joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4068a0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x406a01
push 0x24
push str.APlayerService
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x4068f2
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push str.APlayerService
call fcn.00406a10
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x4af748], 0
je 0x4069dd
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x104], ax
lea eax, [ebp - 0x102]
push eax
call fcn.00449690
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push eax
call fcn.00449690
add esp, 0x18
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 4], 0x40
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor ecx, ecx
lea esp, [esp]
movzx eax, word [ecx + 0x4620d0]
mov word [ebp + ecx - 0x84], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x406950
push esi
lea edx, [ebp - 0x104]
push edi
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x406971
lea edi, [ebp - 0x84]
sub edx, esi
add edi, 0xfffffffe
jmp 0x406990
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x406990
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x4af758
lea eax, [ebp - 0x84]
push eax
push 0x46b384
push 3
mov ecx, edx
and ecx, 3
push str.APlayer_Service
push str.APlayerService
rep movsb byte es:[edi], byte [esi]
call fcn.00406610
add esp, 0x18
pop edi
pop esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x46b384
push 3
push str.APlayer_Service
push str.APlayerService
call fcn.00406610
add esp, 0x18
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406a10
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
push edi
push 1
push eax
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x406ac9
push ebx
push esi
push 0x24
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x406abd
lea eax, [ebp - 0x1c]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x406a9d
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x406a9d
lea esp, [esp]
cmp dword [ebp - 0x18], 3
jne 0x406a9d
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x406a80
push esi
call ebx
push 0x10
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x406abd
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push edi
call ebx
test esi, esi
je 0x406ac7
push esi
call ebx
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x406ad0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor eax, eax
push ebx
push 1
push eax
push eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x406b75
push esi
push edi
push 0x10024
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x406b63
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x406b5c
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push esi
call ebx
test eax, eax
je 0x406b59
cmp dword [ebp - 0x1c], 3
jne 0x406b59
push 0x64
call edi
lea eax, [ebp - 0x20]
push eax
push esi
call ebx
test eax, eax
jne 0x406b44
mov ebx, dword [ebp - 4]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call edi
test esi, esi
je 0x406b73
push esi
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406d80
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], vtable.NPT_Md5Digest.0
mov dword [ecx + 0x58], 0x67452301
mov dword [ecx + 0x5c], 0xefcdab89
mov dword [ecx + 0x60], 0x98badcfe
mov dword [ecx + 0x64], 0x10325476
mov eax, ecx
ret
Function at 0x406dc0
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], vtable.NPT_Sha1Digest.0
mov dword [ecx + 0x58], 0x67452301
mov dword [ecx + 0x5c], 0xefcdab89
mov dword [ecx + 0x60], 0x98badcfe
mov dword [ecx + 0x64], 0x10325476
mov dword [ecx + 0x68], 0xc3d2e1f0
mov eax, ecx
ret

Function at 0x406e10
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], vtable.NPT_Sha256Digest.0
mov dword [ecx + 0x58], 0x6a09e667
mov dword [ecx + 0x5c], 0xbb67ae85
mov dword [ecx + 0x60], 0x3c6ef372
mov dword [ecx + 0x64], 0xa54ff53a
mov dword [ecx + 0x68], 0x510e527f
mov dword [ecx + 0x6c], 0x9b05688c
mov dword [ecx + 0x70], 0x1f83d9ab
mov dword [ecx + 0x74], 0x5be0cd19
mov eax, ecx
ret
Function at 0x4074d0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
lea eax, [ebp - 0x150]
xor esi, esi
mov dword [ebp - 0xc], ebx
sub edi, eax
mov edi, edi
lea eax, [edi + esi*4]
lea eax, [ebp + eax - 0x150]
push eax
call fcn.004320e0
mov dword [ebp + esi*4 - 0x150], eax
inc esi
add esp, 4
cmp esi, 0x10
jb 0x4074f0
mov eax, dword [ebx + 0x58]
mov edi, dword [ebx + 0x60]
mov dword [ebp - 0x10], eax
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
mov ebx, dword [ebx + 0x64]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x148]
mov eax, dword [eax + 0x68]
mov dword [ebp - 4], eax
mov edx, 0x40
lea esp, [esp]
mov eax, dword [ecx + 0x2c]
xor eax, dword [ecx + 0x18]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 0xc]
xor eax, dword [ecx - 4]
rol eax, 1
mov dword [ecx + 0x34], eax
dec edx
jne 0x407540
mov eax, dword [ebp + 8]
xor esi, esi
lea esp, [esp]
mov ecx, dword [ebp + 8]
mov edx, eax
rol edx, 5
mov eax, ebx
xor eax, edi
and eax, dword [ebp - 8]
inc esi
xor eax, ebx
add edx, eax
add edx, dword [ebp + esi*4 - 0x154]
mov eax, dword [ebp - 4]
add eax, 0x5a827999
mov dword [ebp - 4], ebx
mov ebx, edi
mov edi, dword [ebp - 8]
add edx, eax
mov eax, edx
ror edi, 2
mov dword [ebp - 8], ecx
mov dword [ebp + 8], eax
cmp esi, 0x14
jb 0x407560
cmp esi, 0x28
jae 0x4075d7
rol edx, 5
mov eax, ebx
xor eax, edi
xor eax, ecx
add edx, eax
mov eax, dword [ebp - 4]
add edx, dword [ebp + esi*4 - 0x150]
mov dword [ebp - 4], ebx
mov ebx, edi
add eax, 0x6ed9eba1
mov edi, ecx
ror edi, 2
mov ecx, dword [ebp + 8]
add edx, eax
inc esi
mov dword [ebp + 8], edx
cmp esi, 0x28
jb 0x4075a2
mov dword [ebp - 8], ecx
cmp esi, 0x3c
jae 0x40761d
lea esp, [esp]
rol edx, 5
mov ecx, edi
or ecx, dword [ebp - 8]
mov eax, edi
and eax, dword [ebp - 8]
and ecx, ebx
or ecx, eax
add ecx, 0x8f1bbcdc
add ecx, dword [ebp + esi*4 - 0x150]
inc esi
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ebx
mov ebx, edi
mov edi, dword [ebp - 8]
add edx, ecx
ror edi, 2
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp + 8], edx
cmp esi, 0x3c
jb 0x4075e0
cmp esi, 0x50
jae 0x407653
rol edx, 5
mov eax, ebx
xor eax, edi
xor eax, ecx
add eax, dword [ebp + esi*4 - 0x150]
add edx, 0xca62c1d6
add eax, dword [ebp - 4]
mov dword [ebp - 4], ebx
mov ebx, edi
mov edi, ecx
mov ecx, dword [ebp + 8]
ror edi, 2
add edx, eax
inc esi
mov dword [ebp + 8], edx
cmp esi, 0x50
jb 0x407622
mov eax, dword [ebp - 0x10]
add eax, edx
mov edx, dword [ebp - 0xc]
add dword [edx + 0x60], edi
add dword [edx + 0x64], ebx
add dword [edx + 0x5c], ecx
pop edi
mov dword [edx + 0x58], eax
mov eax, dword [ebp - 4]
add dword [edx + 0x68], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x407680
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x64]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x6c]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x70]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x74]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x124]
xor edi, edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], ecx
sub ebx, eax
mov edi, edi
lea eax, [ebx + edi*4]
lea eax, [ebp + eax - 0x124]
push eax
call fcn.004320e0
mov dword [ebp + edi*4 - 0x124], eax
inc edi
add esp, 4
cmp edi, 0x10
jb 0x4076d0
lea ebx, [ebp - 0xec]
mov esi, 0x30
jmp 0x407700
mov ecx, dword [ebx]
mov edx, dword [ebx - 0x34]
mov edi, ecx
rol edi, 0xf
mov eax, ecx
shr ecx, 0xa
rol eax, 0xd
xor edi, eax
xor edi, ecx
mov ecx, edx
mov eax, edx
shr edx, 3
lea ebx, [ebx + 4]
rol ecx, 0xe
ror eax, 7
xor ecx, eax
xor ecx, edx
add edi, ecx
add edi, dword [ebx - 0x3c]
add edi, dword [ebx - 0x18]
mov dword [ebx + 4], edi
dec esi
jne 0x407700
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
mov edi, dword [ebp - 4]
mov edx, ecx
ror edx, 0xb
mov eax, ecx
add ebx, 4
rol eax, 7
xor edx, eax
mov eax, ecx
ror eax, 6
xor edx, eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0xc]
and eax, ecx
xor eax, dword [ebp - 8]
mov ecx, edi
ror ecx, 0xd
add edx, eax
add edx, dword [ebx + 0x4620f4]
mov eax, edi
add edx, dword [ebp + ebx - 0x128]
add edx, dword [ebp - 0x1c]
add dword [ebp - 0x14], edx
rol eax, 0xa
xor ecx, eax
mov eax, edi
ror eax, 2
xor ecx, eax
mov eax, dword [ebp - 0x20]
mov edi, eax
or edi, dword [ebp - 4]
and eax, dword [ebp - 4]
and edi, dword [ebp - 0x10]
add ecx, edx
mov edx, dword [ebp - 0x10]
or edi, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
add edi, ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], edi
cmp ebx, 0x100
jb 0x407740
add dword [esi + 0x5c], eax
mov eax, dword [ebp - 0x10]
add dword [esi + 0x60], eax
mov eax, dword [ebp - 0xc]
add dword [esi + 0x6c], eax
mov eax, dword [ebp - 8]
add dword [esi + 0x70], eax
add dword [esi + 0x58], edi
add dword [esi + 0x64], edx
add dword [esi + 0x68], ecx
mov eax, dword [ebp - 0x1c]
add dword [esi + 0x74], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409e80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45d77f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
push dword [ebp + 0xc]
lea ecx, [esi + 8]
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.PLT_Service.0
mov dword [esi + 4], eax
call fcn.00428ee0
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
call fcn.00428ee0
mov edi, dword [ebp + 0x14]
push edi
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 1
call fcn.00428ee0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
push 0
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 7
call fcn.004282a0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
push dword [ebp + 0x18]
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 0xb
mov byte [esi + 0x68], 0
call fcn.00428ee0
mov byte [ebp - 4], 0xc
test edi, edi
je 0x409f8f
push edi
mov ecx, esi
call fcn.0040c1e0
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x410150
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45de5e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push 0
mov esi, ecx
call fcn.004282a0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi + 0x2c], 1
mov byte [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov byte [esi + 0x38], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x41a6a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ea4a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
push str.Plutinosoft_LLC
lea ecx, [ebx + 8]
mov dword [ebp - 4], 0
mov dword [ebx], vtable.PLT_DeviceData.0
call fcn.00428ee0
push str.http:__www.plutinosoft.com
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 1
call fcn.00428ee0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
mov edi, dword [ebp + 0x30]
lea ecx, [ebx + 0x3c]
push edi
mov byte [ebp - 4], 0xd
call fcn.00428ee0
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x40]
mov byte [ebp - 4], 0xe
call fcn.0041a5f0
mov dword [ebx + 0x40], vtable.NPT_HttpUrl.0
lea ecx, [ebx + 0x68]
mov byte [ebp - 4], 0xf
call fcn.004380b0
mov dword [ebx + 0x68], vtable.NPT_HttpUrl.0
push dword [ebp + 0x3c]
lea ecx, [ebx + 0x90]
mov byte [ebp - 4], 0x10
call fcn.00428ee0
push dword [ebp + 0x40]
lea ecx, [ebx + 0x94]
mov byte [ebp - 4], 0x11
call fcn.00428ee0
mov dword [ebx + 0x98], 0
mov dword [ebx + 0x9c], 0
mov dword [ebx + 0xa0], 0
mov dword [ebx + 0xa4], 0
mov dword [ebx + 0xa8], 0
mov dword [ebx + 0xac], 0
mov dword [ebx + 0xb0], 0
mov dword [ebx + 0xb4], 0
mov dword [ebx + 0xb8], 0
mov dword [ebx + 0xbc], 0
mov dword [ebx + 0xc0], 0
mov dword [ebx + 0xc4], 0
mov dword [ebx + 0xc8], 0
lea ecx, [ebx + 0xcc]
mov byte [ebp - 4], 0x15
call fcn.00438b30
mov dword [ebx + 0xd4], 0
mov byte [ebp - 4], 0x17
mov dword [ebx + 0xd8], 0
mov dword [ebx + 0xdc], 0
test edi, edi
je 0x41a85c
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x41a851
sub edi, ecx
jne 0x41a868
lea eax, [ebx + 0x3c]
push eax
call fcn.0040afe0
add esp, 4
fldz
sub esp, 8
mov ecx, esp
sub esp, 8
fstp qword [esp]
call fcn.0042a020
sub esp, 8
lea eax, [ebp + 0x34]
mov ecx, esp
push eax
call fcn.0042a000
mov ecx, ebx
call fcn.0041d260
lea eax, [ebx + 0x40]
push eax
mov ecx, ebx
call fcn.0041d320
call fcn.00437ee0
and eax, 0xffffff
cmp dword [ebx + 0xe0], eax
jne 0x41a8b4
test eax, eax
je 0x41a8b3
dec eax
jmp 0x41a8b4
inc eax
lea ecx, [ebp + 8]
mov dword [ebx + 0xe0], eax
call fcn.0040a120
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x3c
Function at 0x4251a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f906
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
push dword [ebp + 8]
mov byte [ebp - 4], 0xa
mov byte [esi + 0x34], 0
call fcn.004254f0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4288f1
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jbe 0x428902
mov eax, 0xffffb1d7
pop esi
pop ecx
ret
push ebx
mov bl, byte [esi + 0x10]
lea eax, [esp + 8]
push eax
push 0
push esi
push 0x428690
push 0
push 0
call fcn.004487c4
add esp, 0x18
test eax, eax
jne 0x42892a
pop ebx
or eax, 0xffffffff
pop esi
pop ecx
ret
test bl, bl
je 0x42893b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
xor eax, eax
pop esi
pop ecx
ret
mov dword [esi + 0x14], eax
pop ebx
xor eax, eax
pop esi
pop ecx
ret
Function at 0x438fb0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esp + 8], 1
mov dword [esi], eax
mov al, byte [esp + 0xc]
and al, 1
mov byte [esi + 0x19], al
lea eax, [esp + 8]
push eax
push 0x8004667e
push dword [esi]
mov dword [esi + 4], 0xffffffff
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov byte [esi + 0x18], 0
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test byte [esp + 0xc], 1
je 0x439032
push edi
lea edi, [esi + 0x1c]
push edi
push 0
push 2
push 1
call fcn.0043ad80
add esp, 0x10
test eax, eax
mov eax, esi
je 0x43902d
mov dword [esi + 0x20], 0xffffffff
mov dword [edi], 0xffffffff
mov byte [esi + 0x19], 0
pop edi
pop esi
ret 8
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x1c], 0xffffffff
mov eax, esi
pop esi
ret 8

Function at 0x439110
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
push edi
push dword [esp + 0x10]
mov edi, ecx
push 0
push 2
mov dword [edi], vtable.NPT_UdpMulticastSocketInterface.0
push 2
mov dword [edi + 4], vtable.NPT_UdpSocketInterface.0
call dword [sym.imp.WS2_32.dll_socket]
push eax
lea ecx, [edi + 8]
call fcn.00438f00
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [esp + 0x14]
push eax
mov eax, dword [edi + 0xc]
push 0x20
push 0xffff
mov dword [edi + 4], vtable.NPT_BsdUdpSocket.0
mov dword [edi + 8], vtable.NPT_BsdUdpSocket.1.0
mov dword [esp + 0x20], 1
push dword [eax]
call esi
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [edi + 0xc]
push 0xb
push 0
mov dword [edi], vtable.NPT_BsdUdpMulticastSocket.0
mov dword [edi + 4], vtable.NPT_BsdUdpMulticastSocket.1.0
mov dword [edi + 8], vtable.NPT_BsdUdpMulticastSocket.2.0
mov dword [esp + 0x18], 1
push dword [eax]
call esi
mov eax, edi
pop edi
pop esi
pop ecx
ret 4

Function at 0x4391b0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov edi, ecx
push 0
push 2
push 2
mov dword [edi], vtable.NPT_UdpSocketInterface.0
call dword [sym.imp.WS2_32.dll_socket]
push eax
lea ecx, [edi + 4]
call fcn.00438f00
push 4
lea eax, [esp + 0x10]
push eax
mov eax, dword [edi + 8]
push 0x20
push 0xffff
mov dword [edi], vtable.NPT_BsdUdpSocket.0
mov dword [edi + 4], vtable.NPT_BsdUdpSocket.1.0
mov dword [esp + 0x1c], 1
push dword [eax]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x439210
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push esi
push edi
push 0x2c
mov edi, ecx
call fcn.00447d70
mov esi, eax
add esp, 4
test esi, esi
je 0x439252
push dword [esp + 0xc]
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push eax
mov ecx, esi
call fcn.00438f00
mov dword [esi], vtable.NPT_BsdTcpClientSocket.0
mov dword [edi + 4], esi
mov dword [edi], vtable.NPT_TcpClientSocket.0
mov eax, edi
pop edi
pop esi
ret 4
xor esi, esi
mov dword [edi + 4], esi
mov dword [edi], vtable.NPT_TcpClientSocket.0
mov eax, edi
pop edi
pop esi
ret 4
Function at 0x439270
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi + 8], vtable.NPT_TcpServerSocketInterface.0
push 0x34
mov dword [esi], vtable.NPT_TcpServerSocket.0
mov dword [esi + 8], vtable.NPT_TcpServerSocket.1.0
call fcn.00447d70
mov edi, eax
add esp, 4
test edi, edi
je 0x4392db
push dword [esp + 0x10]
mov dword [edi], vtable.NPT_TcpServerSocketInterface.0
push 0
push 1
push 2
lea ebx, [edi + 4]
call dword [sym.imp.WS2_32.dll_socket]
push eax
mov ecx, ebx
call fcn.00438f00
mov dword [edi], vtable.NPT_BsdTcpServerSocket.0
mov dword [ebx], vtable.NPT_BsdTcpServerSocket.1.0
mov dword [edi + 0x30], 0
mov dword [esi + 0xc], edi
pop edi
mov dword [esi + 4], ebx
mov eax, esi
pop esi
pop ebx
ret 4
xor edi, edi
xor ebx, ebx
mov dword [esi + 0xc], edi
pop edi
mov dword [esi + 4], ebx
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x439a36
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp byte [esp + 8], 0
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov byte [eax + 0x18], 1
je 0x439a4f
mov eax, dword [esi + 4]
push 2
push dword [eax]
call dword [sym.imp.WS2_32.dll_shutdown]
mov eax, dword [esi + 4]
pop esi
cmp byte [eax + 0x19], 0
je 0x439a70
push 0
push 1
lea ecx, [esp + 0xb]
push ecx
mov byte [esp + 0xf], 0
push dword [eax + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
xor eax, eax
pop ecx
ret 4

Function at 0x439bb3
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
mov eax, dword [esi + 8]
push ecx
lea ecx, [esp + 0xc]
push ecx
push 1
push 6
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 4
push dword [eax]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
je 0x439bed
mov eax, 0xffffb04a
pop esi
add esp, 0xc
ret
cmp dword [esp + 8], 1
jne 0x439bfb
xor eax, eax
pop esi
add esp, 0xc
ret
mov eax, dword [esi + 8]
push 4
lea ecx, [esp + 0xc]
push ecx
push 1
push 6
mov dword [esp + 0x18], 1
push dword [eax]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x439c27
mov eax, 0xffffb049
pop esi
add esp, 0xc
ret
push 0
push 0
lea eax, [esp + 0xf]
push eax
mov eax, dword [esi + 8]
mov byte [esp + 0x13], 0
push dword [eax]
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [esi + 8]
push 4
lea ecx, [esp + 0xc]
push ecx
push 1
push 6
mov dword [esp + 0x18], 0
push dword [eax]
call dword [sym.imp.WS2_32.dll_setsockopt]
neg eax
sbb eax, eax
and eax, 0xffffb049
pop esi
add esp, 0xc
ret