ebp - 4], edi
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x3c]
mov ebx, dword [sym.imp.kernel32.dll_GetTempPathA]
push esi
sub edi, esi
push edi
call ebx
cmp eax, edi
jbe 0x419724
mov esi, eax
lea eax, [ebp - 0x40]
call fcn.004140ac
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
push esi
sub eax, esi
push eax
call ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.00405b78
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0041fc9f
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00405e00
test esi, esi
je 0x419753
push esi
call fcn.0043475f
pop ecx
mov eax, dword [ebp - 0x30]
call fcn.0043c85d
ret

Function at 0x419ef4
Capabilities:
Identify system language via api

Disassembly:
push 4
mov eax, 0x44ebf7
call fcn.0043c771
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
call dword [sym.imp.kernel32.dll_GetThreadLocale]
push eax
mov eax, esi
call fcn.0043475f
pop ecx
call dword [sym.imp.kernel32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
mov eax, esi
call fcn.0043475f
pop ecx
call dword [sym.imp.kernel32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
push eax
mov eax, esi
call fcn.0043475f
mov eax, esi
mov dword [esp], 0x409
call fcn.0043475f
pop ecx
mov eax, esi
call fcn.0043c849
ret
Function at 0x41fd59
Capabilities:
Get file version info

Disassembly:
push 0xf0
mov eax, 0x4529a6
call fcn.0043c7da
mov eax, dword [ebp + 8]
push eax
mov esi, ebx
mov dword [ebp - 0x54], ebx
call fcn.00406f18
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], esi
mov byte [ebp - 4], 1
cmp dword [ebx + 0x14], 0x10
mov dword [ebp - 0x40], esi
jb 0x41fd95
mov eax, dword [ebx]
jmp 0x41fd97
mov eax, ebx
lea ecx, [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.version.dll_GetFileVersionInfoSizeA]
cmp eax, esi
jne 0x41fe4f
push str.System_error
mov dword [ebp - 0x4c], str.c:_workspace_8_2_build_windows_i586_cygwin_jdk8u181_11358_install_src_windows_common_FileUtils.cpp
mov dword [ebp - 0x48], str.VersionResource::VersionResource
mov dword [ebp - 0x44], 0x461
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x50], esp
push ebx
call fcn.00406f18
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 2
call fcn.00409bf6
lea eax, [ebp - 0xfc]
push str.GetFileVersionInfoSize_
push eax
mov byte [ebp - 4], 3
call fcn.0040bad0
pop ecx
pop ecx
lea esi, [ebp - 0xfc]
mov byte [ebp - 4], 4
call fcn.0040b809
mov esi, eax
push 0x46140c
push esi
call fcn.0040bad0
pop ecx
pop ecx
mov ecx, dword [sym.imp.version.dll_GetFileVersionInfoSizeA]
push esi
lea edi, [ebp - 0x60]
call fcn.0042503b
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3c]
push ecx
lea esi, [ebp - 0x4c]
mov ecx, eax
call fcn.00419a34
lea eax, [ebp - 0x3c]
mov dword [esp], 0x466c7c
push eax
call fcn.0043475f
mov esi, eax
lea eax, [ebx + 0x1c]
call fcn.0040d4f9
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x20]
sub eax, ecx
cmp dword [ebx + 0x14], 0x10
jb 0x41fe6b
mov edx, dword [ebx]
jmp 0x41fe6d
mov edx, ebx
mov edi, dword [sym.imp.version.dll_GetFileVersionInfoA]
push ecx
push eax
push dword [ebp - 0x40]
push edx
call edi
test eax, eax
jne 0x41ff0b
push str.System_error
mov dword [ebp - 0x4c], str.c:_workspace_8_2_build_windows_i586_cygwin_jdk8u181_11358_install_src_windows_common_FileUtils.cpp
mov dword [ebp - 0x48], str.VersionResource::VersionResource
mov dword [ebp - 0x44], 0x46a
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x50], esp
push ebx
call fcn.00406f18
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 6
call fcn.00409bf6
lea eax, [ebp - 0xfc]
push str.GetFileVersionInfo_
push eax
mov byte [ebp - 4], 7
call fcn.0040bad0
pop ecx
pop ecx
lea esi, [ebp - 0xfc]
mov byte [ebp - 4], 8
call fcn.0040b809
mov esi, eax
push 0x46140c
push esi
call fcn.0040bad0
pop ecx
pop ecx
mov ecx, edi
push esi
lea edi, [ebp - 0x60]
call fcn.0042503b
mov byte [ebp - 4], 9
jmp 0x41fe31
mov eax, ebx
call fcn.0043c85d
ret 4
Function at 0x425c35
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x120
mov eax, 0x452cd2
call fcn.0043c7da
mov eax, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x78], eax
mov eax, esi
call fcn.00425c17
mov edi, eax
test edi, edi
jne 0x425ced
push str.cannot_find_resource
lea ecx, [ebp - 0x30]
call fcn.00405b78
and dword [ebp - 4], edi
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x30]
mov ecx, esi
call fcn.00425b62
mov edi, eax
lea esi, [ebp - 0x12c]
mov byte [ebp - 4], 1
call fcn.004151a7
push str.System_error
mov byte [ebp - 4], 2
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [sym.imp.kernel32.dll_FindResourceA]
push eax
mov eax, esi
push eax
lea edi, [ebp - 0x90]
call fcn.0042503b
mov byte [ebp - 4], 3
mov dword [ebp - 0x84], str.c:_workspace_8_2_build_windows_i586_cygwin_jdk8u181_11358_install_src_windows_common_Resources.cpp
mov dword [ebp - 0x80], str.Resource::getPtr
mov dword [ebp - 0x7c], 0x41
lea ecx, [ebp - 0x58]
push ecx
lea esi, [ebp - 0x84]
mov ecx, eax
call fcn.00419a34
lea eax, [ebp - 0x58]
mov dword [esp], 0x466c7c
push eax
call fcn.0043475f
mov ebx, dword [sym.imp.kernel32.dll_LoadResource]
push edi
push dword [esi + 0x40]
call ebx
test eax, eax
jne 0x425d71
push str.cannot_load_resource
lea ecx, [ebp - 0x30]
call fcn.00405b78
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x30]
mov ecx, esi
mov dword [ebp - 4], 4
call fcn.00425b62
mov edi, eax
lea esi, [ebp - 0x12c]
mov byte [ebp - 4], 5
call fcn.004151a7
push str.System_error
mov byte [ebp - 4], 6
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
mov eax, esi
push eax
mov ecx, ebx
lea edi, [ebp - 0x90]
call fcn.0042503b
mov byte [ebp - 4], 7
mov dword [ebp - 0x84], str.c:_workspace_8_2_build_windows_i586_cygwin_jdk8u181_11358_install_src_windows_common_Resources.cpp
mov dword [ebp - 0x80], str.Resource::getPtr
mov dword [ebp - 0x7c], 0x46
jmp 0x425ccc
push eax
call dword [sym.imp.kernel32.dll_LockResource]
cmp dword [esi + 0x3c], 6
mov ebx, eax
jne 0x425da1
mov esi, dword [esi + 0x1c]
and esi, 0xf
jbe 0x425d92
dec esi
movzx ecx, word [eax]
lea eax, [eax + ecx*2 + 2]
jne 0x425d88
movzx ecx, word [eax]
mov edx, dword [ebp - 0x78]
add ecx, ecx
mov dword [edx], ecx
lea ebx, [eax + 2]
jmp 0x425db0
push edi
push dword [esi + 0x40]
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ecx, dword [ebp - 0x78]
mov dword [ecx], eax
mov eax, ebx
call fcn.0043c85d
ret 4
Function at 0x42e890
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x47162c]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 0x14
mov eax, 0x450872
call fcn.0043c771
xor esi, esi
lea eax, [ebp + 0x38]
push eax
push esi
push esi
push 0x2c
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.shell32.dll_SHGetFolderPathW]
cmp eax, esi
je 0x42e8e6
push 0xc8
lea esi, [ebp - 0x20]
call fcn.0043475f
push 0x466f8c
mov eax, esi
push eax
call fcn.0043475f
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp]
call fcn.00412f5a
push 0x462d7c
push eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], esi
call fcn.0043475f
push ebx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0042d5db
add esp, 0xc
push 1
xor edi, edi
lea esi, [ebp + 0x1c]
call fcn.0041302c
push 1
lea esi, [ebp]
call fcn.0041302c
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.00434c4e
add ebp, 0x244
leave
ret

Function at 0x43475f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x43476e
pop dword [ebp - 0x3c]
mov eax, 0x5987115e
sub eax, 0x5943c9f0
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x47097
push 0
mov eax, 0x3b494429
sub eax, 0x3b03d375
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x13955a81
add ecx, 0xec6af2fa
mov ebx, eax
mov edi, 0x65197dcf
add edi, 0x9b2ff031
add edi, dword [ebp - 0x3c]
mov edx, 0x3fe41174
sub edx, 0xb1a65900
mov esi, dword [edi]
sub dword [ebp - 0x2c], 0xfe5ff4dc
xor esi, edx
add dword [ebp - 0x10], esi
mov dword [ebx], esi
xor dword [ebp - 0x18], 0xc188daa1
add ebx, 4
add edi, 0xa12b4f94
add edi, 0x5ed4b070
loop 0x4347cd
add eax, 0x128bf
mov ebx, eax
add eax, 0x4be4e650
sub eax, 0x4be4e64b
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x434c4e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47162c]
jne 0x434c58
repz ret
jmp fcn.0043ef82
Function at 0xa1a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a1a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa1a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa1a06a
add dl, dl
jne 0xa1a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa1a0dc
xor eax, eax
add dl, dl
jne 0xa1a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa1a17d
add dl, dl
jne 0xa1a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa1a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa1a075
mov eax, 1
add dl, dl
jne 0xa1a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa1a0e1
sub eax, ebx
mov ebx, 1
jne 0xa1a128
mov ecx, 1
add dl, dl
jne 0xa1a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa1a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa1a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa1a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa1a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa1a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa1a136
cmp eax, 0x7d00
jae 0xa1a16d
cmp eax, 0x500
jb 0xa1a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa1a075
cmp eax, 0x7f
ja 0xa1a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa1a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa1a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa1a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x418690
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x5c]
mov byte [esi + 0x18], 0
mov ecx, edi
call fcn.0041af40
test eax, eax
je 0x4186df
mov ebx, dword [edi + 8]
mov eax, dword [edi + 4]
sub ebx, eax
je 0x4186df
mov eax, dword [edi + 4]
mov edx, dword [edi]
add eax, edx
lea ecx, [esi + 0x24]
push eax
push ebx
call fcn.0041aff0
push ebx
mov ecx, edi
call fcn.0041b190
mov ecx, esi
call fcn.004189a0
mov ebx, dword [edi + 8]
mov eax, dword [edi + 4]
sub ebx, eax
jne 0x4186b5
push 0xa000
lea ecx, [esi + 0x40]
call fcn.0041af50
lea ecx, [esi + 0x24]
push 0xa000
call fcn.0041af50
push 0xa000
mov ecx, edi
call fcn.0041af50
push 0
push 1
push 2
call sub.WS2_32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x4187fe
lea ecx, [ebp - 4]
mov dword [ebp - 4], 1
push ecx
push 0x8004667e
push eax
call sub.WS2_32.dll_ioctlsocket
cmp eax, 0xffffffff
je 0x4187f1
lea ebx, [esi + 8]
xor edx, edx
mov eax, ebx
mov ecx, dword [ebp + 8]
push ecx
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
call sub.WS2_32.dll_inet_addr
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov word [ebx], 2
mov ax, word [edx + 0x10]
push eax
call sub.WS2_32.dll_htons
mov ecx, dword [esi + 4]
push 0x10
push ebx
push ecx
mov word [esi + 0xa], ax
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x4187df
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4187df
call sub.WS2_32.dll_WSAGetLastError
push eax
push 0x769bfc
call fcn.00405d90
mov eax, dword [esi + 4]
add esp, 8
cmp eax, 0xffffffff
je 0x4187cd
push eax
call sub.WS2_32.dll_closesocket
push 0xa000
lea ecx, [esi + 0x24]
mov dword [esi + 4], 0xffffffff
call fcn.0041af50
push 0xa000
mov ecx, edi
call fcn.0041af50
mov dword [esi + 0x20], 0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [esi + 0x20], 0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x769be0
call fcn.00531ef0
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4189a0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.WINMM.dll_timeGetTime]
cmp dword [edi + 0x1c], eax
jae 0x418a52
lea esi, [edi + 0x24]
xor ebx, ebx
mov ecx, esi
call fcn.0041af40
test eax, eax
je 0x418a52
mov eax, dword [edi + 4]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10c]
push ebx
push edx
push ebx
push ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
je 0x418a43
cmp eax, ebx
jle 0x418a52
mov eax, dword [esi + 8]
mov edx, dword [esi + 4]
sub eax, edx
push ebx
push eax
mov eax, dword [esi]
mov ecx, edx
mov edx, dword [edi + 4]
add ecx, eax
push ecx
push edx
call dword [0x7a1220]
cmp eax, 0xffffffff
je 0x418a30
push eax
mov ecx, esi
call fcn.0041b190
jmp 0x418a43
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x418a43
cmp eax, 0x2749
jne 0x418a5b
call dword [sym.imp.WINMM.dll_timeGetTime]
cmp dword [edi + 0x1c], eax
jb 0x4189c2
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
je 0x418a89
push eax
call sub.WS2_32.dll_closesocket
push 0xa000
mov ecx, esi
mov dword [edi + 4], 0xffffffff
call fcn.0041af50
push 0xa000
lea ecx, [edi + 0x5c]
call fcn.0041af50
mov dword [edi + 0x20], ebx
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x418aa0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 8]
lea edx, [ebp - 0x10c]
mov eax, dword [esi + 4]
push ecx
push ebx
push ebx
push edx
push ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
je 0x418b14
cmp eax, ebx
jle 0x418b14
mov ecx, dword [esi + 4]
push ebx
lea eax, [ebp - 0x90c]
push 0x800
push eax
push ecx
call dword [fcn.007a11a0]
cmp eax, 0xffffffff
je 0x418b1c
cmp eax, ebx
jle 0x418b2f
lea edx, [ebp - 0x90c]
lea ecx, [esi + 0x40]
push edx
push eax
call fcn.0041aff0
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x418b14
cmp eax, 0x2749
je 0x418b14
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x418b5e
push eax
call sub.WS2_32.dll_closesocket
push 0xa000
lea ecx, [esi + 0x24]
mov dword [esi + 4], 0xffffffff
call fcn.0041af50
push 0xa000
lea ecx, [esi + 0x5c]
call fcn.0041af50
mov dword [esi + 0x20], ebx
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret