joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4141a0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x446800
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45aee0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
xor ebp, ebp
push ebp
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebp
jl 0x4142ee
mov ecx, edi
call fcn.00411300
mov eax, dword [edi]
mov ecx, dword [eax + 0x20]
push ebp
push 1
push 0x64
push edi
call ecx
lea edx, [esp + 0x1c]
push edx
push 0x20006
push ebp
push str.AppID
push SysReAllocString
mov dword [esp + 0x30], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x4142ee
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov ebx, dword [esp + 0x1c]
push 0x20006
push str.BAA898A6_84FB_4A5A_BBA3_F368FDA91B56
push ebx
lea ecx, [esp + 0x2c]
call fcn.00410940
mov esi, eax
cmp esi, ebp
je 0x41425a
mov eax, dword [esp + 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebp
je 0x41424c
push eax
call edi
cmp ebx, ebp
je 0x414253
push ebx
call edi
mov eax, esi
jmp 0x4142ee
mov esi, dword [esp + 0x20]
push str.LocalService
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [esp + 0x3c], ebp
je 0x4142c1
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x44c2ac
call ebx
inc eax
add eax, eax
push eax
push 0x44c2ac
push 1
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.LocalService
push esi
call ebp
push str._Service
call ebx
inc eax
lea ecx, [eax + eax]
push ecx
push str._Service
push 1
push 0
push str.ServiceParameters
push esi
call ebp
mov ecx, edi
call fcn.00411200
mov ebx, dword [esp + 0x1c]
xor ebp, ebp
mov edx, dword [esp + 0x38]
push ebp
push edx
mov ecx, edi
call fcn.00414080
mov edi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp esi, ebp
je 0x4142e1
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, ebp
je 0x4142ec
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
Function at 0x414370
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x224
mov eax, dword [0x45aee0]
xor eax, esp
mov dword [esp + 0x220], eax
push ebp
push esi
mov esi, dword [esp + 0x230]
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x44bd34
push 0x64
push esi
push 0x22681f8
mov ecx, 0x2268220
mov edi, eax
call fcn.00411140
mov eax, dword [0x44c374]
mov cx, word [0x44c378]
lea edx, [esp + 0x1c]
push edx
push edi
mov dword [0x2268478], 1
mov dword [esp + 0x24], eax
mov word [esp + 0x28], cx
call fcn.004110f0
mov esi, eax
xor ebp, ebp
add esp, 8
cmp esi, ebp
je 0x414428
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.UnregServer
push esi
call edi
test eax, eax
je 0x41446a
push str.RegServer
push esi
call edi
test eax, eax
je 0x4144b1
push str.Service
push esi
call edi
test eax, eax
je 0x4144c3
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.004110f0
mov esi, eax
add esp, 8
cmp esi, ebp
jne 0x4143e8
push 0x20019
push str.AppID
push SysReAllocString
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call fcn.00410940
mov esi, eax
cmp esi, ebp
je 0x4144d6
mov eax, dword [esp + 0xc]
cmp eax, ebp
je 0x414558
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x414558
push ebp
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebp
jl 0x41455a
mov ecx, dword [0x2268220]
mov edx, dword [ecx + 0x20]
push ebp
push ebp
push 0x64
push 0x2268220
call edx
mov ecx, 0x2268220
call fcn.00411300
push ebp
push 1
mov ecx, 0x2268220
call fcn.00414110
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x41455a
push ebp
push 1
mov ecx, 0x2268220
call fcn.004141a0
jmp 0x41455a
push 1
push 1
mov ecx, 0x2268220
call fcn.004141a0
jmp 0x41455a
push ebx
mov ebx, dword [esp + 0x10]
push 0x20019
push str.BAA898A6_84FB_4A5A_BBA3_F368FDA91B56
push ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call fcn.00410940
cmp eax, ebp
jne 0x41451b
lea eax, [esp + 0x10]
push eax
push str.LocalService
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0x104
call fcn.004109a0
mov dword [0x2268478], ebp
cmp eax, ebp
jne 0x41452f
mov dword [0x2268478], 1
mov ecx, 0x2268220
call fcn.00414310
mov eax, dword [esp + 0x18]
mov esi, dword [0x2268464]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebp
je 0x414550
push eax
call edi
cmp ebx, ebp
je 0x414557
push ebx
call edi
pop ebx
mov eax, esi
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0041c2ed
add esp, 0x224
ret 0x10
Function at 0x414580
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x446830
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x45aee0]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x410]
mov edi, dword [ebp + 0x414]
mov ebx, dword [ebp + 0x418]
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp], edx
push 2
push edx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x20], esi
test esi, esi
jne 0x414602
call fcn.004107f0
mov edi, eax
jmp 0x4146ec
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x41461b
call fcn.004107f0
jmp 0x4146e3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jne 0x414636
call fcn.004107f0
jmp 0x4146e3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x14], edi
cmp eax, edi
jae 0x41466c
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x41465a
lea ecx, [ebp]
call fcn.00412140
lea ecx, [ebp - 0x18]
call fcn.004114b0
mov eax, 0x8007000e
jmp 0x414702
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.00413180
mov dword [ebp - 4], 1
jmp 0x4146a0
mov eax, dword [ebp]
test eax, eax
jne 0x4146ae
mov edi, 0x8007000e
jmp 0x4146e5
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x4146c7
call fcn.004107f0
jmp 0x4146e3
mov edx, dword [ebp]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x41c]
mov ecx, dword [ebp]
push eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.00413f30
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp + 4]
cmp dword [ebp], edx
je 0x414700
lea ecx, [ebp]
call fcn.00412140
lea esp, [esp]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0041c2ed
add ebp, 0x408
mov esp, ebp
pop ebp
ret 0x10
Function at 0x418030
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x446ac8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x45aee0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x3c]
push eax
lea ecx, [esp + 0x10]
call fcn.0043e710
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, esi
mov dword [esp + 0x20], 0
call fcn.004166f0
test eax, eax
je 0x4180bb
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push ecx
push edx
mov ecx, eax
call fcn.00414df0
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x1c], 0xffffffff
call fcn.0043e740
mov al, bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret 0x10
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0043e740
xor al, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret 0x10
Function at 0x418900
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x447808
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45aee0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
mov esi, dword [esp + 0x30]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x418934
mov edi, dword [esp + 0x34]
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
cmp eax, edi
jae 0x418a45
mov eax, esi
lea edx, [eax + 2]
jmp 0x418960
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x418960
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
mov edx, 0xfffffffe
sub edx, ecx
mov eax, esi
add edi, edx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x418980
sub eax, edx
sar eax, 1
lea ecx, [esi + eax*2 + 2]
xor ebx, ebx
mov ebp, ecx
test edi, edi
je 0x418a01
jmp 0x4189a0
mov eax, ecx
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4189a5
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
cmp eax, edi
ja 0x418a45
mov eax, ecx
inc ebx
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4189c6
sub eax, esi
sar eax, 1
lea edx, [eax + eax]
mov eax, 0xfffffffe
sub eax, edx
add edi, eax
mov eax, ecx
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4189e6
sub eax, esi
sar eax, 1
lea ecx, [ecx + eax*2 + 2]
test edi, edi
jne 0x4189a0
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x14]
lea ecx, [edi + 0x3c]
push ecx
lea ecx, [esp + 0x18]
call fcn.0043e710
mov edx, dword [esp + 0x2c]
push edx
mov ecx, edi
mov dword [esp + 0x28], 0
call fcn.004166f0
test eax, eax
je 0x418a34
push ebp
push ebx
push esi
mov ecx, eax
call fcn.00415180
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0xffffffff
call fcn.0043e740
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x41c2ed
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45aee0]
jne 0x41c2f7
repz ret
jmp fcn.004217ec

Function at 0x42b877
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042038b
and dword [ebp - 4], 0
cmp dword [0x2269008], 0
mov ebx, eax
jne 0x42b928
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42b9d9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42b9d9
push eax
call fcn.00420319
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x2269008], eax
call esi
push eax
call fcn.00420319
mov dword [esp], 0x44d03c
push edi
mov dword [0x226900c], eax
call esi
push eax
call fcn.00420319
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x2269010], eax
call esi
push eax
call fcn.00420319
pop ecx
mov dword [0x2269018], eax
test eax, eax
je 0x42b928
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00420319
pop ecx
mov dword [0x2269014], eax
mov eax, dword [0x2269014]
cmp eax, ebx
je 0x42b980
cmp dword [0x2269018], ebx
je 0x42b980
push eax
call fcn.00420394
push dword [0x2269018]
mov esi, eax
call fcn.00420394
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42b980
test edi, edi
je 0x42b980
call esi
test eax, eax
je 0x42b977
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42b977
test byte [ebp - 0xc], 1
jne 0x42b980
or dword [ebp + 0x10], 0x200000
jmp 0x42b9b9
mov eax, dword [0x226900c]
cmp eax, ebx
je 0x42b9b9
push eax
call fcn.00420394
pop ecx
test eax, eax
je 0x42b9b9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42b9b9
mov eax, dword [0x2269010]
cmp eax, ebx
je 0x42b9b9
push eax
call fcn.00420394
pop ecx
test eax, eax
je 0x42b9b9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x2269008]
call fcn.00420394
pop ecx
test eax, eax
je 0x42b9d9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42b9db
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43e660
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x43e686
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x43e610
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
test eax, eax
je 0x43e690
mov ecx, dword [esi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
cmp dword [esi + 8], eax
pop esi
setne al
ret

Function at 0x43e960
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x43e9b2
cmp eax, 0xffffffff
je 0x43e9b2
mov ecx, 1
push 4
mov word [esp + 8], cx
lea ecx, [esp + 8]
push ecx
push 0x80
push 0xffff
xor edx, edx
push eax
mov word [esp + 0x1a], dx
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov edx, dword [esi]
push 2
push edx
call dword [sym.imp.WSOCK32.dll_shutdown]
mov eax, dword [esi]
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
mov dword [esi], 0
pop esi
pop ecx
ret
Function at 0x43e9c0
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x43e9ce
mov al, 1
pop esi
ret 4
mov eax, dword [esp + 8]
push 0
push eax
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
setne al
pop esi
ret 4

Function at 0x43ea02
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
mov eax, dword [0x45aee0]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push esi
mov esi, ecx
pxor xmm0, xmm0
mov ecx, 2
movq qword [esp + 4], xmm0
movq qword [esp + 0xc], xmm0
mov word [esp + 4], cx
test eax, eax
jne 0x43ea2c
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
jmp 0x43ea33
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov edx, dword [esp + 0x20]
push edx
mov dword [esp + 0xc], eax
call dword [sym.imp.WSOCK32.dll_htons]
mov word [esp + 6], ax
mov eax, dword [esi]
pop esi
test eax, eax
jne 0x43ea61
xor al, al
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041c2ed
add esp, 0x14
ret 8
push 0x10
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.WSOCK32.dll_bind]
mov ecx, dword [esp + 0x10]
cmp eax, 0xffffffff
setne al
xor ecx, esp
call fcn.0041c2ed
add esp, 0x14
ret 8

Function at 0x43eaf0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x43eb3d
mov ecx, 1
push 4
mov word [esp + 8], cx
lea ecx, [esp + 8]
push ecx
push 0x80
push 0xffff
xor edx, edx
push eax
mov word [esp + 0x1a], dx
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov edx, dword [esi]
push 2
push edx
call dword [sym.imp.WSOCK32.dll_shutdown]
mov eax, dword [esi]
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
mov dword [esi], 0
pop esi
pop ecx
ret

Function at 0x43eb40
Capabilities:
Connect socket
Get socket status

Disassembly:
sub esp, 0x110
push ebx
push esi
push edi
mov edi, dword [sym.imp.WSOCK32.dll_ioctlsocket]
lea eax, [esp + 0xc]
push eax
mov esi, ecx
mov ecx, dword [esi]
push 0x8004667e
mov ebx, 1
push ecx
mov dword [esp + 0x18], ebx
call edi
mov edx, dword [esp + 0x120]
mov eax, dword [esi]
push 0x10
push edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
mov ecx, dword [esi]
push 0xfc
lea edx, [esp + 0x24]
push 0
push edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ecx
call fcn.0041ca00
mov eax, dword [esp + 0x130]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0
lea edx, [esp + 0x20]
push edx
push 0
push 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
call dword [sym.imp.WSOCK32.dll_select]
mov ecx, dword [esi]
mov ebx, eax
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push ecx
mov dword [esp + 0x18], 0
call edi
pop edi
xor eax, eax
test ebx, ebx
pop esi
setne al
pop ebx
add esp, 0x110
ret 8

Function at 0x43ebf0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43ec12
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x43ec12
push 0
push ecx
mov ecx, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
jne 0x43ec14
xor eax, eax
ret 8
Function at 0x43ec50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
mov eax, dword [ecx]
mov dword [esp], ecx
test eax, eax
jne 0x43ec5e
pop ecx
ret 8
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.WSOCK32.dll_recv]
push esi
push edi
mov edi, dword [esp + 0x1c]
push 0
push edi
push ebx
push eax
call ebp
mov esi, eax
inc esi
neg esi
sbb esi, esi
and esi, eax
je 0x43ecb5
cmp esi, edi
jge 0x43ecb5
sub edi, esi
test edi, edi
jle 0x43ecb5
lea esp, [esp]
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
test eax, eax
je 0x43ecb5
push 0
push edi
lea ecx, [esi + ebx]
push ecx
push eax
call ebp
cmp eax, 0xffffffff
je 0x43ecb5
test eax, eax
jle 0x43ecb5
sub edi, eax
add esi, eax
test edi, edi
jg 0x43ec90
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x440650
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
push ebx
push ebp
mov ebx, ecx
push esi
lea ecx, [ebx + 0x328]
push edi
mov dword [esp + 0x10], 0x64
mov dword [esp + 0x1c], ecx
call fcn.00442bc0
mov eax, dword [ebx + 0x398]
mov eax, dword [eax]
mov esi, dword [ebx + 0x380]
mov ebp, eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ebp
mov edi, dword [ebx + 0x398]
mov eax, dword [ebx + 0x380]
test esi, esi
je 0x4406a5
cmp esi, eax
je 0x4406aa
call fcn.0041e312
cmp ebp, edi
je 0x44075a
test esi, esi
jne 0x440734
call fcn.0041e312
cmp ebp, dword [esi + 0x18]
jne 0x4406c5
call fcn.0041e312
mov esi, dword [ebp + 0x18]
xor eax, eax
cmp esi, eax
je 0x440744
mov edi, dword [esi]
lea ecx, [esp + 0x20]
push ecx
push eax
push eax
lea edx, [esp + 0x34]
push edx
push 2
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], 1
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call dword [sym.imp.WSOCK32.dll_select]
test eax, eax
jle 0x440744
lea eax, [esp + 0x28]
push eax
push edi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x440744
mov ecx, esi
call fcn.00442640
cmp eax, 0xffffffff
jne 0x440738
mov ecx, esi
call fcn.004425d0
lea ecx, [esp + 0x14]
call fcn.00440280
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
jmp 0x440691
mov esi, dword [esi]
jmp 0x4406bb
test eax, eax
je 0x440744
mov dword [esp + 0x10], 0
lea ecx, [esp + 0x14]
call fcn.00440280
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
jmp 0x440691
mov ecx, dword [esp + 0x1c]
call fcn.00442c00
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x440770
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
push ebx
push ebp
mov ebx, ecx
push esi
lea ecx, [ebx + 0x328]
push edi
mov dword [esp + 0x10], 0x64
mov dword [esp + 0x1c], ecx
call fcn.00442bc0
mov eax, dword [ebx + 0x398]
mov eax, dword [eax]
mov esi, dword [ebx + 0x380]
mov ebp, eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ebp
mov edi, dword [ebx + 0x398]
mov eax, dword [ebx + 0x380]
test esi, esi
je 0x4407c5
cmp esi, eax
je 0x4407ca
call fcn.0041e312
cmp ebp, edi
je 0x44087a
test esi, esi
jne 0x440854
call fcn.0041e312
cmp ebp, dword [esi + 0x18]
jne 0x4407e5
call fcn.0041e312
mov esi, dword [ebp + 0x18]
xor eax, eax
cmp esi, eax
je 0x440864
mov edi, dword [esi]
lea ecx, [esp + 0x20]
push ecx
push eax
lea edx, [esp + 0x30]
push edx
push eax
push 2
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], 1
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call dword [sym.imp.WSOCK32.dll_select]
test eax, eax
jle 0x440864
lea eax, [esp + 0x28]
push eax
push edi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x440864
mov ecx, esi
call fcn.00442830
cmp eax, 0xffffffff
jne 0x440858
mov ecx, esi
call fcn.004425d0
lea ecx, [esp + 0x14]
call fcn.00440280
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
jmp 0x4407b1
mov esi, dword [esi]
jmp 0x4407db
test eax, eax
je 0x440864
mov dword [esp + 0x10], 0
lea ecx, [esp + 0x14]
call fcn.00440280
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
jmp 0x4407b1
mov ecx, dword [esp + 0x1c]
call fcn.00442c00
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x442a50
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x442a91
mov eax, dword [esp + 8]
push 0
push eax
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x442a74
xor al, al
pop esi
ret 4
cmp byte [esi + 4], 0
push 1
lea edx, [esp + 0xc]
push edx
push 1
push 6
setne cl
push eax
mov byte [esp + 0x1c], cl
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov al, 1
pop esi
ret 4

Function at 0x442aa0
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x1124]
test eax, eax
je 0x442ac0
push eax
call fcn.0041c358
add esp, 4
mov dword [esi + 0x1124], 0
mov dword [esi + 0x1138], 1
mov ecx, esi
pop esi
jmp fcn.0043e960
Function at 0x4439e0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
push ebx
push ebp
push esi
push edi
mov ebp, ecx
lea ecx, [ebp + 0x24]
mov byte [esp + 0x13], 0
mov dword [esp + 0x1c], ecx
call fcn.0043e6e0
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
mov esi, dword [ebp + 4]
mov ebx, eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ebx
mov edi, dword [ebp + 0x1c]
mov eax, dword [ebp + 4]
test esi, esi
je 0x443a23
cmp esi, eax
je 0x443a28
call fcn.0041e312
cmp ebx, edi
je 0x443ac1
test esi, esi
jne 0x443aba
call fcn.0041e312
cmp ebx, dword [esi + 0x18]
jne 0x443a47
call fcn.0041e312
mov esi, dword [ebx + 0x10]
test esi, esi
je 0x443aa4
mov edx, dword [esi]
mov eax, dword [edx + 0x48]
mov ecx, esi
call eax
mov edi, eax
xor eax, eax
lea ecx, [esp + 0x20]
push ecx
push eax
push eax
lea edx, [esp + 0x34]
push edx
push 2
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], 1
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call dword [sym.imp.WSOCK32.dll_select]
test eax, eax
jle 0x443aa4
lea eax, [esp + 0x28]
push eax
push edi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x443aa4
mov edx, dword [esi]
mov eax, dword [edx + 0x34]
mov ecx, esi
call eax
mov byte [esp + 0x13], 1
lea ecx, [esp + 0x14]
call fcn.00416200
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
jmp 0x443a15
mov esi, dword [esi]
jmp 0x443a3d
mov ecx, dword [esp + 0x1c]
call fcn.0043e6f0
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x443c70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x45aee0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, 2
xor ecx, ecx
lea edx, [esp + 0x1c]
mov word [esp + 0x1c], ax
push edx
lea eax, [esp + 0x14]
mov word [esp + 0x22], cx
xor esi, esi
lea ecx, [edi + 0x10]
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x18], esi
call fcn.0043eab0
test al, al
je 0x443d79
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x20], 1
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x443cf1
lea ecx, [esp + 0x10]
call fcn.0043eaf0
jmp 0x443d51
push 0x18
call fcn.0041e3ba
add esp, 4
cmp eax, esi
je 0x443d51
mov dword [eax + 4], esi
mov dword [eax + 0xc], esi
xor edx, edx
mov word [eax + 0xa], dx
mov ecx, 2
mov word [eax + 8], cx
mov ecx, dword [edi + 0x14]
mov dword [eax], ecx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push esi
push eax
push 0x443be0
mov dword [eax + 4], edx
movq xmm0, qword [esp + 0x2c]
movq qword [eax + 8], xmm0
movq xmm0, qword [esp + 0x34]
push esi
push esi
movq qword [eax + 0x10], xmm0
call ebx
cmp eax, esi
je 0x443d5b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xa
call fcn.0043ecd0
add esp, 4
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [edi + 0x10]
mov dword [esp + 0x18], esi
call fcn.0043eab0
test al, al
jne 0x443cc4
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c2ed
mov esp, ebp
pop ebp
ret