joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b3160
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d0d4d
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x100e1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x10109ae0]
mov edi, dword [esi + 0x174]
test edi, edi
setg byte [ebp - 0x14]
cmp dword [0x100e4d48], 4
jne 0x100b31c9
mov edx, dword [esi + 0x4cb0]
add edx, dword [esi + 0x4cac]
mov ecx, dword [0x10109a88]
push edx
push dword [esi + 0x4cb4]
mov eax, dword [ecx]
push dword [ebp - 0x14]
push edi
mov eax, dword [eax + 0xc]
call eax
cmp byte [0x1010eeb8], 0
jne 0x100b32ff
movaps xmm0, xmmword [0x100d7c00]
xor eax, eax
movaps xmm2, xmmword [0x100d79f0]
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x1c], 0x181d
movaps xmm0, xmmword [0x100d7d60]
movups xmmword [ebp - 0x2c], xmm0
mov byte [ebp - 0x1a], 0x5b
nop
movups xmm0, xmmword [ebp + eax - 0x3c]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x3c], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x100b3200
cmp eax, 0x23
jae 0x100b322b
nop dword [eax]
xor byte [ebp + eax - 0x3c], 0x5b
inc eax
cmp eax, 0x23
jb 0x100b3220
xorps xmm0, xmm0
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x40], 0
movups xmmword [ebp - 0x54], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100b3246
sub ecx, edx
lea eax, [ebp - 0x3c]
push ecx
push eax
lea ecx, [ebp - 0x54]
call fcn.1002ac50
mov dword [ebp - 4], 0
mov edx, dword [0x10109a40]
test edx, edx
je 0x100b3272
mov edx, dword [edx + 0x50]
jmp 0x100b3274
xor edx, edx
mov eax, dword [0x10109a38]
test eax, eax
je 0x100b3282
mov eax, dword [eax + 0x18]
jmp 0x100b3284
xor eax, eax
lea ecx, [ebp - 0x54]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.1004db90
mov edi, dword [ebp - 0x18]
add esp, 8
mov ecx, dword [ebp - 0x40]
inc edi
cmp ecx, 0xf
jbe 0x100b32ce
mov edx, dword [ebp - 0x54]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100b32c4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100b32c4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100c7927
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push edi
mov dword [ebp - 0x14], 0
call esi
lea eax, [ebp - 0x14]
mov dword [edi], 0x3e
push eax
push dword [ebp - 0x14]
push 4
push edi
call esi
mov byte [0x1010eeb8], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c74ac
mov esp, ebp
pop ebp
ret
Function at 0x100c1670
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
and ecx, eax
mov eax, dword [esi + 0xc]
lea edx, [eax + ecx*8]
mov eax, dword [edx + 4]
cmp eax, dword [esi + 4]
je 0x100c16dd
mov ecx, dword [edi]
mov edx, dword [edx]
cmp ecx, dword [eax + 8]
je 0x100c16d4
cmp eax, edx
je 0x100c16dd
mov eax, dword [eax + 4]
cmp ecx, dword [eax + 8]
jne 0x100c16c8
pop edi
add eax, 0xc
pop esi
pop ebp
ret 4
push 0x100d6c4c
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__]
int3

Function at 0x100c1780
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
movzx eax, byte [edx]
push ebx
push esi
xor eax, 0x811c9dc5
push edi
mov edi, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 8]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push edx
push eax
call fcn.100c1e40
mov esi, dword [eax + 4]
test esi, esi
je 0x100c1835
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x100c17fc
cmp eax, esi
jne 0x100c17f4
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x100c1804
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x100c1804
cmp eax, esi
jne 0x100c1804
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edi + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 0x50]
call fcn.10037800
push 0x5c
push esi
call fcn.100c7927
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100c1840
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x100c19af
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.10037800
push 0x5c
push edi
call fcn.100c7927
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100c190d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100c18c0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100c19a5
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100c1921
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x100c1924
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x100c19a5
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x1c]
and eax, dword [edx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.10037800
push 0x5c
push edi
call fcn.100c7927
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100c19b6
cmp esi, eax
jne 0x100c1975
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x100c1930
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x406100
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x406132
jl 0x406125
test ecx, ecx
jne 0x406132
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x40620f
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
je 0x406162
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x406164
xor eax, eax
cdq
mov dword [esp + 0x1c], edx
mov esi, eax
test edx, edx
jl 0x4061b8
jg 0x406175
test esi, esi
je 0x4061b8
mov eax, dword [esp + 0x10]
cmp eax, edx
jg 0x406189
jl 0x406183
cmp ecx, esi
jae 0x406189
mov esi, ecx
mov dword [esp + 0x1c], eax
push esi
push dword [esp + 0x1c]
push edi
call fcn.0045f6a0
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
sub ecx, esi
mov eax, dword [eax]
sbb edx, dword [esp + 0x1c]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x14]
jmp 0x4061dc
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x4061f8
mov ecx, dword [esp + 0xc]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
lea eax, [ebx + 0x2c]
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
test edx, edx
jg 0x406147
jl 0x4061f8
test ecx, ecx
jne 0x406147
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0xc]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x406253
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x406253
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.0045f6a0
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x4062bc
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x406279
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x4062a7
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.004671be
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x4062bc
cmp edi, eax
ja 0x406285
test edi, edi
je 0x4062bc
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.004671be
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4092a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x4092d1
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4092c0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x4096c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485df3
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4a00c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea edx, [edi + 0x40]
mov dword [edx], 0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov ecx, dword [ebp + 0x20]
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], ecx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
je 0x4097bf
test cl, 0x10
jne 0x4097bf
mov al, 1
jmp 0x4097c1
xor al, al
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
mov ebx, dword [edx + 4]
mov ecx, ebx
mov esi, dword [esi + 0x18]
sar ecx, 3
cmp esi, ecx
jae 0x4097e5
lea ecx, [esi*8]
mov dword [edx + 4], ecx
jmp 0x409817
jbe 0x409817
mov eax, dword [edx + 8]
sar eax, 3
cmp esi, eax
jbe 0x4097fc
push ecx
push esi
mov ecx, edx
call fcn.0040c330
jmp 0x409817
sub esi, ecx
je 0x409814
shl esi, 3
push esi
push 0
push ebx
call fcn.0045f400
add esp, 0xc
lea edx, [edi + 0x40]
add ebx, esi
mov dword [edx + 4], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x41a0d0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x18
mov eax, dword [0x4a00c0]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x41a19b
lea eax, [esp + 4]
push eax
push esi
push 2
call fcn.00435e00
add esp, 0xc
test eax, eax
jne 0x41a19b
lea eax, [esp + 8]
push eax
push esi
push 0x17
call fcn.00435e00
add esp, 0xc
test eax, eax
jne 0x41a19b
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x41a124
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.00435dd0
add esp, 0xc
test eax, eax
je 0x41a158
sub eax, esi
push eax
push 0x2e
push esi
call fcn.00435dd0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x41a15a
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x41a186
mov al, byte [esi]
push eax
call fcn.00428f20
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x41a168
pop edi
movzx eax, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0045da40
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop esi
xor ecx, esp
call fcn.0045da40
add esp, 0x18
ret
Function at 0x424470
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4a00c0]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x118]
push ebx
mov ebx, dword [esp + 0x114]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x124]
mov dword [esp + 4], eax
xor eax, eax
mov ecx, dword [ebx + 0xc]
push ebp
push esi
mov esi, 0x180
mov edx, dword [ecx + 0x15c]
cmp dword [esp + 0x120], edx
push edi
sete al
lea eax, [eax*4 + 0x158]
mov ebp, dword [eax + ecx]
mov eax, 0x190
cmove esi, eax
mov eax, dword [ecx + 0x298]
add esi, ecx
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x424573
xor eax, eax
cmp dword [esp + 0x124], edx
sete al
lea eax, [eax*4 + 0x170]
cmp dword [eax + ecx], 0x424130
jne 0x424573
cmp dword [esi], 0
je 0x42450e
test edi, edi
je 0x424573
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.004345d0
add esp, 0x14
cmp eax, 0xffffffff
je 0x424573
test al, 1
je 0x424573
mov ecx, dword [esi]
test ecx, ecx
jne 0x42455c
mov eax, dword [ebx + 0x4d8]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [section..data]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
test ecx, ecx
je 0x4245a7
mov edi, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x424573
add dword [esi + 8], eax
push 0
push dword [esp + 0x130]
push dword [esp + 0x1c]
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
jne 0x4245e2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x4245b8
xor edi, edi
lea eax, [edi + 0x51]
jmp 0x4245e2
mov ecx, dword [esp + 0x10]
mov eax, 0x1b
mov dword [ecx], 0xffffffff
jmp 0x4245e8
push 0x100
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.004112d0
push eax
push str.Send_failure:__s
push ebx
call fcn.00423ea0
add esp, 0x18
mov dword [ebx + 0x958], esi
mov eax, 0x37
mov ecx, dword [esp + 0x10]
mov dword [ecx], edi
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045da40
add esp, 0x10c
ret

Function at 0x4249c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp byte [eax + 0x1ac], 0
je 0x4249dd
push eax
call fcn.0041e670
add esp, 4
test eax, eax
jne 0x4249fc
xor al, al
ret
mov eax, dword [eax + 0x158]
cmp eax, 0xffffffff
je 0x4249da
push 2
push 1
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x4249da
mov al, 1
ret
Function at 0x424ca0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
mov eax, dword [0x4a00c0]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
mov ebx, dword [esp + 0x190]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [esp + 0x1a4]
push 0x80
push 0
push eax
mov dword [esp + 0x18], 0x80
call fcn.0045f400
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1a4]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x424d27
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.004112d0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x424d67
push edi
push esi
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
call fcn.00424860
add esp, 0x10
test al, al
jne 0x424d70
call fcn.00467cbe
mov esi, dword [eax]
call fcn.00467cbe
mov edi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.004112d0
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.00423ea0
add esp, 0x1c
mov ecx, dword [esp + 0x190]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045da40
add esp, 0x188
ret
Function at 0x426940
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push 0x48a480
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x42695a
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x48a49c
push esi
call fcn.0046eaf0
add esp, 8
test eax, eax
je 0x4269a2
test ebp, ebp
je 0x426993
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x4269c8
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4269c8
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x426a7f
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4269e5
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x426a75
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x426a75
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x426a17
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x426a30
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x426a40
test ebp, ebp
je 0x426a6c
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x4a0004]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x4a0004]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x42ca30
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x42ca42
mov eax, dword [eax + 0x7c]
mov al, byte [eax + 0xe7]
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x42ca56
xor al, al
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
ret

Function at 0x42ca60
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 8]
cmp byte [eax + 0x108], 2
jne 0x42caad
mov eax, dword [esp + 4]
test eax, eax
je 0x42ca7f
mov eax, dword [eax + 0x7c]
mov al, byte [eax + 0xe7]
ret
push esi
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x42ca9a
xor esi, esi
test esi, esi
pop esi
setne al
ret
push eax
mov esi, 1
call dword [sym.imp.WS2_32.dll_closesocket]
test esi, esi
pop esi
setne al
ret
mov al, 1
ret