joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f03d
Capabilities:
Delete file

Disassembly:
push 0x7c
mov eax, 0x4663d1
call fcn.0044bb02
mov ebx, ecx
lea edi, [ebx + 0x1ac]
push str.Bootstrapper::forceMFCStudioCleanup___deleteCurVersionKeys
mov esi, edi
call fcn.00408ffd
pop ecx
lea eax, [ebp - 0x84]
push eax
call fcn.0042aaa2
pop ecx
and dword [ebp - 4], 0
cmp dword [eax + 0x18], 8
jb 0x41f07a
mov eax, dword [eax + 4]
jmp 0x41f07d
add eax, 4
mov cl, byte [ebx + 0x59]
mov byte [ebp - 0x68], cl
push eax
push dword [ebp - 0x68]
mov ecx, edi
call fcn.0042a617
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x84]
call fcn.0040970f
call fcn.0041f1a6
mov al, byte [ebx + 0x59]
mov byte [ebp - 0x68], al
push dword [ebp - 0x68]
lea eax, [ebp - 0x64]
push eax
call fcn.00419e24
xor ebx, ebx
inc ebx
push str.RobloxStudioLauncher.exe
lea eax, [ebp - 0x48]
mov dword [ebp - 4], ebx
call fcn.004081ea
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 2
call fcn.0040b348
add esp, 0xc
mov byte [ebp - 4], 3
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x41f0f5
lea eax, [ebp - 0x28]
push eax
push str.Bootstrapper::forceMFCStudioCleanup___deleting_studio_stub:__S
mov esi, edi
call fcn.00408ffd
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
pop ecx
pop ecx
jae 0x41f110
lea eax, [ebp - 0x28]
push eax
call fcn.0042d04e
pop ecx
test al, al
je 0x41f12e
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x41f127
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
push edi
push ebx
lea esi, [ebp - 0x2c]
call fcn.0040970f
push edi
push ebx
lea esi, [ebp - 0x48]
call fcn.0040970f
push edi
push ebx
lea esi, [ebp - 0x64]
call fcn.0040970f
call fcn.0044bb85
ret

Function at 0x427a7a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x427a91
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x427ac6
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x427ac2
cmp edi, eax
jae 0x427ac6
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x427ab4
cmp edi, eax
jb 0x427aca
xor eax, eax
jmp 0x427ad3
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x427c34
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x498ae8], 0
jne 0x427c64
push 0x4768b8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x427c5d
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x498aec], eax
mov byte [0x498ae8], 1
mov eax, dword [0x498aec]
test eax, eax
je 0x427c7c
push 0
push dword [esi + 4]
push dword [esp + 0xc]
push dword [esi]
call eax
jmp 0x427c88
push dword [esp + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
ret 4
Function at 0x427c8b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x48e190]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
push ecx
push dword [edi]
mov dword [ebp - 0x21c], ecx
xor esi, esi
or eax, 0x2001f
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
call fcn.0040c9e2
mov ebx, eax
cmp ebx, esi
je 0x427cf4
lea esi, [ebp - 0x214]
call fcn.0040ca20
mov eax, ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044763d
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x427d12
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.00427c8b
cmp eax, esi
jne 0x427d59
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call ebx
test eax, eax
je 0x427cfc
lea esi, [ebp - 0x214]
call fcn.0040ca20
push dword [ebp - 0x21c]
mov esi, edi
call fcn.00427c34
lea esi, [ebp - 0x214]
mov edi, eax
call fcn.0040ca20
mov eax, edi
jmp 0x427ce3

Function at 0x427f8d
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
mov edi, eax
call fcn.00427ee8
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
cmp dword [edi + 0x18], 8
lea ebx, [edi + 4]
jb 0x427fb4
mov eax, dword [ebx]
jmp 0x427fb6
mov eax, ebx
lea ecx, [ebp - 8]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 4], eax
test eax, eax
je 0x42804b
push eax
call fcn.00446c15
mov dword [esi + 4], eax
cmp dword [edi + 0x18], 8
pop ecx
jb 0x427fdd
mov ebx, dword [ebx]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x42804b
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x10]
push eax
push 0x46eae8
push dword [esi + 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x42804b
lea eax, [ebp - 4]
push eax
lea edi, [esi + 8]
push edi
push str.VarFileInfoTranslation
push dword [esi + 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x428042
mov eax, dword [ebp - 4]
cmp eax, 4
jb 0x428042
shr eax, 2
mov dword [esi + 0xc], eax
mov eax, dword [edi]
mov cx, word [eax]
mov word [esi], cx
mov ax, word [eax + 2]
mov word [esi + 2], ax
mov dword [ebp - 0xc], 1
jmp 0x42805d
mov eax, dword [esi + 4]
test eax, eax
je 0x42805d
push eax
call fcn.004479f9
and dword [esi + 4], 0
pop ecx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x429ef7
Capabilities:
Delete registry key

Disassembly:
push 0x4c
mov eax, 0x46634f
call fcn.0044ba99
test edi, edi
jne 0x429f32
push str.Attempt_to_delete_a_null_key
lea ecx, [ebp - 0x30]
call fcn.00408140
and dword [ebp - 4], edi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.004012a3
push 0x481228
lea eax, [ebp - 0x58]
push eax
call fcn.0044bba3
push edi
lea eax, [ebp - 0x30]
call fcn.004081ea
cmp dword [eax + 0x14], 0
push 0
push 1
lea esi, [ebp - 0x30]
sete byte [ebp - 0xd]
call fcn.0040970f
cmp byte [ebp - 0xd], 0
je 0x429f6b
push str.Attempt_to_delete_an_empty_key
lea ecx, [ebp - 0x30]
call fcn.00408140
mov dword [ebp - 4], 1
jmp 0x429f17
push edi
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jge 0x429fa5
lea eax, [ebp - 0x14]
push eax
call fcn.00429cf6
pop ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 2
push dword [eax]
push edi
push str.Failed_to_delete_key__S__S
call fcn.00408ffd
add esp, 0xc
lea eax, [ebp - 0x14]
call fcn.0040eb78
call fcn.0044bb71
ret

Function at 0x42a617
Capabilities:
Delete registry value

Disassembly:
push 0x24
mov eax, 0x46631c
call fcn.0044ba99
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
push str.deleteCurVersionKeys
mov dword [ebp - 4], ebx
call fcn.00408ffd
xor eax, eax
cmp byte [ebp + 8], bl
mov dword [esp], 0x46eb78
sete al
lea ecx, [ebp - 0x14]
add eax, 0x80000001
push eax
mov eax, 0x20006
call fcn.0040c9e2
test eax, eax
jl 0x42a6cb
push str.deleteCurVersionKeys___key_Opened
call fcn.00408ffd
pop ecx
push dword [ebp + 0xc]
lea eax, [ebp - 0x30]
push eax
call fcn.0042a51f
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x42a684
mov eax, dword [eax + 4]
jmp 0x42a687
add eax, 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
push dword [ebp - 0x14]
call edi
push ebx
push 1
lea esi, [ebp - 0x30]
call fcn.0040970f
push dword [ebp + 0xc]
lea eax, [ebp - 0x30]
push eax
call fcn.0042a59b
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x42a6b7
mov eax, dword [eax + 4]
jmp 0x42a6ba
add eax, 4
push eax
push dword [ebp - 0x14]
call edi
push ebx
push 1
lea esi, [ebp - 0x30]
call fcn.0040970f
lea esi, [ebp - 0x14]
call fcn.0040ca20
call fcn.0044bb71
ret
Function at 0x42b76e
Capabilities:
Delete file

Disassembly:
push 0x2c
mov eax, 0x466141
call fcn.0044bb02
mov esi, ecx
push edi
mov ebx, str.deleteDesktopShortcut____S
push ebx
mov dword [ebp - 0x34], esi
call fcn.00408ffd
xor esi, esi
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push 6
push eax
call fcn.0042cb7d
add esp, 0x1c
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], esi
je 0x42b831
mov eax, dword [0x497ae4]
mov ecx, 0x497ae4
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x42b7cd
lea eax, [ebp - 0x28]
push edi
push eax
push str._s_s.lnk
lea eax, [ebp - 0x30]
call fcn.0042363a
add esp, 0xc
push dword [ebp - 0x30]
call fcn.0042d04e
pop ecx
test al, al
je 0x42b829
push dword [ebp - 0x30]
mov esi, dword [ebp - 0x34]
push ebx
call fcn.00408ffd
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
lea eax, [ebp - 0x30]
inc bl
call fcn.0040eb78
xor esi, esi
push esi
push 1
lea esi, [ebp - 0x2c]
call fcn.0040970f
mov al, bl
call fcn.0044bb85
ret
lea eax, [ebp - 0x30]
call fcn.0040eb78
xor bl, bl
jmp 0x42b816

Function at 0x42b835
Capabilities:
Delete file

Disassembly:
push 0x2c
mov eax, 0x466141
call fcn.0044bb02
mov eax, dword [ebp + 0xc]
push eax
mov edi, str.deleteProgramsShortcut____S
mov esi, ecx
push edi
mov dword [ebp - 0x34], eax
call fcn.00408ffd
xor eax, eax
xor ebx, ebx
cmp byte [ebp + 8], bl
push 1
sete al
push ebx
push ebx
add eax, 3
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0042cb7d
add esp, 0x1c
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x42b8db
mov eax, dword [0x497ae4]
mov ecx, 0x497ae4
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x42b89e
lea eax, [ebp - 0x28]
push dword [ebp - 0x34]
push eax
push str._s_s.lnk
lea eax, [ebp - 0x30]
call fcn.0042363a
add esp, 0xc
push dword [ebp - 0x30]
call fcn.0042d04e
pop ecx
test al, al
je 0x42b8d3
push dword [ebp - 0x30]
push edi
call fcn.00408ffd
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x30]
call fcn.0040eb78
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.0040970f
call fcn.0044bb85
ret
Function at 0x42c088
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2898
call fcn.0045ae80
mov eax, dword [0x48e190]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2898], 0
push esi
lea eax, [ebp - 0x2898]
push eax
lea eax, [ebp - 0x2894]
push eax
mov esi, ecx
mov dword [ebp - 0x2898], 0x2880
call sub.IPHLPAPI.DLL_GetAdaptersInfo
lea eax, [ebp - 0x2894]
mov ecx, dword [eax + 0x1a0]
cmp ecx, 6
je 0x42c108
cmp ecx, 0x47
je 0x42c108
mov eax, dword [eax]
test eax, eax
jne 0x42c0cc
and dword [ebp - 0x14], eax
push edi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
push dword [ebp - 0x14]
push str._08X
call fcn.0042c7ab
pop ecx
pop ecx
pop edi
jmp 0x42c155
movzx ecx, byte [eax + 0x19b]
push ecx
movzx ecx, byte [eax + 0x19a]
push ecx
movzx ecx, byte [eax + 0x199]
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
push str._02x_02x_02x_02x_02x_02x_02x_02x
call fcn.0042c7ab
add esp, 0x24
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0044763d
leave
ret
Function at 0x42df84
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x48e190]
xor eax, esp
mov dword [esp + 0x194], eax
push 0x498b0c
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x42dfc6
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push eax
push 0x498b10
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.0044763d
mov esp, ebp
pop ebp
ret

Function at 0x42e17a
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
push 0xffffffffffffffff
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x498af4
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0
push dword [esi + 4]
test eax, eax
je 0x42e1c2
call dword [sym.imp.KERNEL32.dll_TerminateThread]
leave
ret
push method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_52
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
leave
ret
Function at 0x42e1da
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
xor edi, edi
push edi
push edi
push 1
push edi
call ebx
mov dword [esp + 8], eax
mov dword [esi + 4], eax
cmp eax, edi
jne 0x42e232
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
call fcn.00412e15
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
mov ecx, str.thread.entry_event
call fcn.0042de2b
pop ecx
push edi
push edi
push 1
push edi
call ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 8], eax
mov dword [esi + 8], eax
cmp dword [ebx + 8], edi
jne 0x42e27a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
call fcn.00412e15
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
mov ecx, str.thread.exit_event
call fcn.0042de2b
pop ecx
lea eax, [esp + 0x14]
push eax
push edi
push esi
push 0x42e310
push edi
push edi
mov dword [esp + 0x2c], edi
call fcn.0044a600
add esp, 0x18
mov dword [ebx + 4], eax
cmp eax, edi
jne 0x42e2ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
cmp dword [esp + 8], edi
je 0x42e2bd
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebx + 8]
cmp ebx, edi
je 0x42e2cb
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
call fcn.00412e15
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
mov ecx, str.thread
call fcn.0042de2b
pop ecx
cmp dword [esp + 8], edi
je 0x42e308
push 0xffffffffffffffff
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42ead3
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
push edi
mov esi, eax
je 0x42eb98
cmp byte [ebp + 0x10], 0
je 0x42eb1c
mov edi, dword [ebp + 0xc]
test byte [edi], 8
je 0x42eb1c
xor eax, eax
mov word [ebp - 8], ax
mov word [ebp - 6], ax
call fcn.00412e15
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov eax, edi
call fcn.0042ef4b
pop ecx
pop ecx
mov edi, dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
call edi
push dword [ebp + 8]
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
call ebx
push eax
call fcn.004355d3
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x42eb98
call fcn.00412e15
cmp dword [esi + 4], eax
jne 0x42eb51
cmp dword [esi], 0x2733
je 0x42eb63
call fcn.00412e15
cmp dword [esi + 4], eax
jne 0x42eb92
cmp dword [esi], 0x4d5
jne 0x42eb92
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x8004667e
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp + 0xc]
and byte [eax], 0xfc
push 0
call edi
push dword [ebp + 8]
call ebx
push eax
call fcn.004355d3
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42eba4
xor edi, edi
call fcn.00412e15
mov dword [esi], edi
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42ebac
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, eax
cmp ebx, 0xffffffff
jne 0x42ebc2
mov edi, 0x2719
jmp 0x42ebe3
xor edi, edi
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.WS2_32.dll_connect]
push eax
call fcn.004355d3
pop ecx
test eax, eax
jne 0x42ebed
call fcn.00412e15
mov dword [esi + 4], eax
mov dword [esi], edi
mov edi, 0x2734
call fcn.00412e15
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov ecx, esi
mov dword [ebp - 0xc], edi
call fcn.0042de0c
test al, al
je 0x42ec25
dec edi
call fcn.00412e15
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov ecx, esi
mov dword [ebp - 0xc], edi
call fcn.0042de0c
test al, al
jne 0x42ec60
mov eax, esi
mov ecx, ebx
call fcn.0042f113
test eax, eax
jl 0x42ec60
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push ebx
mov eax, esi
lea ecx, [ebp - 8]
mov dword [ebp - 8], 4
call fcn.0042efae
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x42ec60
call fcn.00412e15
mov ecx, dword [ebp - 4]
mov dword [esi], ecx
mov dword [esi + 4], eax
pop edi
pop esi
leave
ret
Function at 0x42f01f
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
mov edi, ecx
mov esi, eax
cmp edi, 0xffffffff
jne 0x42f048
mov edi, 0x2719
call fcn.00412e15
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
jmp 0x42f094
xor ebx, ebx
push ebx
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0x110], 1
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x110]
push eax
inc edi
push edi
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.004355d3
mov edi, eax
pop ecx
cmp edi, ebx
je 0x42f088
jle 0x42f092
call fcn.00412e15
mov dword [esi + 4], eax
mov dword [esi], ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42f099
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
mov edi, ecx
mov esi, eax
cmp edi, 0xffffffff
jne 0x42f0c2
mov edi, 0x2719
call fcn.00412e15
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
jmp 0x42f10e
xor ebx, ebx
push ebx
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0x110], 1
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
push ebx
lea eax, [ebp - 0x110]
push eax
push ebx
inc edi
push edi
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.004355d3
mov edi, eax
pop ecx
cmp edi, ebx
je 0x42f102
jle 0x42f10c
call fcn.00412e15
mov dword [esi + 4], eax
mov dword [esi], ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42f113
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
push edi
mov edi, ecx
mov esi, eax
cmp edi, 0xffffffff
jne 0x42f13b
mov edi, 0x2719
call fcn.00412e15
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
jmp 0x42f195
xor eax, eax
inc eax
push 0
mov dword [ebp - 0x208], edi
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x104], edi
mov dword [ebp - 0x108], eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
inc edi
push edi
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.004355d3
pop ecx
mov dword [ebp - 4], eax
test eax, eax
jl 0x42f192
xor edi, edi
call fcn.00412e15
mov dword [esi], edi
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x434090
Capabilities:
Resolve dns

Disassembly:
push 0x64
mov eax, 0x466f6a
call fcn.0044ba99
mov edi, ecx
lea eax, [ebp - 0x70]
xor ebx, ebx
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
call fcn.00434afe
mov esi, eax
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 1
call fcn.00434ae3
cmp dword [esi + 0x18], 0x10
jb 0x4340d2
mov ecx, dword [esi + 4]
jmp 0x4340d5
lea ecx, [esi + 4]
cmp dword [eax + 0x18], 0x10
jb 0x4340e0
mov esi, dword [eax + 4]
jmp 0x4340e3
lea esi, [eax + 4]
mov dword [ebp - 0x1c], ecx
cmp esi, ebx
je 0x4340ef
cmp byte [esi], 0
jne 0x4340f1
xor esi, esi
cmp ecx, ebx
je 0x4340fa
cmp byte [ecx], 0
jne 0x4340fd
mov dword [ebp - 0x1c], ebx
push ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov ecx, eax
lea esi, [ebp - 0x20]
call fcn.0042f199
mov ecx, dword [eax]
mov dword [edi], ecx
mov eax, dword [eax + 4]
push ebx
push 1
lea ecx, [ebp - 0x54]
mov dword [edi + 4], eax
call fcn.00409477
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.00409477
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], esi
push 2
pop ebx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
neg eax
sbb eax, eax
test eax, fcn.0043f600
je 0x434173
xor edi, edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], 1
jmp 0x4341c0
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00434afe
mov edi, eax
lea eax, [ebp - 0x70]
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 4
mov dword [ebp - 0x14], ebx
call fcn.00434ae3
mov dword [ebp - 4], 5
push dword [ebp - 0x18]
lea ecx, [ebp - 0x38]
push ecx
mov edx, edi
mov ecx, eax
mov dword [ebp - 0x14], 6
call fcn.00434b19
pop ecx
pop ecx
mov dword [ebp - 0x14], 0xe
xor edi, edi
mov edx, eax
mov eax, dword [ebp + 8]
call fcn.00432f63
or dword [ebp - 0x14], 0x10
test byte [ebp - 0x14], 8
je 0x4341e0
and dword [ebp - 0x14], 0xfffffff7
lea eax, [ebp - 0x34]
call fcn.004018fd
test byte [ebp - 0x14], 4
je 0x4341f5
and dword [ebp - 0x14], 0xfffffffb
push edi
push 1
lea ecx, [ebp - 0x70]
call fcn.00409477
test byte [ebp - 0x14], bl
je 0x434209
and dword [ebp - 0x14], 0xfffffffd
push edi
push 1
lea ecx, [ebp - 0x54]
call fcn.00409477
mov dword [ebp - 4], ebx
test byte [ebp - 0x14], 1
je 0x43421e
and dword [ebp - 0x14], 0xfffffffe
lea eax, [ebp - 0x28]
call fcn.004018fd
cmp esi, edi
je 0x434229
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, dword [ebp + 8]
call fcn.0044bb71
ret 8