joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409e50
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ada1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x44a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [edi + 0x38]
mov dword [eax + 0x14], 0xf
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 0x10
jb 0x409e95
mov eax, dword [eax]
mov byte [eax], 0
lea esi, [edi + 0x68]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040d8d0
mov dword [esi], eax
lea esi, [edi + 0x70]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040d8a0
mov dword [esi], eax
mov byte [ebp - 4], 2
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x44bbb8]
cmp eax, dword [ecx + 4]
jle 0x409f23
push 0x44bbb8
call fcn.0041c1f0
add esp, 4
cmp dword [0x44bbb8], 0xffffffff
jne 0x409f23
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x44bbb8
mov dword [0x44bbbc], eax
call fcn.0041c1b1
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitializeSRWLock
push dword [0x44bbbc]
call esi
push str.AcquireSRWLockExclusive
push dword [0x44bbbc]
mov dword [edi + 0x1c], eax
call esi
push str.ReleaseSRWLockExclusive
push dword [0x44bbbc]
mov dword [edi + 0x24], eax
call esi
push str.AcquireSRWLockShared
push dword [0x44bbbc]
mov dword [edi + 0x2c], eax
call esi
push str.ReleaseSRWLockShared
push dword [0x44bbbc]
mov dword [edi + 0x20], eax
call esi
push str.TryAcquireSRWLockShared
push dword [0x44bbbc]
mov dword [edi + 0x28], eax
call esi
mov ecx, dword [edi + 0x1c]
mov dword [edi + 0x30], eax
test ecx, ecx
je 0x409fb8
cmp dword [edi + 0x24], 0
je 0x409fb8
cmp dword [edi + 0x2c], 0
je 0x409fb8
cmp dword [edi + 0x20], 0
je 0x409fb8
cmp dword [edi + 0x28], 0
je 0x409fb8
test eax, eax
je 0x409fb8
lea eax, [edi + 0x18]
push eax
call ecx
mov byte [edi + 0x34], 1
jmp 0x409fc8
push 0xc350
push edi
mov byte [edi + 0x34], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [edi + 0x50], 0
mov eax, edi
mov dword [edi + 0x54], 1
mov dword [edi + 0x58], 0xffffffff
mov dword [edi + 0x5c], 0
mov dword [edi + 0x64], 0
mov byte [edi + 0x60], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ccd0
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x44a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
push 2
mov edi, edx
mov ebx, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
jns 0x40cd1a
push str.lanSvr:_socket_UDP_err_n
call fcn.00401410
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
mov eax, 2
movups xmmword [ebp - 0x14], xmm0
push ebx
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push edi
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x40cd78
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push str.lanSvr:_udp_bind_err_n
call fcn.00401410
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041be62
mov esp, ebp
pop ebp
ret

Function at 0x40cdb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x18]
sub esp, 0x2c
test eax, eax
mov edx, 0x44454e
cmovne edx, eax
push ebx
push esi
push edi
cmp byte [edx], 0
mov esi, ecx
jne 0x40cdd4
xor ecx, ecx
jmp 0x40cde9
mov ecx, edx
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40cde0
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 0x38]
call fcn.00403aa0
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], 0x23
mov dword [esp + 0x20], 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], 0x409aa0
mov dword [esp + 0x28], 0x409ab0
mov dword [esp + 0x2c], 0x409ac0
mov dword [esp + 0x30], 0x409ae0
mov dword [esp + 0x34], esi
call fcn.004168a0
mov dword [esi + 0x50], eax
test eax, eax
jne 0x40ce65
push str._Create_error._n
call fcn.00401410
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edi, dword [ebp + 0x10]
lea eax, [edi - 1]
cmp eax, 0xfffe
ja 0x40ced6
mov edx, edi
mov ecx, ebx
call fcn.0040ccd0
mov dword [esi + 0x58], eax
test eax, eax
jns 0x40cea1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Warnning:_Create_UDP_Listen_err_d_n
call fcn.0040eaf0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 8
mov dword [esi + 0x5c], edi
call fcn.0041be73
add esp, 4
lea ecx, [esp + 0xc]
mov dword [eax], 0x409a90
push ecx
push 0
push eax
push 0x403180
push 0xa00000
push 0
mov dword [eax + 4], esi
call fcn.0041f92d
add esp, 0x18
mov dword [esi + 0x64], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40ebd0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1ac
mov eax, dword [0x44a00c]
xor eax, esp
mov dword [esp + 0x1a8], eax
push esi
mov esi, dword [ebp + 0xc]
call fcn.0040e940
push 0x44454e
push 0
call fcn.0042588a
add esp, 8
push 3
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
push 0
call fcn.004259e7
add esp, 8
lea eax, [esp + 0x18]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp dword [ebp + 8], 2
jne 0x40ec85
push str._server
push dword [esi + 4]
call fcn.0042949f
add esp, 8
test eax, eax
jne 0x40ec85
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], str.xfs_rdsvr
mov dword [esp + 0x10], 0x40f470
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x40ed11
call fcn.0040f5d0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
cmp byte [0x44bbad], 0
je 0x40eca2
push 0x444f38
call fcn.00401410
add esp, 4
push 0x4450d0
jmp 0x40ecb4
push str._n_tfile_block_transfer_protocol_server_side_for_xFsRedir._n_tThe_program_provides_a_directory_mapping_server_can_map_one_or_more_directories_to_the_xfsredir_client._n_tThe_program_provides_a_virtual_disk_mapping_server__can_map_partition_and_physical_disk_to_xfsredir_client_n_tThe_program_provides_IP_packet_forwarding_server_of_VLAN__which_can_make_xfsredir_client_form_VLAN_n_tThe_program_provides_Proxy_Server__which_can_make_xfsredir_client_from_proxy__n_n_t_t_______________________________CopyRight_2015_2021_Fanxiushu._n_n
call fcn.00401410
add esp, 4
push str._nrun_type:__press_number_key__n_n__1_._register_service_and_run__Recommended__n__2_._stop_and_unregister_service_n__3_._run_in_console._n_n
call fcn.00401410
add esp, 4
call fcn.004298d6
cmp eax, 0x72
je 0x40ecfc
cmp eax, 0x52
je 0x40ecfc
cmp eax, 0x31
je 0x40ecfc
cmp eax, 0x75
je 0x40ed26
cmp eax, 0x55
je 0x40ed26
cmp eax, 0x32
je 0x40ed26
cmp eax, 0x44
je 0x40ec6b
cmp eax, 0x64
je 0x40ec6b
cmp eax, 0x33
je 0x40ec6b
call fcn.004298d6
cmp eax, 0x72
jne 0x40ecc6
call fcn.0040ee90
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0040f0c0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
call fcn.0040f1b0
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0040f2d0
mov ecx, dword [esp + 0x1ac]
xor eax, eax
pop esi
xor ecx, esp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
Function at 0x40ee90
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x44a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x40eee6
push 1
push str.xfs_rdsvr
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
je 0x40eedb
push eax
mov ebx, 1
call edi
push esi
call edi
test ebx, ebx
jne 0x40f0a8
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x40ef2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.xfs_rdsvr
push 0x4453f4
push str.Success
call fcn.00401480
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
mov eax, 0x22
push 0x3fe
mov word [ebp - 0x408], ax
lea eax, [ebp - 0x406]
push 0
push eax
call fcn.0041ea80
add esp, 0xc
lea eax, [ebp - 0x407]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x408]
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x40ef70
mov eax, dword [str.___server]
push 0
push 0
push 0
mov dword [ecx], eax
mov eax, dword [0x44542c]
push 0
push 0
mov dword [ecx + 4], eax
mov ax, word [0x445430]
mov word [ecx + 8], ax
lea eax, [ebp - 0x408]
push eax
push 1
push 2
push 0x20
push 0xf01ff
push str.Fanxiushu_File_System_Directory_Redirect_Server
push str.xfs_rdsvr
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x40c], eax
test eax, eax
jne 0x40effe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.xfs_rdsvr
push str.CreateServie___s_
push str.Success
call fcn.00401480
add esp, 0x10
push ebx
call edi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
lea ecx, [ebp - 0x410]
push ecx
push 1
push eax
mov dword [ebp - 0x410], str.Fanxiushu_File_System_Directory_Redirect_Server
call esi
lea eax, [ebp - 0x418]
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x41c], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x414], 0xfa0
push eax
push 2
push dword [ebp - 0x40c]
movups xmmword [ebp - 0x42c], xmm0
mov dword [ebp - 0x420], 1
mov dword [ebp - 0x42c], 0xffffffff
mov dword [ebp - 0x418], 1
call esi
test eax, eax
jne 0x40f089
push 0x4454a0
push str.Success
call fcn.00401480
add esp, 8
push dword [ebp - 0x40c]
call edi
push ebx
call edi
mov eax, dword [0x4454f4]
mov dword [str.Success], eax
mov eax, dword [0x4454f8]
mov dword [0x44a984], eax
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041be62
mov esp, ebp
pop ebp
ret
Function at 0x40f0c0
Capabilities:
Start service

Disassembly:
push ecx
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x40f0f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4454fc
push str.Success
call fcn.00401480
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ecx
ret
push 0xf01ff
push str.xfs_rdsvr
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x40f134
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x445528
push str.Success
call fcn.00401480
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ecx
ret
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x40f17b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x40f17b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x445550
push str.Success
call fcn.00401480
add esp, 0xc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
xor eax, eax
pop edi
pop esi
pop ecx
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov eax, dword [0x4454f4]
mov dword [str.Success], eax
mov eax, dword [0x4454f8]
pop edi
mov dword [0x44a984], eax
mov eax, 1
pop esi
pop ecx
ret

Function at 0x40f1b0
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x40f204
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x445568
push str.Success
call fcn.00401480
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
push 0xf01ff
push str.xfs_rdsvr
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x40f259
call ebx
cmp eax, 0x424
je 0x40f259
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call ebx
push eax
push 0x445528
push str.Success
call fcn.00401480
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
je 0x40f290
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40f290
call ebx
push eax
push 0x445594
push str.Success
call fcn.00401480
add esp, 0xc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov eax, dword [0x4454f4]
mov ecx, dword [ebp - 4]
pop edi
mov dword [str.Success], eax
xor ecx, ebp
mov eax, dword [0x4454f8]
pop esi
mov dword [0x44a984], eax
mov eax, 1
pop ebx
call fcn.0041be62
mov esp, ebp
pop ebp
ret
Function at 0x40f2d0
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x44a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x40f305
push eax
push eax
push 0x4455ac
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xf01ff
push str.xfs_rdsvr
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x40f325
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40f380
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x40f374
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4455d0
push str.Success
call fcn.00401480
add esp, 0xc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov eax, dword [0x4454f4]
mov ecx, dword [ebp - 4]
mov dword [str.Success], eax
xor ecx, ebp
mov eax, dword [0x4454f8]
pop edi
mov dword [0x44a984], eax
mov eax, 1
pop esi
call fcn.0041be62
mov esp, ebp
pop ebp
ret

Function at 0x410350
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x14]
mov byte [edi + 0x10], 1
test esi, esi
je 0x41037f
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0xc]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
js 0x41038f
push eax
call esi
mov eax, dword [edi + 0x40]
test eax, eax
js 0x410399
push eax
call esi
mov esi, dword [edi + 0x20]
test esi, esi
je 0x4103b0
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push esi
call fcn.004230f4
add esp, 4
mov esi, dword [edi + 0x48]
test esi, esi
je 0x4103c7
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push esi
call fcn.004230f4
add esp, 4
mov ecx, dword [edi + 0x54]
test ecx, ecx
je 0x410404
push dword [ebp - 4]
mov edx, dword [edi + 0x58]
push ecx
call fcn.00414680
mov ecx, dword [edi + 0x54]
add esp, 8
mov eax, dword [edi + 0x5c]
sub eax, ecx
sar eax, 4
push eax
push ecx
call fcn.00413fd0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov eax, dword [edi + 0x4c]
lea ecx, [edi + 0x4c]
push eax
push dword [eax]
lea eax, [ebp - 4]
push eax
call fcn.00414210
push dword [edi + 0x4c]
call fcn.0041bea6
mov eax, dword [edi + 0x38]
add esp, 4
cmp eax, 0x10
jb 0x410433
inc eax
push eax
push dword [edi + 0x24]
call fcn.00404100
mov dword [edi + 0x38], 0xf
cmp dword [edi + 0x38], 0x10
mov dword [edi + 0x34], 0
jb 0x410453
mov eax, dword [edi + 0x24]
pop edi
pop esi
mov byte [eax], 0
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x24], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x410f00
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [0x44a00c]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
push 0
push 1
push 2
mov edi, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
js 0x410fda
push 4
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 1
push eax
push 4
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp dword [edi + 0x38], 0x10
xorps xmm0, xmm0
mov eax, 2
movaps xmmword [esp + 0x10], xmm0
mov word [esp + 0x10], ax
lea eax, [edi + 0x24]
jb 0x410f81
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
xor ecx, ecx
cmp eax, 0xffffffff
cmove eax, ecx
mov dword [esp + 0x14], eax
movzx eax, word [edi + 0x3c]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x12], ax
lea eax, [esp + 0x10]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x410fee
call fcn.00422fff
push dword [eax]
call fcn.00425b09
add esp, 4
push eax
push str.create_listensock_bind_err__s__n
call fcn.0040eaf0
add esp, 8
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
push bind
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jns 0x411015
call fcn.00422fff
push dword [eax]
call fcn.00425b09
add esp, 4
push eax
push str.create_listensock_listen_err__s__n
jmp 0x410fcb
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
Function at 0x411840
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0x18]
push edi
cmp dword [esi + 4], 0
jne 0x411872
push 0x20030
call fcn.00423370
mov edi, eax
add esp, 4
mov dword [ebp + 0x18], edi
test edi, edi
jne 0x411897
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [esi]
mov edx, dword [eax]
push edx
mov ecx, dword [edx + 4]
mov edi, dword [edx + 8]
mov eax, dword [edx]
mov dword [ebp + 0x18], edi
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [esi + 4]
call fcn.0041bea6
add esp, 4
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x8004667e
push esi
mov dword [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 1
push 6
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [edi], esi
mov dword [edi + 4], 0xffffffff
push 0
mov dword [edi + 8], 0
call fcn.004230b2
mov esi, dword [ebp + 0x14]
add esp, 4
mov dword [edi + 0x10], eax
lea eax, [ebp + 0x18]
mov dword [edi + 0x14], edx
mov dword [edi + 0xc], 0x14
mov dword [edi + 0x18], 1
mov word [edi + 0x1c], 0x101
mov dword [edi + 0x20], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x24], 0x14
mov edi, dword [esi]
push eax
push dword [edi + 4]
push edi
call fcn.00414630
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [esi + 4]
sub ecx, eax
cmp ecx, 1
jb 0x411952
inc eax
mov dword [esi + 4], eax
mov dword [edi + 4], edx
mov eax, dword [edx + 4]
pop edi
pop esi
mov dword [eax], edx
xor eax, eax
mov esp, ebp
pop ebp
ret 0x14
push str.list_T__too_long
call fcn.0041be15
int3

Function at 0x411ab0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x44a00c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov bx, dx
push 0
push 1
push 2
mov dword [ebp - 0x1c], ecx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
js 0x411b34
xorps xmm0, xmm0
mov dword [ebp - 0x20], 1
movups xmmword [ebp - 0x18], xmm0
mov eax, 2
mov word [ebp - 0x16], bx
mov word [ebp - 0x18], ax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push 0x10
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x411b48
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x411b4b
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
mov byte [edi], 1
push 4
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 1
push eax
push 1
push 6
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041be62
mov esp, ebp
pop ebp
ret
Function at 0x411b80
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov esi, dword [edi]
cmp esi, ebx
jl 0x411ba2
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
mov eax, 0x10000
sub ecx, esi
cmp ecx, eax
cmovl eax, ecx
test eax, eax
jle 0x411bf2
push 0
push ebx
lea eax, [esi + edx]
push eax
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
test esi, esi
jg 0x411bf0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test esi, esi
je 0x411be6
jns 0x411bdd
cmp eax, 0x2733
jne 0x411be6
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
add dword [edi], esi
xor eax, eax
cmp dword [edi], ebx
pop edi
pop esi
setge al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412d00
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x44a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
push 2
mov edi, edx
mov ebx, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
jns 0x412d4a
push str.proxy:_socket_UDP_err_n
call fcn.00401410
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
mov eax, 2
movups xmmword [ebp - 0x14], xmm0
push ebx
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push edi
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x412da8
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push str.proxy:_udp_bind_err_n
call fcn.00401410
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041be62
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041be62
mov esp, ebp
pop ebp
ret