joyce8/EMBER2024-capa huggingface dataset:
Function at 0x519ae4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x519b9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x48]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00519a78
test al, al
je 0x519b7e
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a6fc
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x519b7e
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b054
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.0040b054
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.0040b0bc
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc esi
dec ebx
jne 0x519b37
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519ba3
lea eax, [ebp - 0x2c]
call fcn.0040a574
lea eax, [ebp - 4]
call fcn.0040a574
ret

Function at 0x51a3ac
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.005191f0
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040b054
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.005193d8
test al, al
jne 0x51a414
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x579d70]
mov dl, 1
mov eax, dword [0x517fbc]
call fcn.00425b2c
call fcn.00409bf0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x51a420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040b054
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edx, eax
mov eax, ebx
call fcn.005193d8
test al, al
jne 0x51a481
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x57a2a8]
mov dl, 1
mov eax, dword [0x517fbc]
call fcn.00425b2c
call fcn.00409bf0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00519220
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x51aa80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x51aba8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.00519478
xor eax, eax
push ebp
push 0x51ab83
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00519a78
test al, al
je 0x51ab67
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0051a960
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a6fc
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x51ab67
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b054
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005193d8
test al, al
je 0x51ab63
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b054
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0040b0bc
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0051a960
pop ecx
inc edi
dec ebx
jne 0x51ab0b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51ab8a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.00519478
ret
Function at 0x51abb8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x51ae06
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.00519478
xor eax, eax
push ebp
push 0x51addc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00519a78
test al, al
je 0x51adc0
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a6fc
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x51adc0
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b054
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005193d8
test al, al
je 0x51adb4
mov eax, dword [ebp - 4]
call fcn.0040b054
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040b0bc
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0051a4d0
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x51adb4
xor eax, eax
push ebp
push 0x51adad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.00519478
xor eax, eax
push ebp
push 0x51ad8f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040b054
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040b0bc
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0051947c
mov eax, dword [ebp - 4]
call fcn.0040b054
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040b0bc
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0051a4d0
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x51ad6c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0051aa80
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0051abb8
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51ad73
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x51ac43
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51ade3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.00519478
ret
Function at 0x5289b0
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.0040a574
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x5289e1
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.0040a6fc
add esp, 0x24
pop ebx
ret

Function at 0x54b51c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, dword [0x54984c]
call fcn.00408a08
test al, al
je 0x54b635
mov edx, dword [ebx + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [ebx + 0x54]
mov eax, dword [esi + 0x54]
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [esi + 8]
mov edx, dword [ebx + 8]
call fcn.0040a954
lea eax, [esi + 0x10]
mov edx, dword [ebx + 0x10]
call fcn.0040a954
lea eax, [esi + 0x14]
mov edx, dword [ebx + 0x14]
call fcn.0040a954
lea eax, [esi + 0x18]
mov edx, dword [ebx + 0x18]
call fcn.0040a954
lea eax, [esi + 0x1c]
mov edx, dword [ebx + 0x1c]
call fcn.0040a954
lea eax, [esi + 0x20]
mov edx, dword [ebx + 0x20]
call fcn.0040a954
lea eax, [esi + 0x4c]
mov edx, dword [ebx + 0x4c]
call fcn.0040a954
lea eax, [esi + 0x50]
mov edx, dword [ebx + 0x50]
call fcn.0040a954
mov eax, dword [ebx + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [ebx + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [ebx + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [ebx + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [ebx + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [ebx + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [ebx + 0x44]
mov dword [esi + 0x44], eax
lea eax, [esi + 0x48]
mov edx, dword [ebx + 0x48]
call fcn.0040a954
mov eax, dword [ebx + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [ebx + 0x5c]
mov dword [esi + 0x5c], eax
lea eax, [esi + 0x68]
mov edx, dword [ebx + 0x68]
call fcn.0040a954
mov eax, dword [ebx + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [ebx + 0x64]
mov dword [esi + 0x64], eax
mov eax, dword [ebx + 0x70]
mov dword [esi + 0x70], eax
mov eax, dword [ebx + 0x74]
mov dword [esi + 0x74], eax
lea eax, [esi + 0x78]
mov edx, dword [ebx + 0x78]
call fcn.0040a954
movzx eax, byte [ebx + 0x7c]
mov byte [esi + 0x7c], al
lea eax, [esi + 0x80]
mov edx, dword [ebx + 0x80]
call fcn.0040a954
pop esi
pop ebx
ret
mov edx, esi
mov eax, ebx
call fcn.004a4734
pop esi
pop ebx
ret
Function at 0x556e68
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x556e70
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x557025
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x557040
call fcn.0040b2c0
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0x1c]
xor edx, edx
call fcn.00554a40
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x557054
call fcn.004e15c8
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x556eeb
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x556f2c
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0xc]
xor edx, edx
call fcn.00554a40
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x5570bc
call fcn.004e15c8
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040b268
mov eax, esi
mov edx, 0x5570e8
call fcn.0040b268
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x556f44
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x556fb2
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x5570fc
call fcn.004e15c8
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0040b268
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x556f7b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x556fa6
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x55712c
call fcn.004e15c8
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0040b268
mov eax, esi
mov edx, 0x5570e8
call fcn.0040b268
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x556fbe
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x556fe9
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x557158
call fcn.004e15c8
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040b268
mov eax, esi
mov edx, 0x5570e8
call fcn.0040b268
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55702c
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.0040a5d4
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040a5d4
lea eax, [ebp - 4]
call fcn.0040a574
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x8d734b7
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..rsrc
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x29dc06f3
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401d20
Capabilities:
Create tcp socket
Create udp socket
Start tcp server
Terminate process

Disassembly:
push 0x360
call sub.nutsock4.dll_htons
push 0
push 1
push 2
mov word [0x408a12], ax
mov dword [0x408a14], 0
mov word [0x408a10], 2
call sub.nutsock4.dll_socket
add esp, 0x10
test eax, eax
mov dword [0x408a74], eax
jge 0x401d6e
push str.socket__
call sub.nutlibc4.dll_perror
add esp, 4
push 1
call sub.nutlibc4.dll_exit
push 0x10
push 0x408a10
push eax
call sub.nutsock4.dll_bind
add esp, 0xc
test eax, eax
mov dword [0x408a70], eax
je 0x401d9b
push str.bind__
call sub.nutlibc4.dll_perror
add esp, 4
push 1
call sub.nutlibc4.dll_exit
mov eax, dword [0x408a74]
push 5
push eax
call sub.nutsock4.dll_listen
add esp, 8
test eax, eax
mov dword [0x408a70], eax
je 0x401dc8
push str.listen__
call sub.nutlibc4.dll_perror
add esp, 4
push 1
call sub.nutlibc4.dll_exit
mov ecx, dword [0x408a74]
push 0x408a04
push 0x408b10
push ecx
mov dword [0x408a04], 0x10
call sub.nutsock4.dll_accept
add esp, 0xc
test eax, eax
mov dword [0x408b08], eax
jl 0x401e4e
call sub.nutlibc4.dll_fork
cmp eax, 0xffffffff
mov dword [0x408b04], eax
je 0x401e62
test eax, eax
je 0x401e76
mov edx, dword [0x408b08]
push edx
call sub.nutlibc4.dll_close
add esp, 4
test eax, eax
mov dword [0x408a70], eax
jne 0x401ec9
mov eax, dword [0x408a74]
push 0x408a04
push 0x408b10
push eax
mov dword [0x408a04], 0x10
call sub.nutsock4.dll_accept
add esp, 0xc
test eax, eax
mov dword [0x408b08], eax
jge 0x401df4
push str.accept__
call sub.nutlibc4.dll_perror
add esp, 4
push 1
call sub.nutlibc4.dll_exit
push str.fork__
call sub.nutlibc4.dll_perror
add esp, 4
push 1
call sub.nutlibc4.dll_exit
mov ecx, dword [0x408a74]
push ecx
call sub.nutlibc4.dll_close
add esp, 4
test eax, eax
mov dword [0x408a70], eax
je 0x401ea2
push str.close_mySocket_
call sub.nutlibc4.dll_perror
add esp, 4
push 1
call sub.nutlibc4.dll_exit
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push edx
push eax
call fcn.004017b0
mov ecx, dword [0x408b08]
push ecx
call sub.nutlibc4.dll_close
add esp, 0xc
test eax, eax
mov dword [0x408a70], eax
je 0x401edd
push str.close__
call sub.nutlibc4.dll_perror
add esp, 4
push 1
call sub.nutlibc4.dll_exit
xor eax, eax
ret
Function at 0x401f30
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x94
mov eax, dword [0x40706c]
xor eax, esp
mov dword [esp + 0x90], eax
push esi
mov esi, dword [esp + 0xa0]
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x88]
push ecx
mov byte [esp + 0x8c], 0x8d
mov byte [esp + 0x8d], 0x17
mov byte [esp + 0x8e], 0x56
mov byte [esp + 0x8f], 0xd5
mov byte [esp + 0x90], 0xe7
mov byte [esp + 0x91], 0x76
mov byte [esp + 0x92], 0xa2
mov byte [esp + 0x93], 0xc0
call dword [sym.imp.numerical.dll_uts_trimSetCharacter]
push 1
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x9c]
push eax
push esi
call dword [sym.imp.numerical.dll_uts_trimStringWide]
mov esi, dword [esp + 0xb4]
push 0
push 8
lea ecx, [esp + 0xac]
push ecx
push esi
call sub.nutsock4.dll_send
add esp, 0x28
cmp eax, 8
je 0x40202b
mov dword [0x408b00], esi
call sub.nutlibc4.dll_getpid
mov edx, dword [0x408a78]
push eax
push str._d:
push edx
call sub.nutlibc4.dll_fprintf
mov eax, dword [0x408a78]
push str.Error:_Socket_write_error_while_sending_key_n
push eax
call sub.nutlibc4.dll_fprintf
mov ecx, dword [0x408a78]
push ecx
call sub.nutlibc4.dll_fflush
add esp, 0x18
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.00403990
add esp, 0x94
ret
mov ecx, dword [esp + 0x94]
pop esi
xor ecx, esp
xor eax, eax
call fcn.00403990
add esp, 0x94
ret

Function at 0x402050
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x94
mov eax, dword [0x40706c]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x94]
push ecx
mov byte [esp + 0x98], 0x8d
mov byte [esp + 0x99], 0x17
mov byte [esp + 0x9a], 0x56
mov byte [esp + 0x9b], 0xd5
mov byte [esp + 0x9c], 0xe7
mov byte [esp + 0x9d], 0x76
mov byte [esp + 0x9e], 0xa2
mov byte [esp + 0x9f], 0xc0
call dword [sym.imp.numerical.dll_uts_trimSetCharacter]
mov ebx, dword [esp + 0xb0]
add esp, 8
xor esi, esi
mov edi, 8
push 0
push edi
lea edx, [esp + esi + 0xa0]
push edx
push ebx
call sub.nutsock4.dll_recv
add esp, 0x10
test eax, eax
jle 0x402124
add esi, eax
sub edi, eax
jne 0x4020d3
push edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xa0]
push ebp
push ecx
call dword [sym.imp.numerical.dll_uts_trimStringWide]
add esp, 0x10
xor eax, eax
mov ecx, dword [esp + 0xa0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00403990
add esp, 0x94
ret
test eax, eax
mov dword [0x408b00], ebx
jne 0x40214b
call sub.nutlibc4.dll_getpid
push eax
mov eax, dword [0x408a78]
push str._d:
push eax
call sub.nutlibc4.dll_fprintf
push str.Socket_connection_closed_by_the_other_side_n
jmp 0x402166
call sub.nutlibc4.dll_getpid
push eax
mov eax, dword [0x408a78]
push str._d:
push eax
call sub.nutlibc4.dll_fprintf
push str.Error:_Socket_read_error_n
mov ecx, dword [0x408a78]
push ecx
call sub.nutlibc4.dll_fprintf
mov edx, dword [0x408a78]
push edx
call sub.nutlibc4.dll_fflush
add esp, 0x18
or eax, 0xffffffff
jmp 0x40210b
Function at 0x402bc0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x40706c]
xor eax, esp
mov dword [esp + 0x130], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402bf0
sub eax, edx
cdq
and edx, 7
add eax, edx
mov ebx, eax
sar ebx, 3
add bl, 1
cmp bl, 0x32
jbe 0x402c66
call sub.nutlibc4.dll_getpid
push eax
mov eax, dword [0x408a78]
push str._d:
push eax
call sub.nutlibc4.dll_fprintf
mov edx, dword [0x408a78]
movzx ecx, bl
push ecx
push str.SndMsg:_count___d_n
push edx
call sub.nutlibc4.dll_fprintf
mov eax, dword [0x408a78]
push eax
call sub.nutlibc4.dll_fflush
push 0x24
call fcn.004021e0
add esp, 0x20
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.00403990
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.numerical.dll_uts_trimSetCharacter]
lea ecx, [esp + 0x98]
push ecx
push edi
call esi
lea edx, [esp + 0x20]
push edx
add edi, 8
push edi
call esi
movzx eax, bl
add esp, 0x10
test eax, eax
mov dword [esp + 0x10], 0
jle 0x402d40
mov edi, dword [esp + 0x14]
mov esi, dword [sym.imp.numerical.dll_uts_trimStringWide]
push 8
lea eax, [esp + 0x130]
push edi
push eax
call sub.nutlibc4.dll_strncpy
push 1
lea ecx, [esp + 0xa8]
push ecx
lea edx, [esp + 0x148]
push edx
lea eax, [esp + 0x144]
push eax
call esi
push 1
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x148]
push edx
lea eax, [esp + 0x15c]
push eax
call esi
mov ecx, dword [esp + 0x150]
mov edx, dword [esp + 0x154]
push 0
push 9
lea eax, [esp + 0x14c]
mov dword [esp + 0x14c], ecx
mov ecx, dword [ebp + 8]
push eax
push ecx
mov dword [esp + 0x158], edx
mov byte [esp + 0x15c], bl
call sub.nutsock4.dll_send
add esp, 0x3c
cmp eax, 9
jne 0x402d9e
mov eax, dword [esp + 0x10]
movzx ecx, bl
add eax, 1
add edi, 8
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x402ca2
cmp dword [0x408a78], 0
je 0x402d87
call sub.nutlibc4.dll_getpid
push eax
mov eax, dword [0x408a78]
push str._d:
push eax
call sub.nutlibc4.dll_fprintf
mov ecx, dword [esp + 0x20]
mov edx, dword [ebp + 8]
mov eax, dword [0x408a78]
push ecx
push edx
push str.Sent_to__d:__s_n
push eax
call sub.nutlibc4.dll_fprintf
mov ecx, dword [0x408a78]
push ecx
call sub.nutlibc4.dll_fflush
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.00403990
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov dword [0x408b00], edx
call sub.nutlibc4.dll_getpid
push eax
mov eax, dword [0x408a78]
push str._d:
push eax
call sub.nutlibc4.dll_fprintf
mov ecx, dword [0x408a78]
push str.Error:_Socket_write_error_while_sending_message_n
push ecx
call sub.nutlibc4.dll_fprintf
mov edx, dword [0x408a78]
push edx
call sub.nutlibc4.dll_fflush
mov ecx, dword [esp + 0x154]
add esp, 0x18
pop edi
pop esi
pop ebx
xor ecx, esp
or eax, 0xffffffff
call fcn.00403990
mov esp, ebp
pop ebp
ret