joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402db0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x41e25c]
sub esp, 0x498
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
jne 0x402edb
mov al, 0x44
mov cl, 0x4c
mov byte [esp + 0x2d], al
mov byte [esp + 0x31], al
mov byte [esp + 9], al
mov byte [esp + 0x1d], al
mov byte [esp + 0x11], al
mov byte [esp + 0x2e], cl
mov byte [esp + 0x2f], cl
mov byte [esp + 0x32], cl
mov byte [esp + 0x33], cl
lea eax, [esp + 0x28]
mov dl, 0x4d
mov cl, 0x35
push eax
mov byte [esp + 0x2c], 0x43
mov byte [esp + 0x2d], 0x52
mov byte [esp + 0x2e], 0x59
mov byte [esp + 0x2f], 0x50
mov byte [esp + 0x30], 0x54
mov byte [esp + 0x34], 0x2e
mov byte [esp + 0x38], bl
mov byte [esp + 0xc], dl
mov byte [esp + 0xe], cl
mov byte [esp + 0xf], 0x49
mov byte [esp + 0x10], 0x6e
mov byte [esp + 0x11], 0x69
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x13], bl
mov byte [esp + 0x20], dl
mov byte [esp + 0x22], cl
mov byte [esp + 0x23], 0x55
mov byte [esp + 0x24], 0x70
mov byte [esp + 0x25], 0x64
mov byte [esp + 0x26], 0x61
mov byte [esp + 0x27], 0x74
mov byte [esp + 0x28], 0x65
mov byte [esp + 0x29], bl
mov byte [esp + 0x14], dl
mov byte [esp + 0x16], cl
mov byte [esp + 0x17], 0x46
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1a], 0x61
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1c], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x41e25c], eax
jne 0x402ea3
pop esi
xor al, al
pop ebx
add esp, 0x498
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov dword [0x41e258], eax
mov eax, dword [0x41e25c]
lea edx, [esp + 0x1c]
push edx
push eax
call esi
mov edx, dword [0x41e25c]
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [0x41e254], eax
call esi
mov dword [0x41e250], eax
push edi
mov edi, dword [esp + 0x4ac]
mov ecx, edi
xor eax, eax
lea edx, [esp + 0x3c]
mov dword [ecx], eax
push edx
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
call dword [0x41e258]
mov eax, dword [esp + 0x4a8]
push 0x41a518
push eax
call fcn.00409d94
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x402f5b
mov al, byte [esi + 0xc]
mov bl, 0x10
test bl, al
jne 0x402f52
push esi
push 0x400
lea ecx, [esp + 0xac]
push 1
push ecx
call fcn.00409c4c
add esp, 0x10
lea edx, [esp + 0xa4]
push eax
lea eax, [esp + 0x40]
push edx
push eax
call dword [0x41e254]
test byte [esi + 0xc], bl
je 0x402f21
push esi
call fcn.00409bcf
add esp, 4
lea ecx, [esp + 0x3c]
push ecx
call dword [0x41e250]
mov edx, dword [esp + 0x94]
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x9c]
mov dword [edi], edx
mov edx, dword [esp + 0xa0]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x498
ret
Function at 0x4049d0
Capabilities:
Get file version info
Read .ini file

Disassembly:
sub esp, 0x6c
push ebp
mov ebp, dword [esp + 0x74]
push esi
push edi
push 0x2e
push ebp
call fcn.0040a700
mov edi, eax
add esp, 8
test edi, edi
jne 0x4049fc
mov eax, dword [esp + 0x80]
pop edi
pop esi
pop ebp
mov byte [eax], 0
add esp, 0x6c
ret
mov esi, str..dll
mov ecx, edi
mov al, byte [ecx]
mov dl, al
cmp al, byte [esi]
jne 0x404a27
test dl, dl
je 0x404a23
mov al, byte [ecx + 1]
mov dl, al
cmp al, byte [esi + 1]
jne 0x404a27
add ecx, 2
add esi, 2
test dl, dl
jne 0x404a03
xor ecx, ecx
jmp 0x404a2c
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x404b22
mov esi, str..exe
mov ecx, edi
mov al, byte [ecx]
mov dl, al
cmp al, byte [esi]
jne 0x404a5f
test dl, dl
je 0x404a5b
mov al, byte [ecx + 1]
mov dl, al
cmp al, byte [esi + 1]
jne 0x404a5f
add ecx, 2
add esi, 2
test dl, dl
jne 0x404a3b
xor ecx, ecx
jmp 0x404a64
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x404b22
mov esi, str..ini
mov ecx, edi
mov al, byte [ecx]
mov dl, al
cmp al, byte [esi]
jne 0x404a97
test dl, dl
je 0x404a93
mov al, byte [ecx + 1]
mov dl, al
cmp al, byte [esi + 1]
jne 0x404a97
add ecx, 2
add esi, 2
test dl, dl
jne 0x404a73
xor ecx, ecx
jmp 0x404a9c
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x404ad8
mov esi, str..inf
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x404acb
test cl, cl
je 0x404ac7
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x404acb
add eax, 2
add esi, 2
test cl, cl
jne 0x404aa7
xor eax, eax
jmp 0x404ad0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x404bce
push ebp
lea eax, [esp + 0x18]
push 0x64
push eax
push 0x41e260
push 0x41a664
push str.VERSION
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x80]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
add esp, 0x6c
ret
lea eax, [esp + 0x7c]
mov dword [esp + 0x7c], 0
push eax
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x404b4b
mov ecx, dword [esp + 0x80]
pop edi
pop esi
pop ebp
mov byte [ecx], al
add esp, 0x6c
ret
push edi
call fcn.0040a5c5
add esp, 4
mov esi, eax
push esi
push edi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0x41a658
push esi
mov dword [esp + 0x1c], 0
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [esp + 0x10]
push 0x34
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.0040a290
mov eax, dword [esp + 0x2c]
add esp, 0xc
mov ecx, eax
and ecx, 0xffff
shr eax, 0x10
push ecx
push eax
mov eax, dword [esp + 0x24]
mov edx, eax
and edx, 0xffff
shr eax, 0x10
push edx
push eax
mov eax, dword [esp + 0x90]
push str._d._d._d._d
push eax
call fcn.00409b2c
push esi
call fcn.0040a19f
add esp, 0x1c
pop edi
pop esi
pop ebp
add esp, 0x6c
ret
Function at 0x405150
Capabilities:
Create service
Persist via windows service

Disassembly:
sub esp, 0x2c
push ebp
push esi
push edi
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
jne 0x405187
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager___failed___d__n
call fcn.0040a730
add esp, 8
xor al, al
pop edi
pop esi
pop ebp
add esp, 0x2c
ret 0xc
mov eax, dword [esp + 0x44]
push 0
mov esi, dword [esp + 0x44]
push 0
mov ecx, dword [esp + 0x44]
push 0
push 0
push 0
push eax
push 0
push 2
push 0x10
push 0xf01ff
push esi
push ecx
push ebp
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edi, eax
test edi, edi
jne 0x4051ca
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x2c
ret 0xc
push esi
push str.Service___s__is_installed_n
call fcn.0040a730
add esp, 8
xor edx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], edx
lea eax, [esp + 0x24]
mov dword [esp + 0x18], edx
mov ecx, 3
mov dword [esp + 0x1c], edx
mov dword [eax - 4], 1
mov dword [eax], 0xea60
add eax, 8
dec ecx
jne 0x4051fb
lea eax, [esp + 0x20]
push str.ADVAPI32
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x405250
push str.ChangeServiceConfig2A
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x405249
lea ecx, [esp + 0xc]
push ecx
push 2
push edi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push ebp
call esi
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x2c
ret 0xc
Function at 0x405270
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
sub esp, 0x1c
push ebp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
jne 0x4052aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager___failed___d__
call fcn.0040a730
add esp, 8
xor al, al
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 4
mov esi, dword [esp + 0x2c]
push 0xf01ff
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x4052e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.OpenService_____s__failed___d__n
call fcn.0040a730
add esp, 0xc
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x1c
ret 4
lea eax, [esp + 0xc]
push ebx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x405313
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.QueryServiceStatus_____s__failed___d__n
call fcn.0040a730
add esp, 0xc
jmp 0x4053cd
mov eax, dword [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 1
je 0x405360
push esi
push str.Service___s__stopping..._n
call fcn.0040a730
add esp, 8
lea ecx, [esp + 0x10]
push ecx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x405355
call ebx
push eax
push esi
push str.ControlService_____s__failed___d__n
call fcn.0040a730
add esp, 0xc
jmp 0x405360
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x10]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x405383
call ebx
push eax
push esi
push str.QueryServiceStatus_____s__failed___d__n
call fcn.0040a730
add esp, 0xc
jmp 0x4053cd
mov eax, dword [esp + 0x14]
push esi
cmp eax, 1
jne 0x4053c0
push str.Service___s__stopped_n
call fcn.0040a730
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x4053ad
push esi
push str.Service___s__removed_n
jmp 0x4053c5
call ebx
push eax
push esi
push str.DeleteService_____s__failed___d__n
call fcn.0040a730
add esp, 0xc
jmp 0x4053cd
push str.Couldnt_stop_service___s__n
call fcn.0040a730
add esp, 8
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push ebp
call esi
pop ebx
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x1c
ret 4

Function at 0x4053f0
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x405404
mov eax, dword [esp + 8]
mov dword [eax + 4], esi
mov al, 1
pop esi
ret
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
je 0x40541a
mov ecx, dword [esp + 8]
pop esi
mov dword [ecx + 4], eax
mov al, 1
ret
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x405428
xor al, al
pop esi
ret
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 8]
push edi
mov esi, dword [edx]
mov edx, ecx
lea edi, [eax + 4]
mov al, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
Function at 0x405b40
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x1a8
test eax, eax
push esi
push edi
mov esi, ecx
je 0x405cc1
mov edi, dword [esp + 0x1b8]
test edi, edi
je 0x405cc1
lea eax, [esp + 0x20]
push eax
push 2
call sub.WS2_32.dll_WSAStartup
cmp eax, 0xffffffff
jne 0x405b86
push str.WSAStartUp___fail
call sub.WS2_32.dll_WSAGetLastError
push eax
jmp 0x405ccb
push 0
push 1
push 2
call sub.WS2_32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0x18c], eax
jne 0x405bac
push str.socket___fail
call sub.WS2_32.dll_WSAGetLastError
push eax
jmp 0x405ccb
mov ecx, dword [esp + 0x1b4]
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.004053f0
add esp, 8
test al, al
jne 0x405bf5
mov eax, dword [esp + 0x1b4]
push eax
push str.Host__s_not_found
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CTermEngine.CreateServer
push 0xa
call fcn.00408890
add esp, 0x14
xor al, al
pop edi
pop esi
add esp, 0x1a8
ret 8
push edi
mov word [esp + 0x14], 2
call sub.WS2_32.dll_htons
mov edx, dword [esi + 0x18c]
lea ecx, [esp + 0x10]
push 0x10
push ecx
push edx
mov word [esp + 0x1e], ax
call sub.WS2_32.dll_bind
cmp eax, 0xffffffff
jne 0x405c2f
push str.bind___fail
call sub.WS2_32.dll_WSAGetLastError
push eax
jmp 0x405ccb
mov eax, dword [esi + 0x18c]
push 0xa
push eax
call sub.WS2_32.dll_listen
cmp eax, 0xffffffff
jne 0x405c4f
push str.listen___fail
call sub.WS2_32.dll_WSAGetLastError
push eax
jmp 0x405ccb
mov edx, dword [esi + 0x18c]
lea ecx, [esp + 0xc]
push 4
push ecx
push 1
push 6
push edx
mov dword [esp + 0x20], 1
call sub.WS2_32.dll_setsockopt
mov ecx, dword [esi + 0x18c]
lea eax, [esp + 8]
push 4
push eax
push 0x80
push 6
mov word [esp + 0x1a], 0
push ecx
mov word [esp + 0x1c], 1
mov word [esp + 0x1e], 2
call sub.WS2_32.dll_setsockopt
push edi
push str.Server_is_listening_at_port__d
push 0
push str.CTermEngine.CreateServer
push 0x14
call fcn.00408890
add esp, 0x14
mov al, 1
pop edi
pop esi
add esp, 0x1a8
ret 8
push str.Invalid_input
push 0x4e23
push str.CTermEngine.CreateServer
push 0xa
call fcn.00408890
add esp, 0x10
xor al, al
pop edi
pop esi
add esp, 0x1a8
ret 8
Function at 0x406d70
Capabilities:
Create process on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x54
test edx, edx
je 0x406e10
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push 0
push 0x8000200
push 0
push 0
push 0
push edx
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
jne 0x406ddb
push str.CreateProcess___fail
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CTermEngine.Fork
push 0xa
call fcn.00408890
add esp, 0x10
add esp, 0x54
ret
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x64]
test eax, eax
je 0x406df4
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov eax, dword [esp + 0x60]
test eax, eax
je 0x406e02
mov edx, dword [esp + 8]
mov dword [eax], edx
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x406e10
mov ecx, dword [esp]
mov dword [eax], ecx
add esp, 0x54
ret
Function at 0x4075f0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x110
push esi
mov esi, dword [esp + 0x118]
test esi, esi
je 0x4076c7
mov eax, dword [esi + 4]
push eax
push str.Application__d_Stop...
push 0
push str.CTermEngine.TerminateApp
push 0x14
call fcn.00408890
add esp, 0x14
lea ecx, [esp + 0x10]
push str.Terminal.ini
push 0x41e264
push str._s.._s
push ecx
call fcn.00409b2c
mov edx, dword [esi + 4]
add esp, 0x10
lea eax, [esp + 4]
push edx
push 0x41b008
push eax
call fcn.00409b2c
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push str.Clear___s__at_Terminal.ini
push 0
push str.CTermEngine.TerminateApp
push 0x14
call fcn.00408890
add esp, 0x14
lea edx, [esp + 0x10]
lea eax, [esp + 4]
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
mov ecx, dword [esi]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [esi + 8]
push 0x4e31
push edx
call fcn.00405470
mov eax, dword [esi]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 8]
push ecx
call fcn.00405450
add esp, 4
push esi
push str.APPINFO_object__x_destroyed
push 0
push str.CTermEngine.TerminateApp
push 0x1e
call fcn.00408890
add esp, 0x14
pop esi
add esp, 0x110
ret 4
Function at 0x407ec0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x110
push ebx
push esi
mov esi, dword [esp + 0x11c]
push edi
cmp esi, 0xffffffff
jne 0x407ee1
or eax, esi
pop edi
pop esi
pop ebx
add esp, 0x110
ret
mov ebx, dword [esp + 0x128]
test ebx, ebx
jg 0x407ef9
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x110
ret
mov edi, dword [esp + 0x12c]
mov dword [esp + 0xc], 0
test edi, edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 1
jl 0x407f63
mov eax, 0x10624dd3
mov ecx, 0x3e8
imul edi
sar edx, 6
mov eax, edx
mov dword [esp + 0x14], 0
shr eax, 0x1f
add edx, eax
mov eax, edi
mov dword [esp + 0x10], edx
cdq
idiv ecx
lea ecx, [esp + 0x18]
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
lea eax, [esp + 0x10]
shl edx, 3
push eax
mov dword [esp + 0x18], edx
push 0
push 0
lea edx, [esi + 1]
push ecx
push edx
jmp 0x407f72
push 0
push 0
lea eax, [esp + 0x20]
push 0
lea ecx, [esi + 1]
push eax
push ecx
call sub.WS2_32.dll_select
test eax, eax
je 0x407fc0
cmp eax, 0xffffffff
je 0x407fde
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x124]
push 0
add edx, eax
push ebx
push edx
push esi
call sub.WS2_32.dll_recv
test eax, eax
je 0x407fcf
cmp eax, 0xffffffff
je 0x407fde
mov ecx, dword [esp + 0xc]
sub ebx, eax
add ecx, eax
test ebx, ebx
mov dword [esp + 0xc], ecx
jg 0x407f08
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
pop edi
pop esi
mov eax, 0x5b4
pop ebx
add esp, 0x110
ret
pop edi
pop esi
mov eax, 0x2746
pop ebx
add esp, 0x110
ret
call sub.WS2_32.dll_WSAGetLastError
pop edi
pop esi
pop ebx
add esp, 0x110
ret
Function at 0x408350
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
cmp ebp, 0xffffffff
push edi
jne 0x408373
pop edi
or eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov eax, dword [esp + 0x128]
test eax, eax
jne 0x40838c
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x110
ret
mov edi, dword [esp + 0x12c]
test edi, edi
jg 0x4083a5
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x110
ret
lea eax, [edi + 0xb]
push eax
mov dword [esp + 0x14], eax
call fcn.0040a5c5
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4083cb
pop edi
pop esi
pop ebp
mov eax, 0x4e22
pop ebx
add esp, 0x110
ret
mov al, 0xff
xor esi, esi
mov byte [ebx], al
mov byte [ebx + 1], al
mov byte [ebx + 2], al
xor eax, eax
test edi, edi
mov dword [ebx + 3], edi
jle 0x4083f3
mov edx, dword [esp + 0x128]
xor ecx, ecx
mov cl, byte [eax + edx]
add esi, ecx
inc eax
cmp eax, edi
jl 0x4083e0
mov ecx, edi
mov dword [ebx + 7], esi
mov esi, dword [esp + 0x128]
mov eax, ecx
lea edi, [ebx + 0xb]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x10]
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
jne 0x408431
push ebx
or esi, 0xffffffff
call fcn.0040a19f
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
xor edi, edi
test eax, eax
jle 0x4084e4
mov esi, dword [esp + 0x130]
test esi, esi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], 1
jl 0x40849d
mov eax, 0x10624dd3
mov dword [esp + 0x18], 0
imul esi
sar edx, 6
mov ecx, edx
mov eax, esi
shr ecx, 0x1f
add edx, ecx
mov ecx, 0x3e8
mov dword [esp + 0x14], edx
cdq
idiv ecx
lea ecx, [esp + 0x1c]
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
lea eax, [esp + 0x14]
shl edx, 3
push eax
mov dword [esp + 0x1c], edx
push 0
push ecx
lea edx, [ebp + 1]
push 0
push edx
jmp 0x4084ac
push 0
lea eax, [esp + 0x20]
push 0
push eax
lea ecx, [ebp + 1]
push 0
push ecx
call sub.WS2_32.dll_select
test eax, eax
je 0x4084fa
cmp eax, 0xffffffff
je 0x408515
mov edx, dword [esp + 0x10]
push 0
sub edx, edi
lea eax, [edi + ebx]
push edx
push eax
push ebp
call sub.WS2_32.dll_send
test eax, eax
je 0x408515
cmp eax, 0xffffffff
je 0x408515
add edi, eax
mov eax, dword [esp + 0x10]
cmp edi, eax
jl 0x408442
push ebx
call fcn.0040a19f
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
push ebx
mov esi, 0x5b4
call fcn.0040a19f
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
call sub.WS2_32.dll_WSAGetLastError
mov esi, eax
test esi, esi
je 0x4084e4
push ebx
call fcn.0040a19f
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
Function at 0x408540
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x518
push ebx
mov ebx, dword [esp + 0x520]
push ebp
push esi
cmp ebx, 0xffffffff
push edi
jne 0x408563
pop edi
pop esi
or eax, ebx
pop ebp
pop ebx
add esp, 0x518
ret
mov eax, dword [esp + 0x530]
xor edi, edi
cmp eax, edi
jne 0x40857e
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x518
ret
push eax
call fcn.004170c5
push eax
call fcn.0041703b
add esp, 8
cmp eax, edi
je 0x40873b
mov ecx, dword [esp + 0x534]
cmp ecx, edi
jle 0x4085a4
cmp ecx, eax
jle 0x4085ab
mov dword [esp + 0x534], eax
mov ebp, dword [esp + 0x534]
mov esi, dword [esp + 0x538]
mov al, 0xff
mov dword [esp + 0x1b], ebp
mov byte [esp + 0x18], al
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], al
mov dword [esp + 0x1f], edi
test esi, esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], 1
jl 0x40862a
mov eax, 0x10624dd3
mov ecx, 0x3e8
imul esi
sar edx, 6
mov eax, edx
mov dword [esp + 0x14], 0
shr eax, 0x1f
add edx, eax
mov eax, esi
mov dword [esp + 0x10], edx
cdq
idiv ecx
lea ecx, [esp + 0x24]
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
lea eax, [esp + 0x10]
shl edx, 3
push eax
mov dword [esp + 0x18], edx
push 0
push ecx
lea edx, [ebx + 1]
push 0
push edx
jmp 0x408639
push 0
lea eax, [esp + 0x28]
push 0
push eax
lea ecx, [ebx + 1]
push 0
push ecx
call sub.WS2_32.dll_select
test eax, eax
je 0x408672
cmp eax, 0xffffffff
je 0x408682
mov edx, 0xb
push 0
sub edx, edi
lea eax, [esp + edi + 0x1c]
push edx
push eax
push ebx
call sub.WS2_32.dll_send
test eax, eax
je 0x408682
cmp eax, 0xffffffff
je 0x408682
add edi, eax
cmp edi, 0xb
jl 0x4085cf
jmp 0x40868f
pop edi
pop esi
pop ebp
mov eax, 0x5b4
pop ebx
add esp, 0x518
ret
call sub.WS2_32.dll_WSAGetLastError
test eax, eax
jne 0x40873d
test ebp, ebp
mov dword [esp + 0x10], 0
jle 0x40873b
mov ecx, dword [esp + 0x530]
lea edx, [esp + 0x128]
push ecx
push 0x400
push 1
push edx
call fcn.00409c4c
mov edi, eax
add esp, 0x10
test edi, edi
je 0x40873b
xor esi, esi
test edi, edi
jle 0x408722
lea ebp, [ebx + 1]
push 0
lea eax, [esp + 0x28]
push 0
push eax
push 0
push ebp
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], 1
call sub.WS2_32.dll_select
test eax, eax
je 0x40873b
cmp eax, 0xffffffff
je 0x408719
mov ecx, edi
push 0
sub ecx, esi
lea edx, [esp + esi + 0x12c]
push ecx
push edx
push ebx
call sub.WS2_32.dll_send
test eax, eax
je 0x408719
cmp eax, 0xffffffff
je 0x408719
add esi, eax
cmp esi, edi
jl 0x4086cd
jmp 0x408722
call sub.WS2_32.dll_WSAGetLastError
test eax, eax
jne 0x40873b
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x534]
add eax, edi
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x40869f
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x518
ret