joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ef0
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x486390
push 0x459ee0
mov eax, dword fs:[0]
push eax
sub esp, 0x4e8
mov eax, dword [0x4a4300]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
call fcn.00403a70
mov byte [ebp - 0x278], 0
push 0x257
push 0
cmp eax, 1
lea eax, [ebp - 0x277]
push eax
jne 0x405f9e
call fcn.004523e0
add esp, 0xc
push 0x4a8890
push 0x258
lea eax, [ebp - 0x278]
push eax
push 0
push str.Start
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x405f89
push 0x482ab8
call fcn.004027a0
add esp, 4
call fcn.00401440
lea ecx, [ebp - 0x278]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405f92
jmp 0x406197
call fcn.004523e0
add esp, 0xc
push 0x4a8890
push 0x258
lea eax, [ebp - 0x278]
push eax
push 0
push str.Game
push str.PATH
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call esi
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405fe1
test al, 0x10
jne 0x406038
mov dword [ebp - 0x4f4], 0
mov dword [ebp - 4], 0
call fcn.00405b10
mov dword [ebp - 0x4f4], eax
mov dword [ebp - 4], 0xfffffffe
jmp 0x406022
test eax, eax
jne 0x406038
push 0x482ab8
call fcn.004027a0
add esp, 4
call fcn.00401440
push 0x4a8890
push 0x258
lea eax, [ebp - 0x278]
push eax
push 0
push str.Game
push str.PATH
call esi
test eax, eax
jne 0x406184
push 4
push 0x482770
push 0x482af4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x40614f
mov byte [ebp - 0x4d0], 0
push 0x257
push 0
lea eax, [ebp - 0x4cf]
push eax
call fcn.004523e0
add esp, 0xc
mov dword [ebp - 0x4f0], 0
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x4ec], xmm0
movq qword [ebp - 0x4dc], xmm0
mov dword [ebp - 0x4d4], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x4f0], eax
mov dword [ebp - 0x4ec], 0
lea eax, [ebp - 0x4d0]
mov dword [ebp - 0x4e8], eax
mov dword [ebp - 0x4e4], 0x482a80
mov dword [ebp - 0x4e0], 0x43
mov dword [ebp - 0x4dc], 0
mov dword [ebp - 0x4d4], 0
lea eax, [ebp - 0x4f0]
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
test eax, eax
je 0x40614f
lea ecx, [ebp - 0x4d0]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
cmp eax, 1
jne 0x40614f
push 0x4a8890
lea eax, [ebp - 0x4d0]
push eax
push str.Game
push str.PATH
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x4a8890
push 0x258
lea eax, [ebp - 0x278]
push eax
push 0
push str.Game
push str.PATH
call esi
test eax, eax
jne 0x406184
push 0x482ab8
call fcn.004027a0
add esp, 4
call fcn.00401440
lea ecx, [ebp - 0x278]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406190
sub ecx, edx
je 0x4061a6
lea ecx, [ebp - 0x278]
call fcn.004041d0
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
Function at 0x406a90
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x4a4300]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
xor eax, eax
push 0x18e
push eax
mov word [esp + 0x10], ax
lea eax, [esp + 0x12]
push eax
call fcn.004523e0
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x406c02
mov eax, dword [0x4a8b54]
test eax, eax
je 0x406aef
push str._STS_DUILIB_CreateLoadWnd
call eax
call eax
push 0x63
lea eax, [esp + 0x1ad]
mov byte [esp + 0x1ac], 0
push 0
push eax
call fcn.004523e0
add esp, 0xc
lea ecx, [esp + 0x198]
xorps xmm0, xmm0
movdqu xmmword [esp + 0x198], xmm0
call fcn.0040b6b0
test eax, eax
je 0x406c38
lea eax, [esp + 0x198]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x64
mov esi, eax
mov dword [esp + 8], 6
lea eax, [esp + 0x1ac]
push 0
push eax
call fcn.004523e0
add esp, 0xc
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1ac]
push eax
push 0
push esi
call dword [sym.imp.IPHLPAPI.DLL_SendARP]
neg eax
sbb eax, eax
inc eax
je 0x406c38
call fcn.0040b820
test eax, eax
je 0x406c14
call fcn.00402ea0
call fcn.00402da0
mov ecx, dword [0x4a8884]
test eax, eax
mov esi, 1
cmove ecx, esi
mov dword [0x4a8884], ecx
call fcn.00402e20
mov ecx, dword [0x4a888c]
cmp eax, esi
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 0
push 0x4068a0
push 0
cmove ecx, esi
push 0
mov dword [0x4a888c], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x406be6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 4], 0
je 0x406c26
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
push 0x482db0
call fcn.004027a0
add esp, 4
call fcn.00401440
push 0x482e14
call fcn.004027a0
add esp, 4
call fcn.00401440
push 0x482e48
call fcn.004027a0
add esp, 4
call fcn.00401440
push 0x482de4
call fcn.004027a0
add esp, 4
call fcn.00401440
int3
Function at 0x4074c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.0040fd80
mov ebx, eax
mov esi, edx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x20c], esi
call fcn.0040fd80
sub eax, ebx
sbb edx, esi
test edx, edx
jg 0x407559
jl 0x407503
cmp eax, 0x7530
ja 0x407559
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
push 0x48309c
call esi
push 0x48309c
call fcn.00458229
add esp, 4
mov ecx, edi
call fcn.0040c550
cmp eax, 1
je 0x40756c
push 0x3e8
call ebx
call fcn.0040fd80
sub eax, dword [ebp - 0x210]
sbb edx, dword [ebp - 0x20c]
mov dword [ebp - 0x214], edx
js 0x407510
jg 0x407559
cmp eax, 0x7530
jbe 0x407510
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
push 0x1ff
lea eax, [ebp - 0x207]
mov byte [ebp - 0x208], 0
push 0
push eax
call fcn.004523e0
add esp, 0xc
call fcn.0040fd80
sub eax, dword [ebp - 0x210]
sbb edx, dword [ebp - 0x20c]
push edx
push eax
lea eax, [ebp - 0x208]
push 0x4830bc
push eax
call fcn.0045752f
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [ebp - 0x208]
push eax
call fcn.00458229
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop edi
pop esi
pop ebx
call fcn.004516e1
mov esp, ebp
pop ebp
ret

Function at 0x407650
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.0040fd80
mov esi, edx
mov ebx, eax
mov dword [ebp - 0x20c], esi
call fcn.0040fd80
sub eax, ebx
sbb edx, esi
test edx, edx
jg 0x4076c4
jl 0x40768d
cmp eax, 0x7530
ja 0x4076c4
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4830e4
call esi
mov ecx, edi
call fcn.0040c730
cmp eax, 1
je 0x4076d7
call fcn.0040fd80
sub eax, ebx
sbb edx, dword [ebp - 0x20c]
mov dword [ebp - 0x214], edx
js 0x407693
jg 0x4076c4
cmp eax, 0x7530
jbe 0x407693
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
push 0x1ff
lea eax, [ebp - 0x207]
mov byte [ebp - 0x208], 0
push 0
push eax
call fcn.004523e0
add esp, 0xc
call fcn.0040fd80
sub eax, ebx
sbb edx, dword [ebp - 0x20c]
push edx
push eax
lea eax, [ebp - 0x208]
push str._DEBUG___lld__
push eax
call fcn.0045752f
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004516e1
mov esp, ebp
pop ebp
ret

Function at 0x407d10
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x408610
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push ebx
push esi
push edi
mov dword [ebp - 0xc0], eax
mov esi, edx
xor eax, eax
mov byte [ebp - 0x18], 0
push 0x42
push eax
mov word [ebp - 0x64], ax
mov edi, ecx
lea eax, [ebp - 0x62]
movq qword [ebp - 0x17], xmm0
push eax
mov dword [ebp - 0xf], 0
mov word [ebp - 0xb], 0
mov byte [ebp - 9], 0
call fcn.004523e0
push esi
mov edx, edi
mov dword [ebp - 0xa8], 0
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xbc], 0x67452301
mov dword [ebp - 0xb8], 0xefcdab89
mov dword [ebp - 0xb4], 0x98badcfe
mov dword [ebp - 0xb0], 0x10325476
call fcn.00407d40
add esp, 0x10
lea edx, [ebp - 0xbc]
lea ecx, [ebp - 0x18]
call fcn.00407e10
xor edi, edi
lea esi, [ebp - 0x62]
mov bl, byte [ebp + edi - 0x18]
movzx eax, bl
push eax
push str._02x
lea eax, [esi - 2]
push 2
push eax
call fcn.00401420
shl bl, 4
movzx eax, bl
push eax
push str._02x
push 2
push esi
call fcn.00401420
inc edi
add esp, 0x20
add esi, 4
cmp edi, 0x10
jl 0x4086c2
xor eax, eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x64]
push eax
push 0x21
push dword [ebp - 0xc0]
call fcn.0045474c
mov ecx, dword [ebp - 8]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004516e1
mov esp, ebp
pop ebp
ret

Function at 0x4088b0
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push esi
mov ebx, edx
xor esi, esi
mov eax, 0x1505
push edi
mov edi, ecx
test ebx, ebx
je 0x4088da
mov dl, byte [esi + edi]
test dl, dl
je 0x4088da
mov ecx, eax
inc esi
shl eax, 5
add eax, ecx
movzx ecx, dl
add eax, ecx
cmp esi, ebx
jb 0x4088c2
pop edi
pop esi
pop ebx
ret

Function at 0x408e20
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov dword [ebp - 8], eax
push edi
mov edi, edx
test eax, eax
je 0x408e98
test edi, edi
je 0x408e98
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, 0x1505
test ebx, ebx
je 0x408e61
mov cl, byte [edx + edi]
test cl, cl
je 0x408e5e
mov eax, esi
inc edx
shl esi, 5
add esi, eax
movzx eax, cl
add esi, eax
cmp edx, ebx
jb 0x408e46
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push esi
push ebx
mov edx, edi
mov ecx, eax
call fcn.00408c70
add esp, 0xc
mov ecx, eax
cmp dword [ebp - 4], 0
pop esi
pop ebx
je 0x408e98
mov edx, dword [ebp - 8]
pop edi
mov eax, dword [edx + 4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [edx + 0x10]
mov eax, dword [eax + ecx*4]
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40abc0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 6
mov eax, 2
mov dword [ebp - 0xe], 0
xorps xmm0, xmm0
mov word [ebp - 0xa], 0
push 1
movq qword [ebp - 0x16], xmm0
push eax
mov word [ebp - 0x18], ax
mov word [ebp - 0x16], dx
mov dword [ebp - 0x14], ecx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x40ac2b
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 1
push 6
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x40ac3c
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 0xffffff7f
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x40ac24
push ecx
mov ecx, esi
call fcn.0040aad0
add esp, 4
test eax, eax
je 0x40ac24
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x40ac24
push 0x10
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x40ac24
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004516e1
mov esp, ebp
pop ebp
ret
Function at 0x40acb0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x257
lea eax, [ebp - 0x327]
mov dword [ebp - 0x330], ecx
push 0
push eax
mov byte [ebp - 0x328], 0
call fcn.004523e0
add esp, 0xc
lea eax, [ebp - 0x328]
push 0x258
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x80
push 4
push 0
push 5
push SysReAllocString
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40ae2a
lea eax, [ebp - 0x32c]
mov dword [ebp - 0x32c], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push eax
push dword [ebp - 0x32c]
mov dword [ebp - 0x334], eax
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40ae23
test esi, esi
je 0x40ae23
push 0
push 0
push 0
push 5
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
jne 0x40ada0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push eax
call fcn.004523e0
mov edx, dword [ebp - 0x334]
lea eax, [ebp - 0xd0]
add esp, 0xc
mov ecx, ebx
push eax
call fcn.00408610
mov ebx, dword [ebp - 0x330]
add esp, 4
push 0x64
push 0
push ebx
call fcn.004523e0
add esp, 0xc
lea eax, [ebp - 0xd0]
push eax
push 0x48276c
push ebx
call fcn.0045752f
add esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
test edi, edi
je 0x40ae0d
push edi
call esi
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004516e1
mov esp, ebp
pop ebp
ret
Function at 0x40b1b0
Capabilities:
Extract resource via kernel32 functions
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x483330
push 0x84
push 0
mov ebx, ecx
mov dword [ebp - 0x260], 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x40b235
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40b235
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x40b235
cmp eax, 0x2000
ja 0x40b235
push eax
push esi
push ebx
call fcn.00451d90
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
push 0x257
lea eax, [ebp - 0x25b]
mov byte [ebp - 0x25c], 0
push 0
push eax
call fcn.004523e0
add esp, 0xc
lea eax, [ebp - 0x25c]
push 0x258
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x25c]
dec ecx
lea ecx, [ecx]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x40b270
mov eax, dword [str..json]
push 0
push 0x80
push 3
mov dword [ecx], eax
mov ax, word [0x483340]
push 0
push 0
mov word [ecx + 4], ax
lea eax, [ebp - 0x25c]
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40b2c4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x260]
push eax
push 0x2000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp eax, dword [ebp - 0x260]
pop edi
sbb eax, eax
xor ecx, ebp
pop esi
neg eax
pop ebx
call fcn.004516e1
mov esp, ebp
pop ebp
ret

Function at 0x40b6b0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xff
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], 0
push 0
push eax
mov esi, ecx
call fcn.004523e0
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x100
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x40b70b
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0
push eax
lea eax, [ebp - 0x128]
xorps xmm0, xmm0
push eax
push 0
lea eax, [ebp - 0x108]
movdqu xmmword [ebp - 0x128], xmm0
push eax
movdqu xmmword [ebp - 0x118], xmm0
mov dword [ebp - 0x124], 2
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x40b6fa
mov eax, dword [ebp - 0x12c]
push 0x10
mov eax, dword [eax + 0x18]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push esi
call fcn.00456d90
add esp, 0xc
push dword [ebp - 0x12c]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.004516e1
mov esp, ebp
pop ebp
ret
Function at 0x40bd00
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
push 1
push 2
mov ebx, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x40bdc7
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [ebp - 8]
push 4
push eax
push 1
push 6
push esi
mov dword [ebp - 8], 1
call edi
xor eax, eax
mov dword [ebp - 8], 1
push 4
mov word [ebp - 6], ax
lea eax, [ebp - 8]
push eax
push 0xffffff7f
push 0xffff
push esi
call edi
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x2000
push eax
push 0x1001
push 0xffff
push esi
call edi
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x2000
push eax
push 0x1002
push 0xffff
push esi
call edi
push ecx
mov ecx, esi
call fcn.0040ffe0
add esp, 4
mov dword [ebp - 8], 1
lea eax, [ebp - 8]
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x40bdda
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 4
push 0xffff
push esi
call edi
test eax, eax
jne 0x40bdc0
mov edi, dword [sym.imp.WS2_32.dll_htons]
xorps xmm0, xmm0
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], ax
mov eax, 2
push 0
movq qword [ebp - 0x1a], xmm0
mov word [ebp - 0x1c], ax
call edi
push 0
mov word [ebp - 0x1a], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x40bdc0
mov dword [ebp - 0x22], eax
xorps xmm0, xmm0
mov word [ebp - 0x1e], ax
mov eax, 2
push 0xfff1
movq qword [ebp - 0x2a], xmm0
mov word [ebp - 0x2c], ax
call edi
mov word [ebp - 0x2a], ax
lea eax, [ebp - 0x2c]
push 0x10
push eax
push esi
mov dword [ebp - 0x28], ebx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40be80
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x40bdc0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004516e1
mov esp, ebp
pop ebp
ret
Function at 0x40e340
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6b20a8], 0
jne 0x40e38d
push 0xfde80
call fcn.00452c03
add esp, 4
mov dword [0x6b20a8], eax
test eax, eax
jne 0x40e37d
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
push 0xfde80
push 0
push eax
call fcn.004523e0
add esp, 0xc
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push 0x40e2b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40e3b6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 8], eax
setne al
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
Function at 0x40ee30
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x486430
push 0x459ee0
mov eax, dword fs:[0]
push eax
sub esp, 0x200
mov eax, dword [0x4a4300]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
xor eax, eax
mov word [ebp - 0x30], ax
xorps xmm0, xmm0
movq qword [ebp - 0x2e], xmm0
mov dword [ebp - 0x26], eax
mov word [ebp - 0x22], ax
mov word [ebp - 0x40], ax
movq qword [ebp - 0x3e], xmm0
mov dword [ebp - 0x36], eax
mov word [ebp - 0x32], ax
mov dword [ebp - 0x20], 0x10
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
neg eax
sbb eax, eax
inc eax
je 0x40ef66
mov dword [ebp - 0x20], 0x10
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x40]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getpeername]
neg eax
sbb eax, eax
inc eax
je 0x40ef66
mov dword [ebp - 0x210], 0
push 0x1cc
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004523e0
add esp, 0xc
lea ecx, [ebp - 0x210]
call fcn.00401fe0
mov esi, dword [ebp - 0x210]
test esi, esi
je 0x40ef66
push dword [ebp - 0x8c]
push dword [ebp - 0x90]
push dword [ebp - 0x1ac]
push dword [ebp - 0x1b0]
mov edx, esi
mov ecx, edi
call fcn.0040e9a0
add esp, 0x10
cmp eax, 1
jne 0x40ef5f
mov dword [ebp - 4], 0
mov edx, esi
mov ecx, edi
call fcn.0040e5e0
mov dword [ebp - 4], 0xfffffffe
jmp 0x40ef5f
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret