joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401532
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x40157f
mov al, cl
cmp al, 0x61
jb 0x40155a
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x40157f
mov al, cl
cmp al, 0x61
jb 0x401572
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x40154b
cmp edx, dword [esp + 0x18]
je 0x40158f
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x401544
xor eax, eax
jmp 0x401592
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x40159a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x401681
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x401687
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x4015e6
cmp al, 0x61
jb 0x4015de
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x4015d1
cmp edx, dword [esp + 0x14]
je 0x4015f6
dec ecx
jne 0x4015c6
xor eax, eax
jmp 0x401681
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x401681
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x401681
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x401632
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x401641
jmp 0x401629
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.00401532
test eax, eax
je 0x401681
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40167c
cmp al, 0x61
jb 0x401674
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x401667
call fcn.0040159a
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x40169f
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x40169f
sub edx, ecx
mov ecx, edx
jmp 0x4015f6
xor eax, eax
jmp 0x401681

Function at 0x4031bb
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004032a2
mov dword [ebp - 4], 0
mov eax, dword [0x42f9de]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x40321b
add dword [esp], 5
retf
Function at 0x4032a2
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x42f9de]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4032dd
add dword [esp], 5
retf

Function at 0x403378
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x42f9de]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4033b3
add dword [esp], 5
retf

Function at 0x403445
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x42f9de]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x403480
add dword [esp], 5
retf
Function at 0x407185
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x42f9de]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4071c0
add dword [esp], 5
retf

Function at 0x408726
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x42f9de]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x408761
add dword [esp], 5
retf

Function at 0x408857
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x42f9de]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x408892
add dword [esp], 5
retf

Function at 0x40bc46
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x42f9de]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x40bc81
add dword [esp], 5
retf

Function at 0x40bd84
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x42f9de]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x40bdbf
add dword [esp], 5
retf

Function at 0x40f64b
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x40f6fe
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x410cda
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x410d27
mov al, cl
cmp al, 0x61
jb 0x410d02
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x410d27
mov al, cl
cmp al, 0x61
jb 0x410d1a
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x410cf3
cmp edx, dword [esp + 0x18]
je 0x410d37
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x410cec
xor eax, eax
jmp 0x410d3a
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x410d42
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x410e29
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x410e2f
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x410d8e
cmp al, 0x61
jb 0x410d86
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x410d79
cmp edx, dword [esp + 0x14]
je 0x410d9e
dec ecx
jne 0x410d6e
xor eax, eax
jmp 0x410e29
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x410e29
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x410e29
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x410dda
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x410de9
jmp 0x410dd1
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.00410cda
test eax, eax
je 0x410e29
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x410e24
cmp al, 0x61
jb 0x410e1c
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x410e0f
call fcn.00410d42
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x410e47
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x410e47
sub edx, ecx
mov ecx, edx
jmp 0x410d9e
xor eax, eax
jmp 0x410e29

Function at 0x411cf8
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [0x42fa02], 0
jne 0x411d26
call fcn.0041093b
mov dword [0x42fa02], eax
mov dword [ebp - 4], 0
mov eax, dword [0x42fa02]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x411d4a
add dword [esp], 5
retf

Function at 0x4120d2
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4120fe
add dword [esp], 5
retf
Function at 0x4141bb
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x42f9de]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4141f6
add dword [esp], 5
retf

Function at 0x4142b9
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4142e5
add dword [esp], 5
retf
Function at 0x418902
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0x28
call fcn.0041bc23
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0xa
rep stosd dword es:[edi], eax
push ebx
push 8
call fcn.0041bc23
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
pop ebx
mov dword [ebp - 8], esp
mov eax, dword [ebp - 4]
push eax
push 0x24
call fcn.0041bc23
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], eax
push ebx
mov ebx, dword [ebx]
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
pop ebx
add ebx, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov dword [edi], ebx
add edi, 4
add ebx, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x418a05
push 0
push 0x409cb1a
push 6
call fcn.0041bc17
add esp, 0xc
mov ebx, dword [ebp - 0xc]
push ebx
mov edi, dword [ebp - 0x10]
push edi
mov edi, dword [edi]
push ebx
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
pop ebx
add ebx, 4
pop edi
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
add edi, 4
add ebx, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
call fcn.0041bc29
add esp, 4
cmp dword [ebp + 8], 1
jge 0x418acf
mov ebx, dword [ebp - 4]
add ebx, 0x14
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
fild dword [ebx]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x42e673]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x42e673]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.00404958
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
jmp 0x418ad7
push eax
mov ebx, dword [ebp - 4]
push ebx
push ebx
mov ebx, dword [ebx]
push ebx
call fcn.0041bc29
add esp, 4
pop ebx
call fcn.0041bc29
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4190ff
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 1
push 0
push 0
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x419156
push 0x19
push 0x409ca28
push 6
call fcn.0041bc17
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x4191c9
push 1
push dword [ebp - 4]
call fcn.004191d7
cmp dword [ebp + 0xc], 0
je 0x419188
cmp dword [ebp + 8], 1
je 0x419188
xor eax, eax
jmp 0x41918d
mov eax, 1
test eax, eax
je 0x4191c9
push 1
push dword [ebp - 4]
call fcn.00419270
push 1
push dword [ebp - 4]
call fcn.00419309
push 1
push dword [ebp - 4]
call fcn.004194b1
push 0
push dword [ebp - 4]
call fcn.0041954a
mov eax, dword [ebp - 4]
jmp 0x4191d1
mov esp, ebp
pop ebp
ret 8

Function at 0x4191d7
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esp
push 0
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x419215
push 0x47
push 0x409ca16
push 6
call fcn.0041bc17
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 1
push dword [ebp - 8]
push 0x20
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_setsockopt]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x419256
push 0x47
push 0x409ca16
push 6
call fcn.0041bc17
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
mov eax, 0
sete al
jmp 0x41926a
mov esp, ebp
pop ebp
ret 8

Function at 0x419270
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esp
push 0
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4192ae
push 0x47
push 0x409ca15
push 6
call fcn.0041bc17
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 1
push dword [ebp - 8]
push 4
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_setsockopt]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4192ef
push 0x47
push 0x409ca15
push 6
call fcn.0041bc17
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
mov eax, 0
sete al
jmp 0x419303
mov esp, ebp
pop ebp
ret 8
Function at 0x419309
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 8
call fcn.0041bc23
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
je 0x419355
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov word [ebx], 1
jmp 0x419363
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov word [ebx], 0
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov word [ebx], 0
mov dword [ebp - 0xc], esp
mov eax, dword [ebp - 4]
push eax
push 4
call fcn.0041bc23
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
call dword [sym.imp.KERNEL32.dll_LocalSize]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4193ce
push 0xcd
push 0x409ca12
push 6
call fcn.0041bc17
add esp, 0xc
push eax
mov ebx, dword [ebp - 0x10]
push ebx
mov edi, dword [ebp - 0x14]
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
call fcn.0041bc29
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
mov eax, dword [ebp - 4]
push eax
push 4
call fcn.0041bc23
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
push 0x80
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_setsockopt]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x419462
push 0x10c
push 0x409ca12
push 6
call fcn.0041bc17
add esp, 0xc
push eax
mov ebx, dword [ebp - 0x10]
push ebx
mov edi, dword [ebp - 0x14]
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
call fcn.0041bc29
add esp, 4
pop eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
mov eax, 0
sete al
jmp 0x41949d
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.0041bc29
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8

Function at 0x4194b1
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esp
push 0
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4194ef
push 0x47
push 0x409ca22
push 6
call fcn.0041bc17
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 1
push dword [ebp - 8]
push 1
push 6
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_setsockopt]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x419530
push 0x47
push 0x409ca22
push 6
call fcn.0041bc17
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
mov eax, 0
sete al
jmp 0x419544
mov esp, ebp
pop ebp
ret 8
Function at 0x41954a
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esp
push 0
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x419588
push 0x47
push 0x409ca17
push 6
call fcn.0041bc17
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 1
push dword [ebp - 8]
push 0xa
push 0
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_setsockopt]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4195c9
push 0x47
push 0x409ca17
push 6
call fcn.0041bc17
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
mov eax, 0
sete al
jmp 0x4195dd
mov esp, ebp
pop ebp
ret 8

Function at 0x4195e3
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esp
push 0
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x419621
push 0x47
push 0x409ca1b
push 6
call fcn.0041bc17
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 4
push dword [ebp - 8]
push 0x1002
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_setsockopt]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x419662
push 0x47
push 0x409ca1b
push 6
call fcn.0041bc17
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
mov eax, 0
sete al
jmp 0x419676
mov esp, ebp
pop ebp
ret 8
Function at 0x419ec2
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push dword [ebp + 8]
call fcn.00419fb9
mov dword [ebp - 4], eax
fild dword [ebp + 8]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x42e65b]
fstp qword [ebp - 0x14]
push dword [ebp + 8]
call fcn.0041a024
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push 0
push dword [ebp + 8]
mov eax, 0x10
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
mov eax, 0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
mov eax, 0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push 1
fld qword [ebp - 0x14]
call fcn.00404958
push eax
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
nop
nop
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x419f5c
push 0x8e
push 0x409c9ac
push 6
call fcn.0041bc17
add esp, 0xc
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x419fa9
mov dword [ebp - 4], esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x419f92
push 0xed
push 0x409c9ac
push 6
call fcn.0041bc17
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3e5
mov eax, 0
sete al
jmp 0x419fb3
mov eax, 1
jmp 0x419fb3
mov esp, ebp
pop ebp
ret 4
Function at 0x41c660
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.00422268
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x41c6ca
push esi
lea edi, [eax + 0x400]
call fcn.0042225d
push edi
call fcn.00422268
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x41c69a
push esi
xor edi, edi
call fcn.004208a0
add esp, 4
test eax, eax
je 0x41c6e5
push eax
push esi
call fcn.00420b70
add esp, 8
mov edi, eax
push esi
call fcn.0042225d
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x41e310
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
push 0x104
call fcn.0041bea0
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, 0x104
jbe 0x41e367
push ebx
push edi
call fcn.0041bfb0
push esi
mov ebx, esi
call fcn.0041bea0
add esp, 8
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
ja 0x41e33e
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret