joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42739c
Capabilities:
Start service

Disassembly:
mov eax, 0x48bac0
call fcn.004874e0
sub esp, 0x18
push esi
push 0xf01ff
add ecx, 4
call fcn.00435b75
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x4273e5
lea eax, [ebp - 0x18]
push str.The_Ammyy_service_could_not_be_found
push eax
call fcn.00430892
pop ecx
lea eax, [ebp - 0x18]
pop ecx
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x427436
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [ebp + 8]
push edi
push eax
call fcn.0040c8f4
push dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push edi
push str.ERROR__d___S__while_starting_the_AMMYY_service
push eax
call fcn.00430892
add esp, 0x18
lea eax, [ebp - 0x24]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
pop edi
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4277e7
Capabilities:
Delete service
Query service status
Start service

Disassembly:
mov eax, 0x48bb50
call fcn.004874e0
sub esp, 0xa8
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ebx
jge 0x427827
lea eax, [ebp - 0x54]
push str.JustLunch___Invalid_Session
push eax
call fcn.00430892
pop ecx
lea eax, [ebp - 0x54]
pop ecx
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x427861
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x6c]
push str.OpenSCManager___error__d
push eax
call fcn.00430892
add esp, 0xc
lea eax, [ebp - 0x6c]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
push 1
push eax
mov ecx, ebx
mov dword [ebp - 4], esi
call fcn.0042720a
jmp 0x42787b
push 2
mov ecx, ebx
pop edi
mov dword [ebp - 0x14], esi
push dword [ebp - 0x18]
mov dword [ebp - 4], edi
call fcn.00426fdc
lea ecx, [ebx + 4]
call fcn.00435b75
push 0xf01ff
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
mov dword [ebp - 0x14], esi
jne 0x4278d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x30]
push str.OpenService___error__d
push eax
call fcn.00430892
add esp, 0xc
lea eax, [ebp - 0x30]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
push dword [ebp + 8]
lea eax, [ebp - 0xb4]
push 0x4b70b0
push eax
call dword [sym.imp.MSVCRT.dll_swprintf]
lea eax, [ebp - 0xb4]
add esp, 0xc
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x427931
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x78]
push str.StartService___error__d
push eax
call fcn.00430892
add esp, 0xc
lea eax, [ebp - 0x78]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
lea eax, [ebp - 0x94]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x427969
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x3c]
push str.QueryServiceStatus___error__d
push eax
call fcn.00430892
add esp, 0xc
lea eax, [ebp - 0x3c]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
cmp dword [ebp - 0x90], 1
je 0x42797c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x427931
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4279ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x48]
push str.DeleteService___error__d
push eax
call fcn.00430892
add esp, 0xc
lea eax, [ebp - 0x48]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x18]
call esi
push 0
mov ecx, ebx
call fcn.00427158
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x42bcce
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
cmp dword [esi], 0xffffffff
je 0x42bcfa
lea eax, [ebp - 0xc]
push str.CreateInternal__1
push eax
call fcn.00430892
pop ecx
lea eax, [ebp - 0xc]
pop ecx
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x42bd33
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc]
push str.Error__d_socket__
push eax
call fcn.00430892
add esp, 0xc
lea eax, [ebp - 0xc]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
pop esi
leave
ret

Function at 0x42be4c
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
xor edx, edx
mov ecx, 0x3e8
push edi
div ecx
xor edi, edi
mov dword [ebp - 0x118], 1
mov dword [ebp - 8], eax
mov eax, dword [esi]
imul edx, edx, 0x3e8
mov dword [ebp - 0x114], eax
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x118]
push edi
push eax
push edi
mov dword [ebp - 4], edx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, edi
jne 0x42bea6
or eax, 0xffffffff
pop edi
pop esi
leave
ret 4
jle 0x42beef
lea eax, [ebp - 0x118]
push eax
push dword [esi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x42beef
push edi
push edi
push dword [esi]
call dword [sym.imp.WS2_32.dll_accept]
cmp eax, 0xffffffff
jne 0x42bea0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x14]
push str.accept___error_d
push eax
call fcn.00430892
add esp, 0xc
lea eax, [ebp - 0x14]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x14]
push str.select___error_d
push eax
call fcn.00430892
add esp, 0xc
lea eax, [ebp - 0x14]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException

Function at 0x42bf15
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0xc], eax
mov word [ebp - 0x10], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x10]
push 0x10
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
pop esi
je 0x42bf50
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
leave
ret 8
Function at 0x42bfa8
Capabilities:
Connect socket
Get socket status

Disassembly:
mov eax, 0x48c320
call fcn.004874e0
sub esp, 0x230
push ebx
push esi
push edi
lea ecx, [ebp - 0x10]
call fcn.0042bcc3
xor ebx, ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.0042bcce
push ebx
push dword [ebp - 0x10]
call fcn.0042ccf3
mov eax, dword [ebp + 8]
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
push dword [ebp + 0xc]
mov word [ebp - 0x34], 2
call dword [sym.imp.WS2_32.dll_htons]
mov edi, dword [ebp - 0x10]
mov word [ebp - 0x32], ax
lea eax, [ebp - 0x34]
push 0x10
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
xor esi, esi
inc esi
test eax, eax
je 0x42c0c9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x42c0de
mov eax, dword [ebp + 0x10]
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x18], eax
imul edx, edx, 0x3e8
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], edx
push eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x23c]
push eax
push ebx
push ebx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, ebx
jl 0x42c105
cmp eax, esi
jg 0x42c105
cmp eax, ebx
je 0x42c0fb
cmp eax, esi
jne 0x42c092
lea eax, [ebp - 0x138]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x42c0fb
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x42c0c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x24]
push str.select___error_d
push eax
call fcn.00430892
add esp, 0xc
lea eax, [ebp - 0x24]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
push esi
push dword [ebp - 0x10]
call fcn.0042ccf3
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
call fcn.0042bda5
mov ebx, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0042bcc9
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
lea ecx, [ebp - 0x10]
call fcn.0042bd36
jmp 0x42c0de
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x24]
push str.select___error_d
push eax
call fcn.00430892
add esp, 0xc
lea eax, [ebp - 0x24]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException

Function at 0x42c12b
Capabilities:
Set socket configuration

Disassembly:
push dword [esp + 4]
call fcn.0042c13a
pop ecx
jmp fcn.0042c184

Function at 0x42c13a
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
lea ecx, [ebp - 4]
inc eax
push 4
push ecx
push eax
push 6
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x42c182
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea eax, [ebp - 0x10]
push str.ERROR__d_disabling_Nagles_algorithm
push eax
call fcn.00430892
add esp, 0xc
lea eax, [ebp - 0x10]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
leave
ret
Function at 0x42c33d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
cmp dword [0x4c2978], 0
mov dword [ebp - 0x18], str.getaddrinfo
mov dword [ebp - 0x14], 0x42c4d6
mov dword [ebp - 0x10], str.getnameinfo
mov dword [ebp - 0xc], 0x42ca07
mov dword [ebp - 8], str.freeaddrinfo
mov dword [ebp - 4], fcn.0042c49a
jne 0x42c48b
push ebx
push esi
push edi
lea eax, [ebp - 0x22c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x42c47e
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x124]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x124]
push str.ws2_32
push eax
call sub.MSVCRT.dll_strcat
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x10
lea eax, [ebp - 0x124]
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x42c3f5
push str.getaddrinfo
push esi
call edi
test eax, eax
jne 0x42c3f1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
jne 0x42c444
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x124]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x124]
push str.wship6
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x124]
push eax
call ebx
mov esi, eax
test esi, esi
je 0x42c47e
push str.getaddrinfo
push esi
call edi
test eax, eax
jne 0x42c440
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x42c47e
xor ebx, ebx
push dword [ebp + ebx*8 - 0x18]
push esi
call edi
test eax, eax
mov dword [ebp + ebx*8 - 0x14], eax
je 0x42c45d
inc ebx
cmp ebx, 3
jl 0x42c446
jmp 0x42c466
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x42c47e
xor eax, eax
mov ecx, dword [ebp + eax - 0x14]
mov dword [eax + 0x4b74c8], ecx
add eax, 8
cmp eax, 0x18
jl 0x42c46c
pop edi
pop esi
mov dword [0x4c2978], 1
pop ebx
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x4b74c8]
leave
ret 4

Function at 0x42c920
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
push dword [ebp + 8]
and dword [edi], 0
and byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x42c99a
cmp word [ebx + 8], 2
jne 0x42c976
cmp word [ebx + 0xa], 4
jne 0x42c976
mov esi, dword [ebx + 0xc]
jmp 0x42c970
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042c7b9
test eax, eax
mov dword [edi], eax
je 0x42c995
lea edi, [eax + 0x1c]
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x42c954
mov esi, dword [ebp + 0x18]
push 0x400
push dword [ebx]
push esi
call dword [sym.imp.MSVCRT.dll_strncpy]
and byte [esi + 0x400], 0
add esp, 0xc
xor eax, eax
jmp 0x42c9c0
push 8
pop eax
jmp 0x42c9c0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov eax, 0x2af9
sub ecx, eax
je 0x42c9c0
dec ecx
je 0x42c9bb
dec ecx
je 0x42c9b4
dec ecx
jmp 0x42c9c0
mov eax, 0x2afb
jmp 0x42c9c0
mov eax, 0x2afa
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x42ccf3
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
cmp byte [ebp + 0xc], al
sete al
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push 0x8004667e
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x42cd43
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc]
push str.Error_d_in_SetBlockingMode__u_
push eax
call fcn.00430892
add esp, 0x10
lea eax, [ebp - 0xc]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
leave
ret

Function at 0x42cd45
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
push 4
cmp byte [ebp + 0xc], al
setne al
mov word [ebp + 0xc], ax
mov ax, word [ebp + 0x10]
mov word [ebp + 0xe], ax
lea eax, [ebp + 0xc]
push eax
push 0x80
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x42cda2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc]
push str.setsockopt_SO_LINGER___u
push eax
call fcn.00430892
add esp, 0xc
lea eax, [ebp - 0xc]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
leave
ret

Function at 0x42cda4
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push 4
push eax
push 0x1001
push 0xffff
mov dword [ebp - 4], 0x10000
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x42cdf4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x10]
push str.Error_d_setsockopt__
push eax
call fcn.00430892
add esp, 0xc
lea eax, [ebp - 0x10]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
leave
ret

Function at 0x42cdf6
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [ebp + 0x10]
push esi
mov esi, ecx
xor edx, edx
mov ecx, 0x3e8
mov dword [ebp - 0x11c], 1
div ecx
mov dword [ebp - 8], eax
mov eax, dword [esi]
imul edx, edx, 0x3e8
mov dword [ebp - 0x118], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0x11c]
push 0
push eax
push 0
mov dword [ebp - 4], edx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
mov dword [ebp + 0x10], eax
jl 0x42ce81
cmp eax, 1
jg 0x42ce81
lea eax, [ebp - 0x11c]
push eax
push dword [esi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x42ce7d
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x42ce78
or eax, 0xffffffff
pop esi
leave
ret 0xc
xor eax, eax
jmp 0x42ce78
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi]
push dword [ebp + 0x10]
push eax
push str.ERROR__d_in_TCP::TryRead__1__d_socket_X
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0042d3ef
add esp, 0x18
lea eax, [ebp - 0x18]
push 0x4a2784
push eax
call sub.MSVCRT.dll__CxxThrowException
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
push edi
call fcn.00406300
mov eax, dword [edi + 0xc]
mov dword [esi], 0x498990
mov dword [esi + 0xc], eax
mov eax, esi
pop edi
pop esi
ret 4
Function at 0x42d448
Capabilities:
Get socket status

Disassembly:
mov eax, 0x48c458
call fcn.004874e0
sub esp, 0x120
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x10]
lea eax, [esi + 0x3bc0]
push eax
call fcn.004315f1
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 4], ebx
jbe 0x42d48e
push edi
mov ecx, esi
push dword [ebp + 8]
call 0x42d540
lea eax, [esi + 0x3b88]
add dword [eax], edi
adc dword [eax + 4], ebx
cmp dword [ebp + 0x10], ebx
je 0x42d502
lea ecx, [esi + 0x3b98]
call fcn.004209ac
test eax, eax
jle 0x42d502
xor edi, edi
inc edi
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x128], eax
push ebx
push ecx
inc eax
push ebx
push eax
mov dword [ebp - 0x12c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, ebx
je 0x42d4a5
jl 0x42d51f
cmp eax, edi
jg 0x42d51f
lea eax, [ebp - 0x12c]
push eax
push dword [esi + 8]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x42d4f3
mov ecx, esi
call fcn.0042d5fe
lea ecx, [esi + 0x3b98]
call fcn.004209ac
test eax, eax
jg 0x42d4a5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00431605
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
push eax
push str.ERROR_in_TransportTCP::SendExact__1__d
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.0042d3ef
add esp, 0x10
lea eax, [ebp - 0x28]
push 0x4a2784
push eax
call sub.MSVCRT.dll__CxxThrowException
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
test eax, eax
mov esi, ecx
mov dword [ebp + 8], eax
jbe 0x42d599
push edi
and dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
push eax
lea ecx, [esi + 0x3b98]
push dword [ebp + 8]
call fcn.00420878
cmp byte [esi + 0x3b7d], 0
mov edi, eax
push edi
push ebx
push dword [ebp + 0xc]
je 0x42d585
lea ecx, [esi + 0xc]
call fcn.004301ed
jmp 0x42d58d
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [ebp + 8], edi
add ebx, edi
cmp dword [ebp + 8], 0
ja 0x42d555
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42d5fe
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [edi + 0x3b98]
call fcn.004209ac
mov ebx, eax
mov eax, 0x8000
cmp ebx, eax
jle 0x42d621
mov ebx, eax
test ebx, ebx
je 0x42d669
lea esi, [edi + 0x3ba8]
push ebx
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 4]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
lea esi, [edi + 0x3b98]
push ebx
push eax
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.0042096b
push 0
push ebx
push dword [ebp - 4]
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jle 0x42d66e
push edi
mov ecx, esi
call fcn.004208b6
pop edi
pop esi
pop ebx
leave
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test edi, edi
je 0x42d67f
cmp eax, 0x2733
je 0x42d669
push edi
push eax
push str.ERROR__d__d_in_TransportTCP::SendFromQueue__1
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0042d3ef
add esp, 0x14
lea eax, [ebp - 0x14]
push 0x4a2784
push eax
call sub.MSVCRT.dll__CxxThrowException
Function at 0x42d6a1
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
cmp dword [ecx + 0x13be0], 0
push esi
jbe 0x42d6bb
mov al, 1
pop esi
leave
ret 4
mov eax, dword [ebp + 8]
mov esi, dword [ecx + 8]
cdq
mov ecx, 0x3e8
mov dword [ebp - 0x118], esi
idiv ecx
mov dword [ebp - 0x11c], 1
imul edx, edx, 0x3e8
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0x11c]
push 0
push eax
lea eax, [esi + 1]
push eax
mov dword [ebp - 4], edx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jl 0x42d71c
cmp eax, 2
jg 0x42d71c
lea eax, [ebp - 0x11c]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
neg eax
sbb eax, eax
neg eax
jmp 0x42d6b6
push eax
push str.ERROR_in_TransportTCP::IsReadyForRead__1__d
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.0042d3ef
add esp, 0x10
lea eax, [ebp - 0x18]
push 0x4a2784
push eax
call sub.MSVCRT.dll__CxxThrowException
Function at 0x42db04
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x48c488
call fcn.004874e0
sub esp, 0x54
push ebx
push esi
push str.Elevate__
push 0x4c2700
call fcn.004319df
xor ebx, ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0040c503
add esp, 0x10
push str._elevated
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.004354bc
push 0x4c1edc
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
call fcn.00435674
add esp, 0xc
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.004353fc
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x60], 0x3c
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], str.runas
call fcn.00435b75
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x50], eax
call fcn.00435b75
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x40], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x42dbf4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x4c7
jne 0x42dbd2
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.004353fc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004353fc
xor al, al
jmp 0x42dc0d
call esi
push eax
lea eax, [ebp - 0x24]
push str.Error__d_in_Elevate__
push eax
call fcn.00430892
add esp, 0xc
lea eax, [ebp - 0x24]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.004353fc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004353fc
mov al, 1
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42dcf9
Capabilities:
Log keystrokes

Disassembly:
cmp dword [0x4c1ec8], 0x60000
push ebx
push esi
push edi
jae 0x42dd17
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x42ddb9
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push eax
call esi
push 0
mov edi, eax
push dword [esp + 0x14]
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov ebx, eax
push 1
push ebx
push edi
call esi
test eax, eax
jne 0x42dd57
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x42ddb2
push eax
push str.SetForegroundWindow__1_Error__d
jmp 0x42dda5
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x42dd73
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetForegroundWindow__2_Error__d
jmp 0x42dda5
push 0
push ebx
push edi
call esi
test eax, eax
jne 0x42dd8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetForegroundWindow__3_Error__d
jmp 0x42dda5
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetActiveWindow]
test eax, eax
jne 0x42ddb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetForegroundWindow__4_Error__d
push 0x4c2700
call fcn.004319c7
add esp, 0xc
xor eax, eax
jmp 0x42ddb9
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret