joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4110b5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push edi
push ebx
push esi
mov ebx, dword [ebp + 8]
cmp ebx, 0
mov edi, 0
je 0x4110d0
cmp byte [ebx], 0
jne 0x4110da
mov eax, 0xffffffff
jmp 0x4111c0
push ebx
call fcn.004a7700
add esp, 4
mov esi, eax
cmp esi, 1
jbe 0x41113a
push esi
push ebx
call fcn.0040f99a
sub esp, 0xfffffff8
or al, al
je 0x41111a
cmp byte [ebx + esi - 1], 0x5c
je 0x41113a
cmp byte [ebx + esi - 1], 0x2f
je 0x41113a
push 0x4d47ea
push ebx
call fcn.0040a950
sub esp, 0xfffffff8
mov ebx, eax
mov edi, eax
jmp 0x41113a
cmp byte [ebx + esi - 1], 0x5c
je 0x411128
cmp byte [ebx + esi - 1], 0x2f
jne 0x41113a
push ebx
call fcn.0040a7ee
add esp, 4
mov edi, eax
mov ebx, eax
mov byte [edi + esi - 1], 0
call fcn.004150b4
or eax, eax
jne 0x411176
push ebx
mov eax, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x411176
push edi
mov eax, dword [0x4d3eec]
call eax
add esp, 4
test dword [ebp - 4], 0x10
je 0x41116f
mov eax, 1
jmp 0x4111c0
mov eax, 0
jmp 0x4111c0
lea eax, [ebp - 0x68]
push eax
push ebx
call fcn.00414eb2
sub esp, 0xfffffff8
cmp eax, 0xffffffff
jne 0x41119a
push edi
mov eax, dword [0x4d3eec]
call eax
add esp, 4
mov eax, 0
jmp 0x4111c0
push edi
mov eax, dword [0x4d3eec]
call eax
add esp, 4
mov eax, dword [ebp - 0x60]
and eax, 0xf000
cmp eax, 0x4000
sete al
movzx eax, al
or eax, eax
setg al
movzx eax, al
pop esi
pop ebx
pop edi
leave
ret

Function at 0x4111f9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, 0
je 0x41120c
cmp byte [esi], 0
jne 0x411213
mov eax, 0xffffffff
jmp 0x41126f
push esi
call fcn.0040d019
sub esp, 0xfffffffc
or eax, eax
jne 0x411232
push 0x4d47ec
push esi
call fcn.0040ce74
sub esp, 0xfffffff8
mov esi, eax
jmp 0x41123d
push esi
call fcn.0040a7ee
sub esp, 0xfffffffc
mov esi, eax
push esi
mov eax, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call eax
push esi
mov edi, eax
mov eax, dword [0x4d3eec]
call eax
sub esp, 0xfffffffc
cmp edi, 0xffffffff
jne 0x41125e
mov eax, 0xffffffff
jmp 0x41126f
cmp edi, 0x10
jne 0x41126a
mov eax, 0
jmp 0x41126f
mov eax, 1
pop esi
pop ebx
pop edi
leave
ret
Function at 0x41208e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push edi
push ebx
mov edi, sym.imp.KERNEL32.dll_GetStdHandle
push esi
mov esi, dword [ebp + 0xc]
mov ebx, 0
jmp 0x4120bb
mov eax, esi
movsx eax, byte [eax]
add esi, 1
sub eax, 0x71
jne 0x4120ba
mov ebx, 1
jmp 0x4120bb
nop
cmp byte [esi], 0
jne 0x4120a6
mov dword [ebp - 4], 0
lea eax, [ebp - 0x50]
push 0x44
push 0
push eax
call fcn.004a7ae0
mov dword [ebp - 0x50], 0x44
lea esi, [ebp - 6]
sub esp, 0xfffffff4
push 2
push esi
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
call eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 6
jne 0x4120fb
or dword [ebp - 4], 8
call fcn.004a6738
lea eax, [eax + 0x20]
push eax
call fcn.004a7ce4
sub esp, 0xfffffffc
call fcn.004a6738
lea eax, [eax + 0x40]
push eax
call fcn.004a7ce4
sub esp, 0xfffffffc
or dword [ebp - 0x24], 0x100
cmp ebx, 0
jne 0x412146
push 0xfffffffffffffff6
mov eax, dword [edi]
call eax
mov dword [ebp - 0x18], eax
push 0xfffffffffffffff5
mov eax, dword [edi]
call eax
mov dword [ebp - 0x14], eax
push 0xfffffffffffffff4
mov eax, dword [edi]
call eax
mov dword [ebp - 0x10], eax
jmp 0x41215b
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
lea edi, [ebp - 0x60]
push edi
lea esi, [ebp - 0x50]
push esi
push 0
push 0
push dword [ebp - 4]
push 1
push 0
push 0
push dword [ebp + 8]
push 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
lea eax, [ebp - 0xc]
push 0
push dword [ebp - 0x60]
push eax
call fcn.004ab953
mov eax, dword [ebp - 0xc]
add esp, 0xc
pop esi
pop ebx
pop edi
leave
ret

Function at 0x412b73
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push esi
mov esi, 0x4d49bc
push ebx
cmp dword [esi], 0xffffffff
jne 0x412bda
xor ebx, ebx
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetVersionExA]
call eax
test eax, eax
je 0x412bd8
cmp dword [ebp - 0x84], 2
ja 0x412bd3
cmp dword [ebp - 0x84], 2
jne 0x412bd8
cmp dword [ebp - 0x90], 5
ja 0x412bd3
cmp dword [ebp - 0x90], 5
jne 0x412bd8
cmp dword [ebp - 0x8c], 0
jbe 0x412bd8
mov ebx, 1
mov dword [esi], ebx
cmp dword [esi], 1
pop ebx
sete al
pop esi
leave
ret

Function at 0x412be4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push esi
push ebx
mov ebx, 0x4d49c0
cmp dword [ebx], 0xffffffff
jne 0x412c39
xor esi, esi
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetVersionExA]
call eax
or eax, eax
je 0x412c37
cmp dword [ebp - 0x84], 2
ja 0x412c32
cmp dword [ebp - 0x84], 2
jne 0x412c37
cmp dword [ebp - 0x90], 6
jb 0x412c37
mov esi, 1
mov dword [ebx], esi
cmp dword [ebx], 1
sete al
pop ebx
pop esi
leave
ret
Function at 0x412edf
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
push edi
lea eax, [ebp - 0x194]
push ebx
mov ebx, 0x4d3eec
push esi
mov edi, 0
mov esi, dword [ebp + 8]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
mov dword [0x4f0f24], eax
push esi
call fcn.0040c796
sub esp, 0xfffffffc
or eax, eax
jne 0x412f3f
push 1
push 0x105
mov eax, dword [fcn.004092c1]
call eax
mov edi, eax
mov esi, edi
sub esp, 0xfffffff8
push 0x105
push esi
push 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
push esi
call fcn.0040c974
mov dword [ebp - 4], eax
sub esp, 0xfffffffc
mov dword [0x4fdeb8], 0x8000
push dword [0x4f0f18]
mov eax, dword [ebx]
call eax
add esp, 4
push dword [0x4f0f1c]
mov eax, dword [ebx]
call eax
sub esp, 0xfffffffc
push 0
push dword [ebp - 4]
call fcn.0040ce74
sub esp, 0xfffffff8
mov dword [0x4f0f18], eax
push esi
call fcn.0040a7ee
mov dword [0x4f0f1c], eax
add esp, 4
cmp byte [0x4f0f04], 0
jne 0x412f9d
call fcn.0040eef8
mov byte [0x4f0f04], 1
push dword [ebp + 0x10]
call fcn.004141b4
sub esp, 0xfffffffc
push dword [ebp + 0xc]
push esi
call fcn.00413345
add esp, 8
push edi
mov eax, dword [ebx]
call eax
sub esp, 0xfffffffc
nop
pop esi
pop ebx
pop edi
leave
ret
Function at 0x41587f
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push edi
push esi
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x1c]
mov dword [edi], 0
mov esi, 0x4f136c
cmp dword [esi], 0
jne 0x4158ae
lea edi, [ebp - 0x3c]
push edi
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call eax
mov edi, dword [ebp - 0x20]
mov dword [esi], edi
mov eax, dword [esi]
mov edx, eax
sar edx, 0x1f
push edx
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004a57f8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
sub esp, 0xfffffff0
mov edx, dword [ebp + 8]
add ebx, dword [ebp - 0x48]
mov eax, ebx
mov edi, eax
cmp edx, 0xffffffff
jne 0x4158e4
mov eax, 0
jmp 0x4159dc
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
sub eax, dword [ebp - 0x48]
sbb edx, dword [ebp - 0x44]
mov esi, eax
add esi, edi
mov ebx, edx
mov dword [ebp - 0x50], esi
adc ebx, 0
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x10], eax
and dword [ebp - 0x10], 0xffffffff
xor ebx, ebx
mov esi, dword [ebp - 0x4c]
mov dword [ebp - 8], esi
mov bl, 4
cmp dword [ebp + 0x18], 0
je 0x41591d
xor ebx, ebx
mov bl, 2
push 0
push dword [ebp - 0x10]
push dword [ebp - 8]
push ebx
push 0
push dword [ebp + 8]
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
call eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x415945
mov eax, 0
jmp 0x4159dc
mov esi, dword [ebp + 0x10]
sub esi, dword [ebp - 0x48]
mov ecx, esi
mov eax, ecx
mov esi, dword [ebp + 0x14]
sbb esi, dword [ebp - 0x44]
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
and dword [ebp - 0xc], 0xffffffff
mov edx, dword [ebp + 0x14]
mov dword [ebp - 4], edx
xor edx, edx
xor ebx, ebx
mov dl, 2
cmp dword [ebp + 0x18], 0
cmove ebx, edx
or ebx, 4
push edi
push dword [ebp - 0xc]
push dword [ebp - 4]
push ebx
push dword [ebp - 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
call eax
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
cmp dword [ebp - 0x18], 0
jne 0x4159b0
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0
mov eax, 0
jmp 0x4159dc
push 1
push 0x10
mov eax, dword [fcn.004092c1]
call eax
mov ebx, dword [ebp - 0x18]
sub esp, 0xfffffff8
mov ecx, eax
mov dword [ecx + 8], ebx
mov edx, dword [ecx + 4]
xor dword [ecx + 4], edx
mov dword [ecx], edi
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x18]
lea eax, [edx + eax]
pop esi
pop edi
pop ebx
leave
ret
Function at 0x415cb4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2060
push edi
push esi
push ebx
push 0
push 0x8000
push dword [ebp + 8]
call fcn.004157b9
add esp, 0xc
mov edi, eax
cmp edi, 0xffffffff
jne 0x415ce3
mov eax, 0xffffffff
jmp 0x415da2
push 0x1b6
push dword [ebp + 0xc]
call fcn.004157a0
mov ebx, eax
add esp, 8
cmp ebx, 0xffffffff
jne 0x415d0d
push edi
call fcn.004ac600
sub esp, 0xfffffffc
mov eax, 0xffffffff
jmp 0x415da2
jmp 0x415d48
lea eax, [ebp - 0x2000]
push esi
push eax
push ebx
call fcn.004b3a23
sub esp, 0xfffffff4
cmp eax, esi
je 0x415d48
push edi
call fcn.004ac600
add esp, 4
push ebx
call fcn.004ac600
sub esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.004116e6
add esp, 4
mov eax, 0xffffffff
jmp 0x415da2
push 0x2000
lea eax, [ebp - 0x2000]
push eax
push edi
call fcn.004b31f3
mov esi, eax
add esp, 0xc
cmp esi, 0
ja 0x415d0f
push edi
call fcn.004ac600
add esp, 4
push ebx
call fcn.004ac600
sub esp, 0xfffffffc
lea eax, [ebp - 0x2060]
push eax
push dword [ebp + 8]
call fcn.00415b9a
add esp, 8
test eax, eax
jne 0x415d9d
push dword [ebp - 0x2058]
push dword [ebp + 0xc]
call fcn.004b3c58
add esp, 8
mov eax, 0
pop ebx
pop esi
pop edi
leave
ret

Function at 0x41aef4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 4]
sub esp, 8
push ebx
push edi
push esi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
lea esi, [ebp - 8]
push esi
push 0
push 0x20019
push 0
push 0
push 0
push 0x4d5f6a
push reloc.WS2_32.dll_bind
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
test eax, eax
jne 0x41af5a
push edi
push ebx
push 0
push 0
push 0x4d5f60
push dword [ebp - 8]
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
push dword [ebp - 8]
mov ebx, eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
cmp ebx, 0
je 0x41af61
mov eax, 0xfffffffe
jmp 0x41af66
mov eax, 0xffffffff
jmp 0x41af66
mov eax, 0
pop esi
pop edi
pop ebx
leave
ret

Function at 0x41af6b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 4]
sub esp, 8
push ebx
push esi
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SOFTWAREGreen_Hills_SoftwareKeys
push reloc.WS2_32.dll_bind
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
push esi
push ebx
push 1
push 0
push str.Directory
push dword [ebp - 8]
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
or eax, eax
je 0x41afbf
mov eax, 0xffffffff
jmp 0x41afce
push dword [ebp - 8]
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
mov eax, 0
pop esi
pop ebx
leave
ret
Function at 0x42a581
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, 0x4d79b6
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], 0
mov esi, 0
mov dword [ebp - 0x10], 0
cmp byte [ebx + 0xdc], 0
je 0x42a5c0
cmp byte [ebx + 0xdd], 0
je 0x42a5c0
mov eax, edi
mov esi, edi
mov dword [ebp - 0x10], eax
jmp 0x42a60d
push ebx
call fcn.004286a9
movzx eax, al
sub esp, 0xfffffffc
push eax
mov eax, dword [ebp + 0x2c]
push dword [eax + 0x40]
call fcn.00433038
sub esp, 0xfffffffc
push eax
call fcn.0043a5a9
mov esi, eax
add esp, 8
push ebx
call fcn.004286a9
sub esp, 0xfffffffc
movzx eax, al
push eax
mov eax, dword [ebp + 0x30]
push dword [eax + 0x40]
call fcn.00433038
sub esp, 0xfffffffc
push eax
call fcn.0043a5a9
mov dword [ebp - 0x10], eax
sub esp, 0xfffffff8
push dword [ebp - 0x10]
push esi
call fcn.00409aaf
sub esp, 0xfffffff8
test eax, eax
je 0x42a624
mov esi, edi
jmp 0x42a721
push esi
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
call eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x42a721
push esi
mov eax, dword [sym.imp.WS2_32.dll_gethostbyname]
call eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42a721
push ebx
call fcn.004286a9
add esp, 4
movzx eax, al
push eax
mov eax, dword [ebp + 0x2c]
push dword [eax + 0x40]
call fcn.00433038
sub esp, 0xfffffffc
push eax
call fcn.0043a52a
mov esi, eax
add esp, 8
push ebx
call fcn.004286a9
add esp, 4
movzx eax, al
push eax
mov eax, dword [ebp + 0x30]
push dword [eax + 0x40]
call fcn.00433038
add esp, 4
push eax
call fcn.0043a52a
add esp, 8
push eax
push esi
call fcn.004a66b0
sub esp, 0xfffffff8
or eax, eax
je 0x42a721
push ebx
call fcn.004286a9
add esp, 4
movzx eax, al
push eax
mov eax, dword [ebp + 0x2c]
push dword [eax + 0x40]
call fcn.00433038
sub esp, 0xfffffffc
push eax
call fcn.0043a5a9
add esp, 8
push eax
push str.Warning:_Unable_to_lookup__s__possible_DNS_misconfiguration._n
call fcn.00442438
mov dword [ebp - 8], eax
add esp, 8
push dword [ebp - 8]
push ebx
call fcn.00427b9b
sub esp, 0xfffffff8
push 0
push 0
push 0
push dword [ebp - 8]
push dword [ebp + 0x10]
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x2c]
push dword [eax + 0x40]
call fcn.004054ce
add esp, 0x3c
push dword [ebp - 8]
mov eax, dword [0x4d3eec]
call eax
add esp, 4
push 0
push 0
push 0
push esi
push dword [ebp + 0x28]
movzx eax, byte [ebp + 0x24]
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x2c]
call fcn.00426324
add esp, 4
push eax
push dword [ebp + 0x2c]
call fcn.00426317
sub esp, 0xfffffffc
push eax
mov eax, dword [ebp + 0x30]
push dword [eax + 0x40]
call fcn.00404fcc
sub esp, 0xffffffcc
nop
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e3cc
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
nop
leave
ret
Function at 0x43a2cf
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push esi
push ebx
mov bl, byte [ebp + 0xc]
mov edi, dword [ebp + 0x10]
cmp edi, 0
je 0x43a2f1
mov dword [edi + 4], 0
mov esi, 0x4da4f5
mov dword [edi], esi
mov byte [ebp - 1], 1
push 0
push 0
mov esi, 0
push dword [ebp + 8]
mov eax, dword [sym.imp.WS2_32.dll_accept]
call eax
mov esi, eax
cmp esi, 0xffffffff
jne 0x43a329
cmp edi, 0
je 0x43a322
mov edx, str._acceptClient_:_Could_not_accept
mov dword [edi + 4], 1
mov dword [edi], edx
mov eax, 0xffffffff
jmp 0x43a390
mov dword [ebp - 8], 1
lea edi, [ebp - 8]
push edi
push 0x8004667e
push esi
mov eax, dword [sym.imp.WS2_32.dll_ioctlsocket]
call eax
push 0
push 1
push esi
mov eax, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
call eax
cmp bl, 0
je 0x43a35f
push 1
push dword [ebp + 8]
call fcn.00436e77
add esp, 8
lea eax, [ebp - 1]
mov byte [ebp - 1], 1
push 1
push eax
push 4
push 0xffff
push esi
mov eax, dword [sym.imp.WS2_32.dll_setsockopt]
call eax
lea eax, [ebp - 1]
mov byte [ebp - 1], 1
push 1
push eax
push 1
push 6
push esi
mov eax, dword [sym.imp.WS2_32.dll_setsockopt]
call eax
mov eax, esi
pop ebx
pop esi
pop edi
leave
ret
Function at 0x43a395
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push edi
push esi
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 0
je 0x43a3b4
mov dword [ebx + 4], 0
mov edi, 0x4da517
mov dword [ebx], edi
lea esi, [0x4da518]
lea edi, [ebp - 0x1c]
mov dword [ebp - 0xc], 0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 0
mov byte [ebp - 1], 1
push 0x10
lea eax, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
push 0
push eax
call fcn.004a7ae0
mov word [ebp - 0x1c], 2
sub esp, 0xfffffff4
cmp byte [ebp + 0x10], 0
je 0x43a400
push 0x7f000001
mov eax, dword [sym.imp.WS2_32.dll_htonl]
call eax
mov dword [ebp - 0x18], eax
jmp 0x43a40c
push 0
mov eax, dword [sym.imp.WS2_32.dll_htonl]
call eax
mov dword [ebp - 0x18], eax
movzx esi, word [ebp + 8]
push esi
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
mov word [ebp - 0x1a], ax
push 0
push 1
push 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0xc]
cmp edi, 0xffffffff
jne 0x43a451
cmp ebx, 0
je 0x43a447
mov edi, str._STPTransport::getListenSocket_:_Could_not_create_listen_socket
mov dword [ebx + 4], 1
mov dword [ebx], edi
mov eax, 0
jmp 0x43a4f7
mov byte [ebp - 1], 1
lea edi, [ebp - 1]
push 1
push edi
push 4
push 0xffff
push dword [ebp - 0xc]
mov eax, dword [sym.imp.WS2_32.dll_setsockopt]
call eax
mov byte [ebp - 1], 1
lea edi, [ebp - 1]
push 1
push edi
push 1
push 6
push dword [ebp - 0xc]
mov eax, dword [sym.imp.WS2_32.dll_setsockopt]
call eax
lea esi, [ebp - 0x1c]
push 0x10
push esi
push dword [ebp - 0xc]
mov eax, dword [sym.imp.WS2_32.dll_bind]
call eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43a4b7
cmp ebx, 0
je 0x43a4b0
mov esi, str._STPTransport::getListenSocket_:_Could_not_bind_to_port.
mov dword [ebx + 4], 1
mov dword [ebx], esi
mov eax, 0
jmp 0x43a4f7
push 5
push dword [ebp - 0xc]
mov eax, dword [sym.imp.WS2_32.dll_listen]
call eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43a4e6
cmp ebx, 0
je 0x43a4df
mov esi, str._STPTransport::getListenSocket_:_Could_not_listen_on_socket
mov dword [ebx + 4], 1
mov dword [ebx], esi
mov eax, 0
jmp 0x43a4f7
push 0
push 1
push dword [ebp - 0xc]
mov eax, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
call eax
mov eax, dword [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x43a5a9
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
push esi
push ebx
mov ebx, 0
movzx eax, byte [ebp + 0xc]
mov esi, dword [ebp + 8]
push eax
push esi
call fcn.0043a52a
sub esp, 0xfffffff8
test eax, eax
jne 0x43a5d6
mov eax, 0
jmp 0x43a789
cmp byte [ebp + 0xc], 0
je 0x43a5f0
cmp byte [esi + 0x421], 0
je 0x43a5f0
lea eax, [esi + 0x421]
jmp 0x43a789
push 0x4da5f0
lea eax, [esi + 0x21]
push eax
call fcn.00409aaf
sub esp, 0xfffffff8
or eax, eax
jne 0x43a63d
push 0x4da5fa
lea eax, [esi + 0x21]
push eax
call fcn.00409aaf
add esp, 8
or eax, eax
jne 0x43a63d
lea ebx, [esi + 0x21]
lea eax, [esi + 0x421]
push 0x400
push ebx
push eax
call fcn.004a9cb0
lea eax, [esi + 0x421]
add esp, 0xc
jmp 0x43a789
movzx eax, byte [ebp + 0xc]
push eax
call fcn.0040fba7
mov ebx, eax
add esp, 4
cmp ebx, 0
jne 0x43a674
push 0x400
lea edi, [esi + 0x21]
lea eax, [esi + 0x421]
push edi
push eax
call fcn.004a9cb0
sub esp, 0xfffffff4
lea eax, [esi + 0x421]
jmp 0x43a789
lea edi, [esi + 0x21]
push 0x400
push edi
lea eax, [esi + 0x421]
push eax
call fcn.004a9cb0
mov dword [ebp - 0xc], 0
mov byte [ebp - 1], 0
sub esp, 0xfffffff4
mov edi, ebx
mov dword [ebp - 0x10], 0
jmp 0x43a70d
movsx eax, byte [edi]
push eax
call fcn.004a8aec
add esp, 4
test eax, eax
je 0x43a6d4
movsx edx, byte [edi]
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*4]
shl eax, 1
lea edx, [edx - 0x30]
add edx, eax
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0xff
jle 0x43a70a
mov byte [ebp - 1], 1
jmp 0x43a712
cmp byte [edi], 0x2e
jne 0x43a704
sub dword [ebp - 0xc], 0xffffffff
cmp dword [ebp - 0xc], 3
jle 0x43a6e9
mov byte [ebp - 1], 1
jmp 0x43a712
cmp dword [ebp - 0xc], 3
jne 0x43a6fb
cmp byte [edi + 1], 0
jne 0x43a6fb
mov byte [ebp - 1], 1
jmp 0x43a712
mov dword [ebp - 0x10], 0
jmp 0x43a70a
mov byte [ebp - 1], 1
jmp 0x43a712
sub edi, 0xffffffff
cmp byte [edi], 0
jne 0x43a6a2
cmp dword [ebp - 0xc], 3
jne 0x43a722
cmp byte [ebp - 1], 0
jne 0x43a722
mov eax, ebx
jmp 0x43a789
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
push ebx
mov eax, dword [sym.imp.WS2_32.dll_gethostbyname]
call eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43a74a
mov edi, dword [ebp - 0x14]
cmp dword [edi + 0xc], 0
jne 0x43a74e
mov eax, ebx
jmp 0x43a789
mov edi, dword [ebp - 0x14]
mov edi, dword [edi + 0xc]
mov edi, dword [edi]
push dword [edi]
mov eax, dword [sym.imp.WS2_32.dll_inet_ntoa]
call eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43a76c
mov eax, ebx
jmp 0x43a789
push 0x400
lea eax, [esi + 0x421]
push dword [ebp - 8]
push eax
call fcn.004a9cb0
lea eax, [esi + 0x421]
sub esp, 0xfffffff4
pop ebx
pop esi
pop edi
leave
ret
Function at 0x43a78e
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
push esi
push ebx
mov ebx, dword [ebp + 8]
cmp byte [ebx + 0x19], 0
jne 0x43a7a7
mov eax, 0
jmp 0x43a814
cmp byte [ebp + 0xc], 0
je 0x43a7be
cmp byte [ebx + 0x821], 0
je 0x43a7be
lea eax, [ebx + 0x821]
jmp 0x43a814
lea eax, [ebp - 4]
lea esi, [0x4da604]
mov dword [ebp - 4], 0x10
push eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebx + 0x1c]
mov eax, dword [sym.imp.WS2_32.dll_getsockname]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call eax
test eax, eax
je 0x43a7ef
mov eax, 0
jmp 0x43a814
push 0x400
push dword [ebp - 0x10]
mov eax, dword [sym.imp.WS2_32.dll_inet_ntoa]
call eax
push eax
lea eax, [ebx + 0x821]
push eax
call fcn.004a9cb0
lea eax, [ebx + 0x821]
add esp, 0xc
pop ebx
pop esi
pop edi
leave
ret

Function at 0x43a819
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push edi
push esi
push ebx
mov bl, byte [ebp + 0x10]
movzx eax, bl
push eax
push dword [ebp + 0xc]
push 0
call fcn.0043a395
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
add esp, 0xc
cmp dword [edi + 4], 0
je 0x43a849
mov eax, 0
jmp 0x43a8a6
lea ebx, [ebp - 0x18]
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
lea edi, [ebp - 0x18]
push eax
lea esi, [0x4da614]
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push dword [ebp - 4]
mov eax, dword [sym.imp.WS2_32.dll_getsockname]
call eax
or eax, eax
je 0x43a889
mov edi, str._STPTransport::getListenSocket__Failed_to_getsockname.
mov edx, dword [ebp + 0xc]
mov dword [edx + 4], 1
mov edx, dword [ebp + 0xc]
mov dword [edx], edi
jmp 0x43a8a3
cmp dword [ebp + 8], 0
je 0x43a8a3
movzx ebx, word [ebp - 0x16]
push ebx
mov eax, dword [sym.imp.WS2_32.dll_ntohs]
call eax
mov edx, dword [ebp + 8]
movzx eax, ax
mov dword [edx], eax
mov eax, dword [ebp - 4]
pop ebx
pop esi
pop edi
leave
ret