joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420a80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436580
push 0x42ab42
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x420b04
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
cmp word [eax], 0x5a4d
jne 0x420afd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420afd
cmp word [ecx + 0x14], 0
je 0x420afd
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x420bd0
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x43d53c]
cmp ecx, eax
je 0x420be8
mov eax, 0x10dd
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [0x43d54c]
xor ebp, ebp
cmp esi, ebp
push edi
je 0x420c61
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, edi
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
lea edx, [esp + 0x10]
push edx
movzx edx, byte [ecx + 0x17]
push eax
mov eax, dword [esi + 0xc]
push edx
push eax
call ebx
cmp dword [esi + 4], ebp
jne 0x420c50
mov eax, dword [esi + 0x10]
cmp eax, ebp
je 0x420c50
mov edx, eax
and edx, 0xffff0000
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 0x18], ecx
mov dword [edx + 8], eax
mov dword [esi + 0x10], ebp
mov edi, dword [esi]
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp edi, ebp
mov esi, edi
jne 0x420c00
mov dword [0x43d54c], ebp
call fcn.004207f0
mov esi, dword [0x43d548]
cmp esi, ebp
je 0x420c97
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
lea esp, [esp]
mov edx, dword [esi + 4]
push edx
call ebx
mov edi, dword [esi]
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp edi, ebp
mov esi, edi
jne 0x420c80
pop edi
mov dword [0x43d548], ebp
pop esi
mov dword [0x43d53c], ebp
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x420fb0
Capabilities:
Suspend thread

Disassembly:
push edi
mov edi, eax
mov eax, dword [0x43d540]
test eax, eax
jne 0x421025
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp edi, eax
jne 0x420fca
xor eax, eax
pop edi
ret
push esi
push 8
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
jne 0x420fe0
lea edi, [eax + 8]
jmp 0x420ffd
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x421012
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
pop esi
mov dword [0x43d540], edi
mov eax, edi
mov dword [0x43d544], 0
pop edi
ret
mov eax, dword [0x43d548]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [0x43d548], esi
xor eax, eax
pop esi
pop edi
ret
Function at 0x421030
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
push ebx
push edi
xor edi, edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x43d53c]
cmp ecx, eax
je 0x421056
pop edi
mov eax, 0x10dd
pop ebx
add esp, 0x10
ret 8
mov eax, dword [0x43d540]
cmp eax, edi
jne 0x42125c
mov eax, dword [esp + 0x1c]
cmp eax, edi
jne 0x421078
pop edi
mov eax, 6
pop ebx
add esp, 0x10
ret 8
push esi
mov esi, dword [eax]
cmp esi, edi
jne 0x42109c
pop esi
pop edi
mov dword [0x43d544], eax
mov dword [0x43d540], 6
mov eax, 6
pop ebx
add esp, 0x10
ret 8
push ebp
mov dword [esp + 0x10], edi
call fcn.00420b20
mov esi, dword [esp + 0x28]
mov ebp, eax
call fcn.00420b20
cmp eax, ebp
mov dword [esp + 0x28], eax
jne 0x4210ca
cmp dword [0x43d538], ebx
jne 0x4211ff
jmp 0x4211dd
push 0x18
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
mov dword [esp + 0x10], eax
jne 0x4210e4
lea ebx, [eax + 8]
jmp 0x4211dd
mov eax, ebp
call fcn.00420820
mov edi, eax
test edi, edi
jne 0x4210f9
lea ebx, [eax + 8]
jmp 0x4211dd
mov esi, ebp
xor ebx, ebx
lea ecx, [ecx]
lea ecx, [ebx + edi]
lea eax, [esp + 0x14]
mov edx, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], 0
call fcn.00421390
cmp dword [esp + 0x14], 0
mov esi, eax
jne 0x421148
mov ecx, dword [esp + 0x1c]
mov ebx, esi
sub ebx, ebp
call fcn.00420770
test eax, eax
jne 0x421148
cmp ebx, 5
jl 0x421100
cmp ebx, 0x12
jbe 0x421161
mov ebx, 6
jmp 0x4211dd
cmp ebx, 5
jge 0x421139
cmp dword [0x43d538], 0
mov ebx, 9
jne 0x4211e3
jmp 0x4211dd
mov eax, dword [esp + 0x28]
mov dword [edi + 0x1c], eax
lea ecx, [ebx + edi]
lea edx, [ebx + ebp]
mov dword [edi + 0x18], edx
lea eax, [edi + 0x17]
lea esi, [ecx + 5]
mov byte [eax], bl
mov byte [ecx], 0xe9
add ecx, 1
sub edx, esi
mov dword [ecx], edx
add ecx, 4
call fcn.00420740
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esp + 0x18]
push ecx
push 0x40
push ebx
push ebp
mov dword [esp + 0x28], 0
call esi
test eax, eax
je 0x4211d5
mov ecx, ebp
call fcn.00420a80
mov ebx, eax
test ebx, ebx
je 0x42122c
cmp word [ebx + 0x1c], 0x6544
je 0x42122c
lea edx, [esp + 0x1c]
push edx
push 0x40
push 0x40
push ebx
mov dword [esp + 0x2c], 0
call esi
test eax, eax
jne 0x421214
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x43d540], ebx
test edi, edi
je 0x4211ee
mov eax, edi
call fcn.00420a50
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4211ff
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x24]
pop ebp
pop esi
mov dword [0x43d544], eax
pop edi
mov eax, ebx
pop ebx
add esp, 0x10
ret 8
mov word [ebx + 0x1c], 0x6544
mov word [ebx + 0x1e], 0x6f74
mov word [ebx + 0x20], 0x7275
mov word [ebx + 0x22], 0x2173
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov ecx, dword [0x43d54c]
mov dword [eax + 0xc], ebp
mov dword [eax + 4], 0
mov dword [eax + 0x10], edi
mov edx, dword [esp + 0x18]
pop ebp
mov dword [eax + 0x14], edx
mov dword [eax], ecx
mov dword [0x43d54c], eax
xor eax, eax
pop esi
pop edi
pop ebx
add esp, 0x10
ret 8
Function at 0x421270
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x43d53c]
cmp ecx, eax
je 0x42128e
mov eax, 0x10dd
pop ebp
ret 8
mov eax, dword [0x43d540]
test eax, eax
jne 0x42137d
test ebp, ebp
jne 0x4212a6
lea eax, [ebp + 6]
pop ebp
ret 8
cmp dword [ebp], 0
jne 0x4212c0
mov eax, 6
mov dword [0x43d544], ebp
mov dword [0x43d540], eax
pop ebp
ret 8
push ebx
push esi
push edi
push 0x18
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4212db
lea esi, [eax + 8]
jmp 0x42135f
mov esi, dword [esp + 0x18]
mov edi, dword [ebp]
call fcn.00420b20
movzx ecx, byte [edi + 0x17]
mov esi, dword [edi + 0x18]
sub esi, ecx
test ecx, ecx
je 0x421351
cmp ecx, 0x17
ja 0x421351
cmp dword [edi + 0x1c], eax
jne 0x421351
lea edx, [esp + 0x14]
push edx
push 0x40
push ecx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x421323
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x42135f
mov ecx, dword [0x43d54c]
mov dword [ebx + 0x10], edi
mov dword [ebx + 8], ebp
mov dword [ebx + 0xc], esi
pop edi
mov dword [ebx + 4], 1
mov eax, dword [esp + 0x10]
pop esi
mov dword [ebx + 0x14], eax
mov dword [ebx], ecx
mov dword [0x43d54c], ebx
pop ebx
xor eax, eax
pop ebp
ret 8
cmp dword [0x43d538], 0
mov esi, 9
jne 0x421365
mov dword [0x43d540], esi
test ebx, ebx
je 0x421372
push ebx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
mov eax, esi
pop esi
mov dword [0x43d544], ebp
pop ebx
pop ebp
ret 8

Function at 0x4218b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42ad64
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x43c01c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea ecx, [esi + 0x14]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
xor edi, edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], edi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0x68]
mov byte [esp + 0x14], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov dword [esi], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x421be0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esi]
test eax, eax
je 0x421c31
test ebx, ebx
je 0x421c31
test edi, edi
jle 0x421c31
mov edx, dword [esp + 8]
cmp edx, 0xffffffff
jl 0x421c10
mov ecx, dword [esp + 4]
jg 0x421c02
cmp ecx, 0xffffffff
jbe 0x421c10
push 0
push edx
push ecx
push eax
call dword [sym.imp.MSVCR80.dll__fseeki64]
add esp, 0x10
mov eax, dword [esi]
push eax
push 1
push edi
push ebx
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
cmp dword [esp + 0xc], 0
je 0x421c31
mov ecx, dword [esi]
push ecx
call dword [sym.imp.MSVCR80.dll_fflush]
pop ecx
ret 0xc

Function at 0x421c40
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esi]
test eax, eax
je 0x421c83
test edi, edi
je 0x421c83
mov edx, dword [esp + 8]
cmp edx, 0xffffffff
jl 0x421c6c
mov ecx, dword [esp + 4]
jg 0x421c5e
cmp ecx, 0xffffffff
jbe 0x421c6c
push 0
push edx
push ecx
push eax
call dword [sym.imp.MSVCR80.dll__fseeki64]
add esp, 0x10
mov eax, dword [esi]
mov ecx, dword [esp + 0xc]
push eax
push 1
push edi
push ecx
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x10
ret 0xc
or eax, 0xffffffff
ret 0xc

Function at 0x421c90
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esi]
test eax, eax
je 0x421ce1
test edi, edi
je 0x421ce1
mov edx, dword [esp + 8]
cmp edx, 0xffffffff
jl 0x421cbc
mov ecx, dword [esp + 4]
jg 0x421cae
cmp ecx, 0xffffffff
jbe 0x421cbc
push 0
push edx
push ecx
push eax
call dword [sym.imp.MSVCR80.dll__fseeki64]
add esp, 0x10
mov eax, dword [esi]
mov ecx, dword [esp + 0xc]
push eax
push ecx
push 1
push edi
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
cmp dword [esp + 0x10], 0
je 0x421ce1
mov edx, dword [esi]
push edx
call dword [sym.imp.MSVCR80.dll_fflush]
pop ecx
ret 0x10

Function at 0x421cf0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esi]
test eax, eax
je 0x421d33
test edi, edi
je 0x421d33
mov edx, dword [esp + 8]
cmp edx, 0xffffffff
jl 0x421d1c
mov ecx, dword [esp + 4]
jg 0x421d0e
cmp ecx, 0xffffffff
jbe 0x421d1c
push 0
push edx
push ecx
push eax
call dword [sym.imp.MSVCR80.dll__fseeki64]
add esp, 0x10
mov eax, dword [esi]
mov ecx, dword [esp + 0xc]
push eax
push ecx
push 1
push edi
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x10
ret 0xc
or eax, 0xffffffff
ret 0xc
Function at 0x421f4a
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x43c01c]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00421edf
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x421f99
cmp dword [ebp - 0x1c], 5
jb 0x421fb1
jmp 0x421fad
cmp dword [ebp - 0x10], 1
jne 0x421fb1
cmp dword [ebp - 0x1c], 4
ja 0x421fad
jne 0x421fb1
cmp dword [ebp - 0x18], 0
jbe 0x421fb1
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x42e6ec
call fcn.00421dd0
test eax, eax
jge 0x421fd2
mov byte [0x43d368], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00422218
add ebp, 0x78
leave
ret

Function at 0x422218
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43c01c]
jne 0x422222
repz ret
jmp fcn.00422810

Function at 0x423f80
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0
jne 0x423f98
mov dword [ebp + 0xc], 0x1006
jmp 0x423f9f
mov dword [ebp + 0xc], 0x1005
push 4
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0xffff
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x90c]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x423fcb
xor eax, eax
jmp 0x423fd0
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x424090
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x908], 0
jne 0x4240a9
xor eax, eax
jmp 0x4240d7
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x90c]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x4240d4
mov ecx, dword [ebp - 8]
call sym.Starter.exe_public:_int___thiscall_CHttpSocket::CloseSocket_void_
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x4240e0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x11c], ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
xor edx, edx
mov ecx, 0x3e8
div ecx
imul edx, edx, 0x3e8
mov dword [ebp - 4], edx
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x118], 0
jmp 0x424138
mov edx, dword [ebp - 0x118]
add edx, 1
mov dword [ebp - 0x118], edx
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x110]
jae 0x42415c
mov ecx, dword [ebp - 0x118]
mov edx, dword [ebp + ecx*4 - 0x10c]
cmp edx, dword [ebp + 8]
jne 0x42415a
jmp 0x42415c
jmp 0x424129
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x110]
jne 0x424192
cmp dword [ebp - 0x110], 0x40
jae 0x424192
mov ecx, dword [ebp - 0x118]
mov edx, dword [ebp + 8]
mov dword [ebp + ecx*4 - 0x10c], edx
mov eax, dword [ebp - 0x110]
add eax, 1
mov dword [ebp - 0x110], eax
xor ecx, ecx
jne 0x42411d
mov dword [ebp - 0x114], 0
movzx edx, byte [ebp + 0xc]
test edx, edx
je 0x4241c7
lea eax, [ebp - 8]
push eax
push 0
push 0
lea ecx, [ebp - 0x110]
push ecx
push 0
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0x114], eax
jmp 0x4241e4
lea edx, [ebp - 8]
push edx
push 0
lea eax, [ebp - 0x110]
push eax
push 0
push 0
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x424480
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x43c01c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x1a4], ecx
cmp dword [0x43d52c], 0
jne 0x4244eb
mov word [ebp - 0x1a0], 2
lea eax, [ebp - 0x198]
push eax
mov cx, word [ebp - 0x1a0]
push ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x19c], eax
movzx edx, word [ebp - 0x198]
and edx, 0xff
movzx eax, dl
cmp eax, 2
je 0x4244e1
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [0x43d52c], 1
mov ecx, dword [ebp - 0x1a4]
cmp dword [ecx + 0x908], 0
je 0x4244fe
xor eax, eax
jmp 0x424542
push 0x432a94
call dword [sym.imp.WS2_32.dll_getprotobyname]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
movsx eax, word [edx + 8]
push eax
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp - 0x1a4]
mov dword [ecx + 0x90c], eax
mov edx, dword [ebp - 0x1a4]
cmp dword [edx + 0x90c], 0xffffffff
jne 0x42453d
xor eax, eax
jmp 0x424542
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00422218
mov esp, ebp
pop ebp
ret
Function at 0x4246d0
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x43c01c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0
jne 0x4246f0
xor eax, eax
jmp 0x4247f0
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x908], 0
je 0x424704
mov ecx, dword [ebp - 0x1c]
call sym.Starter.exe_public:_int___thiscall_CHttpSocket::CloseSocket_void_
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x804], edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x910], eax
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0x910], 0
jne 0x424736
xor eax, eax
jmp 0x4247f0
push 4
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x910]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0x18]
push ecx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
push 0x10
push 0
lea edx, [ebp - 0x14]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov word [ebp - 0x14], 2
push 0x50
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0xd]
push ecx
movzx edx, byte [ebp - 0xe]
push edx
movzx eax, byte [ebp - 0xf]
push eax
movzx ecx, byte [ebp - 0x10]
push ecx
push str._d._d._d._d
mov edx, dword [ebp - 0x1c]
add edx, 0x808
push edx
mov eax, 0x100
call fcn.0040af70
add esp, 0x18
push 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x90c]
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x4247de
mov ecx, dword [ebp - 0x1c]
call sym.Starter.exe_public:_int___thiscall_CHttpSocket::CloseSocket_void_
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x90c], 0
xor eax, eax
jmp 0x4247f0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x908], 1
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422218
mov esp, ebp
pop ebp
ret 8
Function at 0x424800
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x90c], 0xffffffff
jne 0x42481f
mov eax, 1
jmp 0x42493f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jle 0x424932
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 8]
cmp edx, 0x3a98
jle 0x424870
push str.Receive__download_timeout
mov eax, 0xd1
mov ecx, 0x432c5c
call fcn.0041cc00
add esp, 4
mov eax, 2
jmp 0x42493f
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x90c]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jg 0x42491b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4248fa
cmp dword [ebp - 0x14], 0x2733
jne 0x4248fa
push 0x3e8
push 1
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x90c]
push edx
mov ecx, dword [ebp - 0x18]
call sym.Starter.exe_protected:_int___thiscall_CHttpSocket::WaitData_unsigned_int__bool__unsigned_long_int_
test eax, eax
jge 0x4248f3
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
push str.Receive__WaitData_Error.
mov eax, 0xd1
mov ecx, 0x432c90
call fcn.0041cc00
add esp, 4
mov eax, 3
jmp 0x42493f
jmp 0x42482e
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push str.Receive__iRet_d__LastError_d
mov eax, 0xd1
mov ecx, str..HttpHttpSocket.cpp
call fcn.0041cc00
add esp, 0xc
jmp 0x424932
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
jmp 0x42482e
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x424a60
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x908], 0
jne 0x424a79
xor eax, eax
jmp 0x424ad4
cmp dword [ebp + 8], 0
jne 0x424a88
mov ecx, dword [ebp - 8]
add ecx, 4
mov dword [ebp + 8], ecx
cmp dword [ebp + 0xc], 0
jne 0x424aa0
mov edx, dword [ebp - 8]
add edx, 4
push edx
call sub.MSVCR80.dll_strlen
add esp, 4
mov dword [ebp + 0xc], eax
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x90c]
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x424ac3
xor eax, eax
jmp 0x424ad4
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
call sym.Starter.exe_public:_char_const____thiscall_CHttpSocket::GetResponseHeader_int__
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x426f50
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x43c01c]
xor eax, ebp
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x43c], ecx
mov eax, dword [ebp - 0x43c]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x434], eax
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov byte [ebp - 0x430], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x42f]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x28], 0x28
mov edx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x2c], 0x400
jae 0x426fed
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x440], eax
jmp 0x426ff7
mov dword [ebp - 0x440], 0x400
mov ecx, dword [ebp - 0x440]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x43c]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x43c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WININET.dll_InternetReadFileExA]
test eax, eax
jne 0x42706a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0x3e5
jne 0x427059
mov ecx, dword [ebp - 0x43c]
call fcn.00426d60
test eax, eax
je 0x427057
mov ecx, dword [ebp - 0x43c]
call fcn.00426bd0
xor eax, eax
jmp 0x4270d0
jmp 0x427068
mov ecx, dword [ebp - 0x43c]
call fcn.00426bd0
xor eax, eax
jmp 0x4270d0
jmp 0x42708f
push 0
mov eax, dword [ebp - 0x43c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42708f
mov ecx, dword [ebp - 0x43c]
call fcn.00426bd0
xor eax, eax
jmp 0x4270d0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
push str.InternetReadFileEx__recvlen_d__leftlen_d
mov eax, 0xd1
mov ecx, str..HttpHttpWinet.cpp
call fcn.0041cc00
add esp, 0xc
cmp dword [ebp - 0x10], 0
jae 0x4270c3
mov ecx, dword [ebp - 0x43c]
call fcn.00426bd0
xor eax, eax
jmp 0x4270d0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov eax, 1
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.00422218
mov esp, ebp
pop ebp
ret 0xc