joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492600
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00401acd
mov eax, dword [0x533d80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x53b518]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x4927eb
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x492736
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x492736
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x492712
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x492689
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4927a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x49280b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x4927e6
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x49280b
jmp 0x492662
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402a5e
mov esp, ebp
pop ebp
ret
Function at 0x4e6370
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x533d80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x1a
jbe 0x4e6406
call fcn.00401677
mov dword [eax], 0xf
xor eax, eax
je 0x4e63a0
mov dword [ebp - 0x14], 1
jmp 0x4e63a7
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
jne 0x4e63d6
push str.__Invalid_Drive_Index___0_
push 0x5046a8
push 0
push 0x1f
push str.minkernelcrtsucrt_srcdesktopcrtmiscgetcwd.cpp
push 2
call fcn.00401ed3
add esp, 0x18
cmp eax, 1
jne 0x4e63d6
int3
cmp dword [ebp - 0x18], 0
jne 0x4e6406
call fcn.004031e3
mov dword [eax], 0xd
push 0
push 0x1f
push str.minkernelcrtsucrt_srcdesktopcrtmiscgetcwd.cpp
push str.is_valid_drive
push str.__Invalid_Drive_Index___0_
call fcn.00405178
add esp, 0x14
xor eax, eax
jmp 0x4e645f
cmp dword [ebp + 8], 0
jne 0x4e6413
mov eax, 1
jmp 0x4e645f
mov eax, dword [ebp + 8]
add eax, 0x40
mov word [ebp - 0x10], ax
mov cx, word [ebp - 0x10]
mov word [ebp - 0xc], cx
mov edx, 0x3a
mov word [ebp - 0xa], dx
mov eax, 0x5c
mov word [ebp - 8], ax
xor ecx, ecx
mov word [ebp - 6], cx
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4e6456
cmp dword [ebp - 0x1c], 1
jne 0x4e645a
xor eax, eax
jmp 0x4e645f
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402a5e
mov esp, ebp
pop ebp
ret
Function at 0x403422
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402058
and dword [ebp - 4], 0
cmp dword [0x4c0120], 0
mov ebx, eax
jne 0x4034d3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x403584
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x403584
push eax
call fcn.00401fe6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4c0120], eax
call esi
push eax
call fcn.00401fe6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4c0124], eax
call esi
push eax
call fcn.00401fe6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4c0128], eax
call esi
push eax
call fcn.00401fe6
pop ecx
mov dword [0x4c0130], eax
test eax, eax
je 0x4034d3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00401fe6
pop ecx
mov dword [0x4c012c], eax
mov eax, dword [0x4c012c]
cmp eax, ebx
je 0x40352b
cmp dword [0x4c0130], ebx
je 0x40352b
push eax
call fcn.00402061
push dword [0x4c0130]
mov esi, eax
call fcn.00402061
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40352b
test edi, edi
je 0x40352b
call esi
test eax, eax
je 0x403522
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x403522
test byte [ebp - 0xc], 1
jne 0x40352b
or dword [ebp + 0x10], 0x200000
jmp 0x403564
mov eax, dword [0x4c0124]
cmp eax, ebx
je 0x403564
push eax
call fcn.00402061
pop ecx
test eax, eax
je 0x403564
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x403564
mov eax, dword [0x4c0128]
cmp eax, ebx
je 0x403564
push eax
call fcn.00402061
pop ecx
test eax, eax
je 0x403564
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4c0120]
call fcn.00402061
pop ecx
test eax, eax
je 0x403584
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x403586
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406147
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b99f8]
jne 0x406151
repz ret
jmp fcn.0040b4e5
Function at 0x411060
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497a6f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0041c840
xor ebx, ebx
mov dword [esi + 0xc], 0xffffffff
mov byte [esi + 0x1b], bl
lea ecx, [esi + 0x1c]
mov dword [ebp - 4], ebx
mov dword [esi], vtable.nmsdProcess.0
call fcn.0041cdd0
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 1
call fcn.0040f5a0
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 2
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
call fcn.0040f5a0
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 3
call fcn.0040f5a0
push 1
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 4
call fcn.00425e30
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.0040f5a0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x41aca0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41acc6
mov eax, dword [esp]
pop ecx
ret
or eax, 0xffffffff
pop ecx
ret

Function at 0x41ae90
Capabilities:
Create pipe

Disassembly:
sub esp, 0x14
xor eax, eax
cmp byte [esp + 0x20], al
push 0
setne al
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x41aed1
xor al, al
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
mov dword [ecx], edx
mov ecx, dword [esp]
mov dword [eax], ecx
mov al, 1
add esp, 0x14
ret

Function at 0x41af10
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 8
call fcn.00466610
mov ecx, dword [esp + 0x14]
add esp, 4
lea edx, [esp + 4]
push edx
mov esi, eax
mov eax, dword [esp + 0x10]
push 0
push esi
push 0x41aef0
push 0
push 0
mov dword [esi], eax
mov dword [esi + 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x41af52
push esi
call fcn.00466620
add esp, 4
or eax, 0xffffffff
pop esi
pop ecx
ret
Function at 0x41c670
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x41c787
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41c787
push 0x1c
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41c6aa
mov edi, dword [ebp - 0x2c]
jmp 0x41c75d
lea ebx, [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [ebp - 4]
push edx
mov edi, eax
push 0x200
mov eax, ebx
push eax
push edi
mov dword [ebp - 8], edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
jne 0x41c6e3
mov eax, 1
lea esp, [ebp - 0x23c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
cmp esi, 0x200
jbe 0x41c70a
mov eax, esi
call fcn.0040b8d0
mov ebx, esp
lea ecx, [ebp - 4]
push ecx
push esi
push ebx
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x41c6d1
mov esi, dword [ebp - 4]
shr esi, 2
xor edi, edi
test esi, esi
jle 0x41c761
mov eax, dword [ebx + edi*4]
mov ecx, dword [ebp - 8]
push 0xc
lea edx, [ebp - 0x14]
push edx
push eax
push ecx
call sub.PSAPI.DLL_GetModuleInformation
test eax, eax
je 0x41c73d
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
cmp ecx, eax
jb 0x41c73d
mov edx, dword [ebp - 0x10]
add edx, eax
cmp ecx, edx
jbe 0x41c75a
mov eax, dword [ebp - 4]
inc edi
shr eax, 2
cmp edi, eax
jl 0x41c713
mov eax, 0x9c
lea esp, [ebp - 0x23c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebx + edi*4]
test edi, edi
jne 0x41c773
mov eax, 0x9c
lea esp, [ebp - 0x23c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
mov dword [ecx], edi
xor eax, eax
lea esp, [ebp - 0x23c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x23
lea esp, [ebp - 0x23c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41c7a0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jne 0x41c7b8
lea eax, [ebx + 0x23]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], 0
lea eax, [edi + edi]
cmp edi, 0x400
jae 0x41c7f4
call fcn.0040b8d0
mov esi, esp
mov ecx, dword [ebp + 8]
push edi
push esi
push ecx
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x41c811
push 0xffffffffffffffff
push esi
push 0
push edi
push ebx
call fcn.00479890
add esp, 0x14
jmp 0x41c819
push eax
call fcn.00466610
mov esi, eax
add esp, 4
mov dword [ebp + 0xc], esi
test esi, esi
jne 0x41c7d4
lea eax, [esi + 0x70]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.004664e0
mov byte [ebx], 0
mov esi, eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41c82b
push eax
call fcn.00466620
add esp, 4
mov eax, esi
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41fb80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4989f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
mov eax, dword [esp + 0x6c]
push ebx
push ebp
push edi
push eax
lea ecx, [esp + 0x2c]
call fcn.0041ce40
lea ecx, [esp + 0x28]
push ecx
xor ebx, ebx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x74], ebx
call fcn.0041e750
mov eax, dword [esp + 0x54]
xor ebp, ebp
xor edi, edi
mov byte [esp + 0x70], 1
mov dword [esp + 0xc], eax
cmp eax, ebx
jbe 0x41fc9d
lea edx, [esp + 0x24]
mov eax, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
push esi
mov ecx, dword [esp + 0x50]
mov esi, dword [ecx + edi*4]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x28]
mov byte [esp + 0x74], 2
mov dword [esp + 0x1c], vtable.btkFSEntry.0
call fcn.004193b0
add esi, 0xc
push esi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x78], 3
call fcn.00418010
lea ecx, [esp + 0x2c]
mov byte [esp + 0x74], 4
call fcn.0041f1c0
test al, al
je 0x41fc3d
mov edx, dword [esp + 0x28]
push edx
call fcn.0041fb80
add esp, 4
jmp 0x41fc46
mov ecx, dword [esp + 0x28]
call fcn.0041fae0
cmp ebp, ebx
jne 0x41fc4c
mov ebp, eax
mov eax, dword [esp + 0x28]
mov byte [esp + 0x74], 6
cmp eax, ebx
je 0x41fc72
cmp byte [eax], bl
jne 0x41fc65
xor eax, eax
mov dword [esp + 0x28], eax
jmp 0x41fc72
lea ecx, [esp + 0x28]
call fcn.0041a380
mov eax, dword [esp + 0x28]
mov byte [esp + 0x74], 5
cmp eax, ebx
je 0x41fc84
lea ecx, [esp + 0x28]
call fcn.0041a380
inc edi
mov byte [esp + 0x74], 1
mov dword [esp + 0x1c], vtable.btkObject.0
cmp edi, dword [esp + 0x10]
jb 0x41fbe5
pop esi
mov ecx, dword [esp + 0x78]
call fcn.0041fae0
cmp ebp, ebx
jne 0x41fcac
mov ebp, eax
mov dword [esp + 0x38], vtable.btkFSList.0
lea ecx, [esp + 0x38]
mov byte [esp + 0x70], 8
call fcn.0041e4d0
lea ecx, [esp + 0x44]
mov byte [esp + 0x70], 7
call fcn.004220e0
mov dword [esp + 0x38], vtable.btkObject.0
lea eax, [esp + 0x34]
mov dword [esp + 0x70], 9
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x34]
mov byte [esp + 0x70], 0xa
cmp eax, ebx
je 0x41fd0e
cmp byte [eax], bl
jne 0x41fd01
xor eax, eax
mov dword [esp + 0x34], eax
jmp 0x41fd0e
lea ecx, [esp + 0x34]
call fcn.0041a380
mov eax, dword [esp + 0x34]
mov byte [esp + 0x70], 9
cmp eax, ebx
je 0x41fd20
lea ecx, [esp + 0x34]
call fcn.0041a380
mov ecx, dword [esp + 0x68]
pop edi
mov eax, ebp
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x68
ret
Function at 0x420af0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x498b6c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], vtable.btkPipedProcess.0
cmp byte [esi + 0x1b], 0
mov dword [esp + 0x14], 3
je 0x420b33
call dword [0x49fdb8]
mov byte [esi + 0x1b], 0
mov dword [esi + 0xc], 0xffffffff
lea edi, [esi + 0xc8]
mov ecx, edi
mov byte [esp + 0x14], 2
call fcn.0044cf30
lea ecx, [edi + 0x54]
call fcn.0042a770
lea ecx, [edi + 0x30]
call fcn.0041c860
lea edi, [esi + 0x6c]
mov ecx, edi
mov byte [esp + 0x14], 1
call fcn.0044cf30
lea ecx, [edi + 0x54]
call fcn.0042a770
lea ecx, [edi + 0x30]
call fcn.0041c860
lea edi, [esi + 0x1c]
mov ecx, edi
mov byte [esp + 0x14], 0
call fcn.0044d020
lea ecx, [edi + 0x44]
call fcn.0042a770
lea ecx, [edi + 0x20]
call fcn.0041c860
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.00420930
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x421490
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x498c08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
push 1
push esi
lea ecx, [esp + 0xc]
call fcn.00421300
mov ecx, dword [esp + 8]
mov eax, dword [ecx]
mov edx, dword [eax]
mov dword [esp + 0x30], 0
call edx
mov ecx, dword [esp + 8]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
test al, al
jne 0x421511
jmp 0x4214e0
mov ecx, dword [esp + 8]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov eax, dword [eax + 4]
push eax
call fcn.00466620
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
add esp, 4
call edx
mov ecx, dword [esp + 8]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
test al, al
je 0x4214e0
cmp dword [esi + 0x28], 0
je 0x42153a
push edi
xor edi, edi
cmp dword [esi + 0x10], edi
jbe 0x421539
nop
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x28]
lea eax, [eax + edi*8]
lea ecx, [eax + 4]
push ecx
push eax
call edx
inc edi
add esp, 8
cmp edi, dword [esi + 0x10]
jb 0x421520
pop edi
mov ecx, esi
call fcn.00422100
cmp dword [esi + 0x10], 0
mov ecx, dword [esp + 0x28]
sete al
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x4237d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x498cb3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
mov dword [esi], vtable.xsocketbuf.5.0
mov dword [esi + 0xc], vtable.xsocketbuf.4.0
mov dword [esi + 0x14], vtable.xsocketbuf.3.0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0x10], vtable.xsocketbuf.2.0
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 8]
mov dword [eax + esi + 0x10], vtable.xsocketbuf.1.0
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx + 0xc]
mov dword [edx + esi + 0x10], vtable.xsocketbuf.0
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 4]
lea ecx, [eax - 0x78]
mov dword [eax + esi + 0xc], ecx
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 8]
lea ecx, [eax - 0xb8]
mov dword [esp + 4], esi
mov dword [eax + esi + 0xc], ecx
lea ecx, [esi + 0x2c]
mov dword [esp + 0x10], 1
call fcn.00454000
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 0
call fcn.00423730
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.004534b0
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4237e6
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x498cb3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
mov dword [esi], vtable.xsocketbuf.5.0
mov dword [esi + 0xc], vtable.xsocketbuf.4.0
mov dword [esi + 0x14], vtable.xsocketbuf.3.0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0x10], vtable.xsocketbuf.2.0
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 8]
mov dword [eax + esi + 0x10], vtable.xsocketbuf.1.0
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx + 0xc]
mov dword [edx + esi + 0x10], vtable.xsocketbuf.0
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 4]
lea ecx, [eax - 0x78]
mov dword [eax + esi + 0xc], ecx
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 8]
lea ecx, [eax - 0xb8]
mov dword [esp + 4], esi
mov dword [eax + esi + 0xc], ecx
lea ecx, [esi + 0x2c]
mov dword [esp + 0x10], 1
call fcn.00454000
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 0
call fcn.00423730
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.004534b0
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4240c0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x498d6d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
lea ebx, [esi + 4]
mov ecx, ebx
mov dword [esp + 0xc], esi
mov dword [esi], eax
mov dword [esp + 0x20], ebx
call fcn.004193b0
lea ecx, [edi + 4]
push ecx
mov ecx, ebx
mov dword [esp + 0x1c], 0
call fcn.00418010
lea ebx, [esi + 8]
mov ecx, ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x20], ebx
call fcn.004193b0
lea edx, [edi + 8]
push edx
mov ecx, ebx
mov byte [esp + 0x1c], 2
call fcn.00418010
lea ebx, [esi + 0xc]
mov ecx, ebx
mov byte [esp + 0x18], 3
mov dword [esp + 0x20], ebx
call fcn.004193b0
lea eax, [edi + 0xc]
push eax
mov ecx, ebx
mov byte [esp + 0x1c], 4
call fcn.00418010
lea ebx, [esi + 0x10]
mov ecx, ebx
mov byte [esp + 0x18], 5
mov dword [esp + 0x20], ebx
call fcn.004193b0
lea ecx, [edi + 0x10]
push ecx
mov ecx, ebx
mov byte [esp + 0x1c], 6
call fcn.00418010
movzx edx, byte [edi + 0x14]
lea ebx, [esi + 0x18]
mov ecx, ebx
mov byte [esp + 0x18], 7
mov byte [esi + 0x14], dl
mov dword [esp + 0x20], ebx
call fcn.004193b0
lea eax, [edi + 0x18]
push eax
mov ecx, ebx
mov byte [esp + 0x1c], 8
call fcn.00418010
mov ecx, dword [edi + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [edi + 0x24]
lea ebx, [esi + 0x28]
mov ecx, ebx
mov byte [esp + 0x18], 9
mov dword [esi + 0x24], edx
mov dword [esp + 0x20], ebx
call fcn.004193b0
mov byte [esp + 0x18], 0xa
lea eax, [edi + 0x28]
push eax
mov ecx, ebx
call fcn.00418010
lea ebx, [esi + 0x2c]
mov ecx, ebx
mov byte [esp + 0x18], 0xb
mov dword [esp + 0x20], ebx
call fcn.004193b0
lea ecx, [edi + 0x2c]
push ecx
mov ecx, ebx
mov byte [esp + 0x1c], 0xc
call fcn.00418010
movzx edx, byte [edi + 0x30]
lea ebx, [esi + 0x34]
mov ecx, ebx
mov byte [esp + 0x18], 0xd
mov byte [esi + 0x30], dl
mov dword [esp + 0x20], ebx
call fcn.004193b0
lea eax, [edi + 0x34]
push eax
mov ecx, ebx
mov byte [esp + 0x1c], 0xe
call fcn.00418010
mov cl, byte [edi + 0x38]
mov byte [esi + 0x38], cl
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4240d7
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x498d6d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
lea ebx, [esi + 4]
mov ecx, ebx
mov dword [esp + 0xc], esi
mov dword [esi], eax
mov dword [esp + 0x20], ebx
call fcn.004193b0
lea ecx, [edi + 4]
push ecx
mov ecx, ebx
mov dword [esp + 0x1c], 0
call fcn.00418010
lea ebx, [esi + 8]
mov ecx, ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x20], ebx
call fcn.004193b0
lea edx, [edi + 8]
push edx
mov ecx, ebx
mov byte [esp + 0x1c], 2
call fcn.00418010
lea ebx, [esi + 0xc]
mov ecx, ebx
mov byte [esp + 0x18], 3
mov dword [esp + 0x20], ebx
call fcn.004193b0
lea eax, [edi + 0xc]
push eax
mov ecx, ebx
mov byte [esp + 0x1c], 4
call fcn.00418010
lea ebx, [esi + 0x10]
mov ecx, ebx
mov byte [esp + 0x18], 5
mov dword [esp + 0x20], ebx
call fcn.004193b0
lea ecx, [edi + 0x10]
push ecx
mov ecx, ebx
mov byte [esp + 0x1c], 6
call fcn.00418010
movzx edx, byte [edi + 0x14]
lea ebx, [esi + 0x18]
mov ecx, ebx
mov byte [esp + 0x18], 7
mov byte [esi + 0x14], dl
mov dword [esp + 0x20], ebx
call fcn.004193b0
lea eax, [edi + 0x18]
push eax
mov ecx, ebx
mov byte [esp + 0x1c], 8
call fcn.00418010
mov ecx, dword [edi + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [edi + 0x24]
lea ebx, [esi + 0x28]
mov ecx, ebx
mov byte [esp + 0x18], 9
mov dword [esi + 0x24], edx
mov dword [esp + 0x20], ebx
call fcn.004193b0
mov byte [esp + 0x18], 0xa
lea eax, [edi + 0x28]
push eax
mov ecx, ebx
call fcn.00418010
lea ebx, [esi + 0x2c]
mov ecx, ebx
mov byte [esp + 0x18], 0xb
mov dword [esp + 0x20], ebx
call fcn.004193b0
lea ecx, [edi + 0x2c]
push ecx
mov ecx, ebx
mov byte [esp + 0x1c], 0xc
call fcn.00418010
movzx edx, byte [edi + 0x30]
lea ebx, [esi + 0x34]
mov ecx, ebx
mov byte [esp + 0x18], 0xd
mov byte [esi + 0x30], dl
mov dword [esp + 0x20], ebx
call fcn.004193b0
lea eax, [edi + 0x34]
push eax
mov ecx, ebx
mov byte [esp + 0x1c], 0xe
call fcn.00418010
mov cl, byte [edi + 0x38]
mov byte [esi + 0x38], cl
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4