joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404969
Capabilities:
Get common file path

Disassembly:
mov eax, 0x419a60
call fcn.00418f20
sub esp, 0x18
push ebx
xor ebx, ebx
cmp byte [0x42295c], bl
push esi
mov esi, ecx
je 0x4049cd
push edi
mov edi, 0x105
cmp dword [esi + 8], edi
jg 0x404995
push edi
call fcn.004023e1
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov ecx, dword [esi]
xor edx, edx
cmp word [ecx], bx
je 0x4049b1
mov edi, ecx
inc edx
inc edi
inc edi
cmp word [edi], bx
jne 0x4049a9
mov word [ecx + edx*2], bx
cmp eax, ebx
mov dword [esi + 4], edx
pop edi
jbe 0x4049c9
cmp eax, 0x104
ja 0x4049c9
push 1
pop eax
jmp 0x404a1c
xor eax, eax
jmp 0x404a1c
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00402f37
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.0040492d
test al, al
je 0x404a11
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x24]
call fcn.00404225
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00401fa2
push dword [ebp - 0x24]
call fcn.00403226
pop ecx
mov bl, 1
push dword [ebp - 0x18]
call fcn.00403226
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x404f66
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404f8c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x404f8c
xor al, al
jmp 0x404fac
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.004190a0
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x405b34
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, ecx
push edi
mov eax, dword [esi]
and dword [esi + 4], 0
and byte [eax], 0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, eax
test edi, edi
jne 0x405b61
call dword [sym.imp.KERNEL32.DLL_GetLastError]
neg eax
sbb eax, eax
inc eax
jmp 0x405b98
cmp edi, dword [esi + 8]
jl 0x405b6e
push edi
mov ecx, esi
call fcn.00402f37
mov eax, dword [esi]
inc edi
push edi
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, esi
mov edi, eax
call fcn.00404a2a
test edi, edi
jne 0x405b96
call dword [sym.imp.KERNEL32.DLL_GetLastError]
neg eax
sbb eax, eax
neg eax
jmp 0x405b98
mov al, 1
pop edi
pop esi
pop ebx
ret 4
Function at 0x405b9e
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x419c20
call fcn.00418f20
sub esp, 0x18
cmp byte [0x42295c], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x405c1f
mov esi, dword [ebp + 8]
mov eax, dword [esi]
and dword [esi + 4], 0
and word [eax], 0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
test edi, edi
je 0x405c0e
cmp edi, dword [esi + 8]
jl 0x405be1
push edi
mov ecx, esi
call fcn.004023e1
mov eax, dword [esi]
inc edi
push edi
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi]
xor ebx, ebx
xor edx, edx
cmp word [ecx], bx
je 0x405c03
mov edi, ecx
inc edx
inc edi
inc edi
cmp word [edi], bx
jne 0x405bfb
mov word [ecx + edx*2], bx
cmp eax, ebx
mov dword [esi + 4], edx
jne 0x405c1b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
neg eax
sbb eax, eax
inc eax
jmp 0x405c70
mov al, 1
jmp 0x405c70
xor esi, esi
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.00402f37
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
mov dword [ebp - 4], esi
call fcn.00405b34
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x24]
mov bl, al
call fcn.00402d6a
mov ecx, dword [ebp + 8]
push eax
mov byte [ebp - 4], 1
call fcn.00401fa2
push dword [ebp - 0x24]
call fcn.00403226
push dword [ebp - 0x18]
call fcn.00403226
pop ecx
mov al, bl
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40cd2f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x41a87f
call fcn.00418f20
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x41c718
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x41c8b4
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.00403566
push dword [esi + 8]
mov ecx, ebx
call fcn.00403566
push dword [esi + 0xc]
mov ecx, edi
call fcn.00403566
push dword [esi + 0xc]
mov ecx, edi
call fcn.00403566
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x40cd3b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x41a87f
call fcn.00418f20
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x41c718
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x41c8b4
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.00403566
push dword [esi + 8]
mov ecx, ebx
call fcn.00403566
push dword [esi + 0xc]
mov ecx, edi
call fcn.00403566
push dword [esi + 0xc]
mov ecx, edi
call fcn.00403566
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x4102d4
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x41b0b4
call fcn.00418f20
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 8
mov dword [esi], 0x41c718
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x14], 0x41c96c
push 4
mov ebx, 0x41c790
pop eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.0040186d
mov dword [esi + 0x3c], 0x41c9fc
push 4
mov dword [esi + 0x54], edi
pop eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x50], ebx
lea edi, [esi + 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], al
call fcn.0040186d
mov dword [edi], 0x41ca04
lea edi, [esi + 0x78]
mov byte [ebp - 4], 5
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040edb3
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 6
call fcn.0040f93a
lea edi, [esi + 0xa0]
mov byte [ebp - 4], 7
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040edb3
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.0040f93a
lea edi, [esi + 0xc8]
mov byte [ebp - 4], 9
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040edb3
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xa
call fcn.0040f93a
mov byte [ebp - 4], 0xb
lea edi, [esi + 0xf0]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040edb3
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xc
call fcn.0040f93a
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0xd
call fcn.0040f93a
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x417fb0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 8]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov ecx, eax
mov dword [esi], eax
call fcn.00417f80
pop esi
ret 4

Function at 0x418ac0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [ecx], 0x6a09e667
mov dword [ecx + 0x20], eax
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x24], eax
ret
Function at 0x4192c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov eax, ecx
mov esi, edx
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
test edi, edi
je 0x4192ef
test esi, 7
je 0x4192ef
movzx edx, byte [esi]
inc esi
movzx ebx, al
xor edx, ebx
shr eax, 8
xor eax, dword [ebp + edx*4]
dec edi
jne 0x4192d4
cmp edi, 0x10
jb 0x419378
mov dword [esp + 0x14], edi
sub edi, 8
and edi, 0xfffffff8
sub dword [esp + 0x14], edi
add edi, esi
xor eax, dword [esi]
mov ebx, dword [esi + 4]
movzx ecx, bl
mov edx, dword [ebp + ecx*4 + 0xc00]
movzx ecx, bh
xor edx, dword [ebp + ecx*4 + 0x800]
shr ebx, 0x10
movzx ecx, bl
xor edx, dword [ebp + ecx*4 + 0x400]
xor edx, dword [esi + 8]
movzx ecx, al
movzx ebx, bh
xor edx, dword [ebp + ebx*4]
mov ebx, dword [esi + 0xc]
xor edx, dword [ebp + ecx*4 + 0x1c00]
movzx ecx, ah
add esi, 8
shr eax, 0x10
xor edx, dword [ebp + ecx*4 + 0x1800]
movzx ecx, al
xor edx, dword [ebp + ecx*4 + 0x1400]
movzx ecx, ah
mov eax, dword [ebp + ecx*4 + 0x1000]
movzx ecx, bl
xor eax, edx
cmp esi, edi
jne 0x419310
xor eax, dword [esi]
mov edi, dword [esp + 0x14]
test edi, edi
je 0x41938f
movzx edx, byte [esi]
inc esi
movzx ebx, al
xor edx, ebx
shr eax, 8
xor eax, dword [ebp + edx*4]
dec edi
jne 0x41937c
pop ebp
pop edi
pop esi
pop ebx
ret 8
Function at 0x58dde0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x130000]
push edi
or ebp, 0xffffffff
jmp 0x58de02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x58de09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x58ddf8
mov eax, 1
add ebx, ebx
jne 0x58de1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x58de2c
jne 0x58de3c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x58de3c
dec eax
add ebx, ebx
jne 0x58de38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x58de10
xor ecx, ecx
sub eax, 3
jb 0x58de54
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x58dec6
sar eax, 1
mov ebp, eax
jmp 0x58de5f
add ebx, ebx
jne 0x58de5f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x58de6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x58de90
inc ecx
add ebx, ebx
jne 0x58de7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x58de71
jne 0x58de8d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x58de71
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x58deb0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x58dea1
jmp 0x58ddfe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x58deb0
add edi, ecx
jmp 0x58ddfe
pop esi
mov edi, esi
mov ecx, 0x3450
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x58dece
cmp byte [edi], 7
jne 0x58dece
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x58ded3
lea edi, [esi + 0x18a000]
mov eax, dword [edi]
or eax, eax
je 0x58df4b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1944a8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x194584]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x58df00
mov ecx, edi
jns 0x58df2f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x194588]
or eax, eax
je 0x58df45
mov dword [ebx], eax
add ebx, 4
jmp 0x58df1d
call dword [esi + 0x19458c]
popal
jmp 0x4670a0
Function at 0x4203aa
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x2c
mov eax, 0x45ccd8
call fcn.0042087e
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], esi
cmp dword [edi + 0x14], 8
jb 0x4203cc
mov eax, dword [edi]
jmp 0x4203ce
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov dword [ebp - 0x38], eax
cmp eax, 0xffffffff
jne 0x4203ed
push esi
push edi
push ebx
call fcn.00420291
add esp, 0xc
jmp 0x4204c0
test eax, 0x400
je 0x420483
cmp dword [edi + 0x14], 8
jb 0x420402
mov eax, dword [edi]
jmp 0x420404
mov eax, edi
push eax
lea ecx, [ebp - 0x28]
call fcn.0041dbdb
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
push ecx
push 0x2000000
push 3
push ecx
push 7
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
mov dword [ebp - 0x2c], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.00408eb6
cmp esi, 0xffffffff
jne 0x42044c
push dword [ebp - 0x34]
jmp 0x4203de
push edi
call fcn.0041ff11
pop ecx
test al, al
jne 0x420475
mov eax, dword [ebp - 0x38]
push eax
push edi
call fcn.00420031
pop ecx
pop ecx
push esi
mov dword [ebx], 9
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x4204c0
or dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [ebp - 0x34]
test esi, esi
je 0x420492
and dword [esi], 0
call fcn.0041d4ab
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], 3
push eax
push edi
test al, 0x10
jne 0x4204a9
mov dword [ebp - 0x30], 2
call fcn.00420031
pop ecx
pop ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx]
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov eax, ebx
call fcn.00420828
ret

Function at 0x44cc01
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044ca80

Function at 0x44ea27
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044e6e7

Function at 0xf046f4
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf046fe
pushal
call 0xf04704
pop ebp
sub ebp, 0x10
sub ebp, 0xb046f4
jmp 0xf0471a
mov eax, 0xb046f4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c4
mov edx, 0x5b6e954a
xor byte [eax], dl
inc eax
dec ecx
jne 0xf04731
jmp 0xf04744
rol dword [edi + 0x4a76c3c1], 0x4a
dec edx
retf
Function at 0x402220
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47acbb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x494ce8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0045c096
push 4
mov dword [ebp - 4], 0
call fcn.0045d5ba
mov edi, eax
add esp, 4
test edi, edi
je 0x4022a0
call fcn.0045bc77
mov dword [edi], eax
call fcn.0045ba36
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0045b96b
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x402296
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0045b993
jmp 0x4022a2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4093d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b4e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x494ce8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
xor ebx, ebx
push 8
mov dword [esi], ebx
call fcn.0045d5ba
add esp, 4
cmp eax, ebx
je 0x4094ca
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea edi, [esi + 0x18]
push 8
mov dword [ebp - 4], ebx
mov dword [edi], ebx
call fcn.0045d5ba
add esp, 4
cmp eax, ebx
je 0x4094a6
mov dword [edi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [edi]
mov dword [ecx], edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [esi + 0x40], ebx
mov eax, 0xf
mov dword [esi + 0x44], eax
mov byte [esi + 0x30], bl
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x74], eax
mov dword [esi + 0x70], ebx
mov byte [esi + 0x60], bl
mov dword [esi + 0x7c], 1
mov byte [esi + 0x80], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], ebx
call fcn.0045c842
push 0x48f250
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], vtable.std::bad_alloc.0
call fcn.0045d63a
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], ebx
call fcn.0045c842
push 0x48f250
lea edx, [ebp - 0x30]
push edx
mov dword [ebp - 0x30], vtable.std::bad_alloc.0
call fcn.0045d63a
int3
Function at 0x411190
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x494ce8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x198], 0
push esi
push edi
mov edi, dword [ebx]
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x110], edi
jne 0x41132d
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x104]
push ecx
push esi
mov dword [ebp - 0x10c], 0x80
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x41121a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebx
call fcn.00431050
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push edi
call fcn.0042d160
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d571
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x84]
push eax
push esi
mov dword [ebp - 0x10c], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x41126d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebx
call fcn.00431050
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push edi
call fcn.0042d160
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d571
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x108]
add ebx, 0xc8
add edi, 0x9a
lea esi, [ebp - 0x104]
call fcn.00411150
test eax, eax
jne 0x4112ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x108]
mov esi, eax
push esi
push ecx
call fcn.00431050
mov edx, dword [ebp - 0x110]
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push edx
call fcn.0042d160
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d571
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x108]
lea ebx, [eax + 0xfc]
lea edi, [eax + 0xcc]
lea esi, [ebp - 0x84]
call fcn.00411150
test eax, eax
jne 0x411327
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x108]
push esi
push eax
call fcn.00431050
mov ecx, dword [ebp - 0x110]
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ecx
call fcn.0042d160
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d571
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x108]
mov edi, dword [ebx]
add edi, 0x86a4
lea esi, [ebx + 0x9a]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebx]
add edi, 0x86d8
lea esi, [ebx + 0xcc]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edx, dword [ebx]
mov eax, dword [ebx + 0xc8]
mov dword [edx + 0x86d4], eax
mov ecx, dword [ebx]
mov edx, dword [ebx + 0xfc]
mov dword [ecx + 0x8708], edx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d571
mov esp, ebp
pop ebp
ret
Function at 0x411390
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [edi]
mov eax, dword [esi + 0x308]
push 4
lea ecx, [ebp - 4]
push ecx
push 1
push 6
push edx
mov dword [ebp - 4], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4113d6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.00431050
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.0042d0e0
add esp, 0x14
pop esi
mov esp, ebp
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.0042d0e0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411970
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x520]
cmp eax, 0xffffffff
je 0x4119cb
mov ecx, dword [ecx + 0x514]
mov edx, dword [ecx]
cmp dword [edx + eax*4], 0
lea eax, [edx + eax*4]
je 0x4119cb
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
test ecx, ecx
je 0x41199d
mov dword [ecx], eax
cmp dword [eax + 0x144], 0
push esi
mov esi, dword [eax + 0x12c]
jne 0x4119c0
push 2
push 1
lea eax, [ebp + 0xb]
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x4119c6
or eax, 0xffffffff
pop esi
pop ebp
ret
mov eax, esi
pop esi
pop ebp
ret
or eax, 0xffffffff
pop ebp
ret