joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c4870
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4c4892
add esp, 0xfffffff0
call fcn.00403cf4
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x4c49fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004b69b4
test al, al
jne 0x4c48cf
mov ecx, 0x4c4a30
mov dl, 1
mov eax, dword [0x4ab0b0]
call fcn.0040d100
call fcn.00404220
push dword [0x53dfa8]
lea edx, [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xbc]
push dword [ebp - 0x10]
push dword [0x53dfa8]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004051f0
mov eax, dword [ebp - 0xc]
call fcn.004b748c
test al, al
jne 0x4c49a1
push dword [0x53dfa4]
push dword [ebp + 8]
push dword [0x53dfa4]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004051f0
mov eax, dword [ebp - 0x14]
call fcn.004b748c
test al, al
jne 0x4c49a1
push dword [0x53dfa8]
lea edx, [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xb8]
push dword [ebp - 0x1c]
push dword [0x53dfa8]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004051f0
mov eax, dword [ebp - 0x18]
call fcn.004b75a4
test al, al
jne 0x4c49a1
push dword [0x53dfa4]
push edi
push dword [0x53dfa4]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004051f0
mov eax, dword [ebp - 0x20]
call fcn.004b75a4
test al, al
jne 0x4c49a1
mov ecx, 0x4c4a30
mov dl, 1
mov eax, dword [0x4ab0b0]
call fcn.0040d100
call fcn.00404220
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.004be298
lea eax, [ebx + 4]
mov edx, esi
call fcn.00404fcc
lea eax, [ebx + 8]
call fcn.00404f90
lea eax, [ebx + 0x30]
mov edx, edi
call fcn.00404fcc
lea eax, [ebx + 0x34]
mov edx, dword [ebp + 8]
call fcn.00404fcc
mov byte [ebx + 0xc], 0xc
mov ax, word [0x4c4a4c]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4a04
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00404fa8
ret

Function at 0x4f9500
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f957b
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
push 0x59
call sub.kernel32.dll_GetThreadLocale_1
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4f9562
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00404af4
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.00409154
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f9582
lea eax, [ebp - 0x104]
call fcn.00404884
ret
Function at 0x5084d4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x50858e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x1c]
sub eax, dword [ebx + 0x10]
add dword [ebx + 0xc], eax
mov eax, dword [ebx + 0x20]
mov dl, byte [ebx + 0x30]
mov byte [eax], dl
mov esi, dword [ebx + 0x14]
mov eax, dword [ebx + 0x1c]
sub esi, eax
test esi, esi
je 0x508513
mov edx, dword [ebx + 0x10]
mov ecx, esi
call fcn.00402b54
add esi, dword [ebx + 0x10]
mov dword [ebx + 0x14], esi
mov ecx, dword [ebx + 0x18]
sub ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 4]
mov esi, dword [eax]
call dword [esi + 0xc]
add dword [ebx + 0x14], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0x1c], eax
mov esi, dword [ebx + 0x14]
mov dword [ebx + 0x20], esi
cmp esi, dword [ebx + 0x18]
jne 0x50856a
mov edx, esi
dec edx
mov eax, dword [ebx + 0x10]
call fcn.0041df90
mov edi, eax
mov dword [ebx + 0x20], edi
cmp edi, dword [ebx + 0x10]
jne 0x50856a
lea edx, [ebp - 4]
mov eax, dword [0x53f6c8]
call fcn.00406c28
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005083d4
mov eax, dword [ebx + 0x20]
mov al, byte [eax]
mov byte [ebx + 0x30], al
mov eax, dword [ebx + 0x20]
mov byte [eax], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x508595
lea eax, [ebp - 4]
call fcn.00404884
ret
Function at 0x52965c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x529664
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x529856
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x52986c
mov eax, esi
call fcn.005274e8
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004048d8
lea ecx, [ebp - 0x10]
mov edx, 0x529880
mov eax, esi
call fcn.005274e8
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004048d8
lea ecx, [ebp - 0x14]
mov edx, 0x529898
mov eax, esi
call fcn.005274e8
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004048d8
lea ecx, [ebp - 0x18]
mov edx, 0x5298b4
mov eax, esi
call fcn.005274e8
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004048d8
lea ecx, [ebp - 0x1c]
mov edx, 0x5298d0
mov eax, esi
call fcn.005274e8
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004048d8
lea ecx, [ebp - 0x24]
mov edx, 0x5298e8
mov eax, esi
call fcn.005274e8
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00409368
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409a24
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x529900
mov eax, esi
call fcn.005274e8
mov eax, dword [ebp - 0x28]
call fcn.00520fc0
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x529910
mov eax, esi
call fcn.005274e8
mov eax, dword [ebp - 0x2c]
call fcn.00520fc0
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x529928
mov eax, esi
call fcn.005274e8
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409a24
inc eax
je 0x5297f9
lea ecx, [ebp - 0x34]
mov edx, 0x529928
mov eax, esi
call fcn.005274e8
mov eax, dword [ebp - 0x34]
call fcn.004099e8
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040b03c
fstp qword [ebp - 0x3c]
wait
call fcn.0040b3a0
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x529814
lea ecx, [ebp - 0x40]
mov edx, 0x529928
mov eax, esi
call fcn.005274e8
mov eax, dword [ebp - 0x40]
call fcn.00520fc0
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x529938
mov eax, esi
call fcn.005274e8
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004048d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52985d
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004048a8
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004048a8
ret
Function at 0x5305e8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x530642
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.005305d8
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0051fc2c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0051f82c
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x530649
lea eax, [ebp - 4]
call fcn.00404884
ret
Function at 0x539714
Capabilities:
Create process on windows
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x53971c
push ecx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404d34
xor eax, eax
push ebp
push 0x539910
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.00404f90
push eax
lea ecx, [ebp - 0x18]
mov edx, 0xcb
mov eax, dword [esi + 0x2f8]
call fcn.004865b0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, 0x53991c
call fcn.0040678c
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0xb0]
call fcn.00406858
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.00404b0c
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x3b8]
call fcn.00460e28
mov al, byte [0x53992c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x539938
mov edx, 0x539944
mov eax, dword [ebp - 8]
call fcn.0040e604
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.0040491c
mov eax, dword [esi + 0x480]
mov edx, dword [eax]
call dword [edx + 0xe0]
lea eax, [ebp - 0xc]
mov edx, 0x539950
call fcn.0040491c
lea eax, [ebp - 0xc]
mov edx, 0x5399b8
call fcn.00404b4c
lea eax, [ebp - 0xc]
mov edx, 0x5399f0
call fcn.00404b4c
lea eax, [ebp - 0xc]
mov edx, 0x539a74
call fcn.00404b4c
push dword [ebp - 0xc]
push 0x539ad8
push dword [ebp - 8]
push 0x539af0
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00404c04
lea eax, [ebp - 0xc]
mov edx, 0x539afc
call fcn.00404b4c
lea eax, [ebp - 0xc]
mov edx, 0x539b38
call fcn.00404b4c
mov eax, dword [esi + 0x480]
mov eax, dword [eax + 0x220]
mov edx, 0x539b58
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x539b70
push dword [ebp - 4]
push 0x539b80
push dword [ebp - 0xc]
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404c04
mov edx, dword [ebp - 0x20]
mov eax, dword [esi + 0x480]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x539b70
push dword [ebp - 4]
push 0x539ba8
push dword [ebp - 0xc]
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00404c04
mov edx, dword [ebp - 0x24]
mov eax, dword [esi + 0x480]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [esi + 0x480]
mov eax, dword [eax + 0x220]
mov edx, 0x539bd0
mov ecx, dword [eax]
call dword [ecx + 0x74]
push 1
push 0x539bdc
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x539917
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004048a8
lea eax, [ebp - 0x18]
call fcn.00406748
lea eax, [ebp - 0x14]
call fcn.00406748
lea eax, [ebp - 0x10]
call fcn.00404f90
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004048a8
ret
Function at 0x53a308
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x53a474
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x3c0]
mov edx, dword [eax]
call dword [edx + 0xe0]
mov eax, dword [ebx + 0x3c0]
mov eax, dword [eax + 0x220]
call fcn.0041fa50
mov eax, dword [ebx + 0x450]
mov eax, dword [eax + 0x22c]
call fcn.004489bc
dec eax
test eax, eax
jl 0x53a3fb
inc eax
mov dword [ebp - 8], eax
xor esi, esi
mov eax, dword [ebx + 0x450]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.004489ec
mov eax, dword [eax + 8]
lea ecx, [ebp - 0xc]
xor edx, edx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 0x450]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.004489ec
mov eax, dword [eax + 0x24]
lea edx, [ebp - 0x10]
call fcn.00535734
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0x488]
call fcn.00460df8
mov edx, dword [ebp - 0x14]
mov eax, ebx
pop ecx
call fcn.00538780
mov eax, dword [ebx + 0x3c0]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x3c0]
mov eax, dword [eax + 0x220]
mov edx, 0x53a48c
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec dword [ebp - 8]
jne 0x53a364
mov eax, dword [ebx + 0x3c0]
mov eax, dword [eax + 0x220]
mov edx, 0x53a4ac
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [ebx + 0x3c0]
mov eax, dword [eax + 0x220]
call fcn.0041fb0c
push 1
mov ecx, 0x53a4bc
mov edx, 0x53a4c4
mov eax, dword [0x53f7a4]
mov eax, dword [eax]
call fcn.00481044
dec eax
jne 0x53a449
push 1
push 0x53a4dc
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53a47b
lea eax, [ebp - 0x14]
call fcn.00404884
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004048a8
lea eax, [ebp - 4]
call fcn.00404884
ret
Function at 0x4010e0
Capabilities:
Terminate process

Disassembly:
push esi
push 0xfb8
call fcn.0040ed4f
mov esi, eax
add esp, 4
test esi, esi
je 0x40111c
push 0xfb8
push 0
push esi
call fcn.00411600
add esp, 0xc
mov dword [esi], 0xff
mov dword [esi + 4], 0xffff
mov eax, esi
mov dword [esi + 8], 0x9f
pop esi
ret
push 0x4258c8
push 3
push 0x4258d4
push 0xbd
push 0x4258f8
call fcn.0040bc30
add esp, 0x14
push 0xffffffffffffffff
call fcn.0040f750
int3
Function at 0x4027f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f2d8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
mov eax, dword [0x42a010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x42ca30], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
jne 0x402890
push 0
push 0
push 0
push 0
call esi
mov dword [0x42ca30], eax
test eax, eax
je 0x40283d
cmp eax, 0xffffffff
jne 0x402890
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x24]
call fcn.0040b400
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x40285c
mov eax, dword [eax]
push eax
push 0x425d5c
push 3
push str.AgNet::CSClientSocket::InitRenderEvent
push 0x42
push str.SClientSocket.cpp
call fcn.0040bc30
add esp, 0x18
cmp dword [ebp - 0x10], 8
jb 0x402889
push dword [ebp - 0x24]
call fcn.0040ed3b
add esp, 4
push 0xfffffffffffffffe
call fcn.0040f750
cmp dword [0x42ca2c], 0
jne 0x402904
push 0
push 0
push 0
push 0
call esi
mov dword [0x42ca2c], eax
test eax, eax
je 0x4028b1
cmp eax, 0xffffffff
jne 0x402904
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x24]
call fcn.0040b400
mov dword [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x4028d0
mov eax, dword [eax]
push eax
push 0x425d5c
push 3
push str.AgNet::CSClientSocket::InitRenderEvent
push 0x4e
push str.SClientSocket.cpp
call fcn.0040bc30
add esp, 0x18
cmp dword [ebp - 0x10], 8
jb 0x4028fd
push dword [ebp - 0x24]
call fcn.0040ed3b
add esp, 4
push 0xfffffffffffffffe
call fcn.0040f750
cmp dword [0x42ca28], 0
jne 0x402978
push 0
push 0
push 0
push 0
call esi
mov dword [0x42ca28], eax
test eax, eax
je 0x402925
cmp eax, 0xffffffff
jne 0x402978
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x3c]
call fcn.0040b400
mov dword [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x402944
mov eax, dword [eax]
push eax
push 0x425d5c
push 3
push str.AgNet::CSClientSocket::InitRenderEvent
push 0x5a
push str.SClientSocket.cpp
call fcn.0040bc30
add esp, 0x18
cmp dword [ebp - 0x28], 8
jb 0x402971
push dword [ebp - 0x3c]
call fcn.0040ed3b
add esp, 4
push 0xfffffffffffffffe
call fcn.0040f750
push 0x42ca10
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402b10
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x42a010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x210
lea eax, [ebp - 0x214]
mov esi, ecx
push 0
push eax
call fcn.00411600
mov dword [ebp - 0x218], esi
lea eax, [ebp - 0x210]
mov esi, 0x426508
mov dword [ebp - 0x214], 0
mov ecx, eax
mov dword [ebp - 8], 2
add esp, 0xc
mov edx, 0x104
sub esi, ecx
jmp 0x402b70
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x402b8e
movzx ecx, word [esi + eax]
test cx, cx
je 0x402b8e
mov word [eax], cx
add eax, 2
dec edx
jne 0x402b70
jmp 0x402b92
test edx, edx
jne 0x402b95
sub eax, 2
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
push 0x4029a0
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
xor ecx, ebp
pop esi
call fcn.0040ed40
mov esp, ebp
pop ebp
ret

Function at 0x402bd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f313
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x42a010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi], vtable.AgNet::CTcpSocket.0
mov eax, dword [eax]
mov dword [esi + 4], eax
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.004010e0
mov dword [esi + 0x14], eax
call fcn.004010e0
mov dword [eax + 4], 0xffff
mov dword [eax + 8], 0xff
mov dword [esi + 0x18], eax
call fcn.004010e0
mov dword [eax + 4], 0xffff
mov dword [eax + 8], 0xff
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xfa1
mov dword [ebp - 4], 0
xor eax, eax
mov dword [esi], vtable.AgNet::CSClientSocket.0
mov dword [esi + 0x24], 0
mov dword [esi + 0x44], 7
mov dword [esi + 0x40], 0
mov word [esi + 0x30], ax
mov byte [ebp - 4], 1
call fcn.004027f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x402fa0
Capabilities:
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f338
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x42a010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ecx + 0x14]
xor eax, eax
add edx, 0x14
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [edx], ax
jne 0x402fee
xor ecx, ecx
jmp 0x403002
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402ff3
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00401830
mov ecx, dword [ebp - 0x18]
mov ebx, 0x4266b0
mov edx, dword [ebx]
cmp word [edx], 0
jne 0x403020
xor eax, eax
jmp 0x403037
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403025
mov ecx, dword [ebp - 0x18]
sub eax, esi
sar eax, 1
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
mov edi, eax
cmovae esi, dword [ebp - 0x28]
cmp ecx, eax
cmovb edi, ecx
test edi, edi
jne 0x4030a5
xor ecx, ecx
test ecx, ecx
jne 0x403066
mov ecx, dword [ebp - 0x18]
cmp ecx, eax
jb 0x403069
xor ecx, ecx
cmp dword [ebp - 0x18], eax
setne cl
test ecx, ecx
je 0x4030c4
mov ecx, dword [ebp - 0x18]
add ebx, 4
cmp ebx, 0x4266c4
jl 0x403014
xor esi, esi
cmp dword [ebp - 0x14], 8
jb 0x403087
push dword [ebp - 0x28]
call fcn.0040ed3b
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ed40
mov esp, ebp
pop ebp
ret
mov cx, word [esi]
cmp cx, word [edx]
jne 0x4030b6
add esi, 2
add edx, 2
dec edi
jmp 0x40304b
movzx ecx, word [esi]
cmp cx, word [edx]
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x40304f
mov esi, 1
jmp 0x403076
Function at 0x403560
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f3a8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x42a010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0x18]
test eax, eax
jne 0x4035a2
mov ecx, esi
call fcn.004042d0
jmp 0x403718
push 0x32840
mov dword [ebp - 0x60], 0x32840
call fcn.0040ebc6
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4035c3
push 0xffffffffffffffff
call fcn.0040f750
push dword [ebp - 0x60]
push 0
push ebx
call fcn.00411600
add esp, 0xc
lea eax, [ebp - 0x5c]
push 0x44
push 0
push eax
call fcn.00411600
add esp, 0xc
lea ecx, [ebp - 0x5c]
call fcn.00401b40
push ecx
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 0
push eax
push ebx
lea ecx, [ebp - 0x5c]
call fcn.00401c20
test eax, eax
jne 0x40368f
push 0x425f3c
push 3
push str.AgNet::CSClientSocket::HandleReadIDCard
push 0x216
push str.SClientSocket.cpp
call fcn.0040bc30
add esp, 0x14
lea ecx, [ebp - 0x7c]
push 0x425f3c
call fcn.00401930
lea eax, [ebp - 0x7c]
mov ecx, esi
push eax
push 0xa5
call fcn.004034b0
cmp dword [ebp - 0x68], 8
jb 0x403652
push dword [ebp - 0x7c]
call fcn.0040ed3b
add esp, 4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
test eax, eax
jne 0x403707
push 0x425f98
push 3
push str.AgNet::CSClientSocket::HandleReadIDCard
push 0x21a
push str.SClientSocket.cpp
call fcn.0040bc30
mov eax, dword [esi]
add esp, 0x14
mov ecx, esi
call dword [eax + 0x24]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
jmp 0x403707
mov ecx, dword [ebp - 0x60]
xor edx, edx
mov eax, ecx
xor edi, edi
div dword [esi + 0x20]
cmp edi, edx
sbb edx, edx
neg edx
add edx, eax
mov dword [ebp - 0x64], edx
test edx, edx
jle 0x403707
lea ebx, [ebx]
push 0xa2
push ebx
push edi
push ecx
push ecx
push 0xa5
mov ecx, esi
call fcn.00403410
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
test eax, eax
je 0x4036e2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
inc edi
cmp edi, dword [ebp - 0x64]
jge 0x403707
mov ecx, dword [ebp - 0x60]
jmp 0x4036b0
push 0x425fb0
push 3
push str.AgNet::CSClientSocket::HandleReadIDCard
push 0x22b
push str.SClientSocket.cpp
call fcn.0040bc30
mov eax, dword [esi]
add esp, 0x14
mov ecx, esi
call dword [eax + 0x24]
push ebx
call fcn.0040f764
add esp, 4
lea ecx, [ebp - 0x5c]
call fcn.00401ba0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040ed40
mov esp, ebp
pop ebp
ret 4
Function at 0x403e00
Capabilities:
Check if file exists
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f478
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x42a010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x403e36
mov ebx, dword [esi]
jmp 0x403e38
mov ebx, esi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403fac
push ebx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x403fac
cmp dword [esi + 0x14], 8
jb 0x403e60
mov eax, dword [esi]
jmp 0x403e62
mov eax, esi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x403e96
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [ebp - 0x14]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
test ebx, ebx
je 0x403f7a
push ebx
call fcn.0040ebc6
mov ebx, dword [ebp + 8]
add esp, 4
mov dword [edi], eax
push dword [ebx]
push 0
push eax
call fcn.00411600
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x403ec6
mov esi, dword [esi]
mov edx, dword [edi]
mov ecx, esi
push ebx
call fcn.0040add0
add esp, 4
test eax, eax
jne 0x403f63
mov esi, dword [edi]
push esi
call fcn.0040f764
add esp, 4
test esi, esi
je 0x403ef0
mov dword [edi], 0x8123
mov dword [edi], 0
mov dword [ebx], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x2c]
call fcn.0040b400
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x403f1b
mov eax, dword [eax]
push eax
push 0x426220
push 3
push str.AgNet::GetFileBuffer
push 0x323
push str.SClientSocket.cpp
call fcn.0040bc30
add esp, 0x18
cmp dword [ebp - 0x18], 8
jb 0x403fd3
push dword [ebp - 0x2c]
call fcn.0040ed3b
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x426240
push 3
push str.AgNet::GetFileBuffer
push 0x32a
push str.SClientSocket.cpp
call fcn.0040bc30
add esp, 0x14
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x403fb4
mov esi, dword [esi]
push esi
push 0x4261e0
push 3
push str.AgNet::GetFileBuffer
push 0x315
push str.SClientSocket.cpp
call fcn.0040bc30
add esp, 0x18
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret