joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425c10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404830
mov eax, dword [ebp + 0xc]
call fcn.00404830
mov eax, dword [ebp + 8]
call fcn.00404830
xor eax, eax
push ebp
push 0x425d5e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov ecx, 0x425d78
mov edx, dword [ebp - 4]
mov eax, 0x80000002
call fcn.00425994
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf013f
push 0
push 0x425d84
push 0
mov eax, dword [ebp - 4]
call fcn.00404840
push eax
push edi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x425d3b
cmp esi, 4
jne 0x425cbd
xor edx, edx
mov eax, dword [ebp + 8]
call fcn.00407c6c
mov dword [ebp - 0x10], eax
push 4
lea eax, [ebp - 0x10]
push eax
push esi
push 0
mov eax, dword [ebp + 0xc]
call fcn.00404840
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
jmp 0x425d29
cmp esi, 7
jne 0x425cfd
lea eax, [ebp + 8]
mov edx, 0x425d94
call fcn.00404648
mov eax, dword [ebp + 8]
call fcn.00404640
push eax
lea eax, [ebp + 8]
call fcn.00404898
push eax
push esi
push 0
mov eax, dword [ebp + 0xc]
call fcn.00404840
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
jmp 0x425d29
mov eax, dword [ebp + 8]
call fcn.00404640
push eax
lea eax, [ebp + 8]
call fcn.00404898
push eax
push esi
push 0
mov eax, dword [ebp + 0xc]
call fcn.00404840
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegFlushKey
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425d65
lea eax, [ebp - 4]
call fcn.00404394
lea eax, [ebp + 8]
mov edx, 2
call fcn.004043b8
ret

Function at 0x426384
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
or eax, 0x10000
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0x20000
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop ebx
pop ebp
ret 0x18

Function at 0x426680
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov dword [esp], eax
push 0
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.wsock32.dll_send
inc eax
setne al
pop edx
ret
Function at 0x42686c
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x426922
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404394
xor eax, eax
push ebp
push 0x426902
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4268b9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42690c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
xor ebx, ebx
jmp 0x4268ee
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.0040459c
push dword [ebp - 0xc]
push 0x426938
push dword [esi]
mov eax, esi
mov edx, 3
call fcn.00404700
inc ebx
mov eax, dword [ebp - 4]
mov edi, dword [eax + ebx*4]
test edi, edi
jne 0x4268c6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42690c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426929
lea eax, [ebp - 0xc]
call fcn.00404394
ret

Function at 0x426964
Capabilities:
Set socket configuration

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
cmp dword [ebx], 0xffffffff
je 0x4269c7
mov byte [esp], 0
push 1
lea eax, [esp + 4]
push eax
push 0xff7f
push 0xffff
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_setsockopt
mov word [esp + 2], 1
mov word [esp + 4], 0
push 4
lea eax, [esp + 6]
push eax
push 0x80
push 0xffff
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_setsockopt
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_closesocket
inc eax
sete al
mov dword [ebx], 0xffffffff
pop ecx
pop edx
pop ebx
ret

Function at 0x4269cc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, 3
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.wsock32.dll_send
mov ebx, eax
call sub.wsock32.dll_WSAGetLastError
test ebx, ebx
jg 0x426a12
cmp eax, 0x274c
je 0x426a0b
cmp ebx, 1
jl 0x426a12
test ebx, ebx
je 0x426a12
dec esi
jne 0x4269e2
mov eax, ebx
test ebx, ebx
jne 0x426a1b
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x426a24
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, 3
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.wsock32.dll_recv
mov ebx, eax
call sub.wsock32.dll_WSAGetLastError
test ebx, ebx
jg 0x426a6a
cmp eax, 0x274c
je 0x426a63
cmp ebx, 1
jl 0x426a6a
test ebx, ebx
je 0x426a6a
dec esi
jne 0x426a3a
mov eax, ebx
test ebx, ebx
jne 0x426a73
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x426ccc
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404830
xor eax, eax
push ebp
push 0x426ee8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov dword [ebp - 0x14], 3
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x426eb1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0x2710
push 4
lea eax, [ebp - 0x10]
push eax
push 0x1006
push 0xffff
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_setsockopt
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x426d51
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x426ed2
mov dword [ebp - 0x10], 0x2710
push 4
lea eax, [ebp - 0x10]
push eax
push 0x1005
push 0xffff
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_setsockopt
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x426d87
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x426ed2
xor eax, eax
mov dword [ebp - 0x10], eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x1001
push 0xffff
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_setsockopt
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x426dbb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x426ed2
mov dword [ebp - 0x10], 0x2000
push 4
lea eax, [ebp - 0x10]
push eax
push 0x1002
push 0xffff
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_setsockopt
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x426df1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x426ed2
lea eax, [ebp - 0x34]
xor ecx, ecx
mov edx, 0x10
call fcn.00402de4
mov word [ebp - 0x34], 2
mov ax, word [ebp - 8]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x32], ax
mov eax, dword [ebp - 4]
call fcn.00404840
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x24]
push eax
push 0x8004667e
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_ioctlsocket
push 0x10
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_connect
lea eax, [ebp - 0x138]
call fcn.0040bdf8
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 0x18]
call fcn.0040bde8
mov dword [ebp - 0x20], 0xa
mov dword [ebp - 0x1c], 0xf4240
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0x138]
push eax
push 0
push 0
call sub.wsock32.dll_select
test eax, eax
setg byte [ebp - 9]
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push 0x8004667e
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_ioctlsocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x426ebb
lea eax, [ebp - 0x18]
call fcn.00426964
cmp byte [ebp - 9], 0
jne 0x426ed2
dec dword [ebp - 0x14]
jne 0x426cff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426eef
lea eax, [ebp - 4]
call fcn.00404394
ret
Function at 0x42b7e4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffbd4
mov esi, eax
xor ebx, ebx
mov byte [esi + 0x43c], 0x2b
mov word [esi + 0x456], 0
mov eax, 0x42b8e0
call fcn.004261e8
mov byte [esp + 0x425], al
mov eax, 0x42b8e0
call fcn.004261e8
mov byte [esp + 0x426], al
mov eax, 0x42b8ec
call fcn.004261e8
mov byte [esp + 0x427], al
mov eax, 0x42b8e0
call fcn.004261e8
mov byte [esp + 0x428], al
mov eax, 0x42b8ec
call fcn.004261e8
mov byte [esp + 0x429], al
mov eax, 0x42b8f8
call fcn.004261e8
mov byte [esp + 0x42a], al
push esi
add esi, 0x438
lea edi, [esp + 0x409]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push 0x26
call sub.wsock32.dll_htonl
mov dword [esp + 0x401], eax
push 0
push 0x2a
lea eax, [esp + 0x409]
push eax
mov eax, dword [esi + 0x430]
push eax
call sub.wsock32.dll_send
test eax, eax
jle 0x42b8cc
mov bl, 1
push 0
lea edx, [esp + 4]
mov ecx, 0x400
mov eax, dword [esi + 0x430]
call fcn.00426a24
test eax, eax
jle 0x42b8cc
mov eax, esp
cmp byte [eax + 8], 0x2b
sete bl
mov eax, ebx
add esp, 0x42c
pop edi
pop esi
pop ebx
ret

Function at 0x42b9e8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffbb0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x28]
push ecx
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop ecx
mov ebx, ecx
test ebx, ebx
js 0x42ba1a
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x42ba13
mov edx, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor edi, edi
mov ebx, dword [ebp - 8]
inc ebx
test ebx, ebx
je 0x42babe
lea edx, [ebp - 0x142a]
mov eax, dword [ebp - 4]
mov ecx, ebx
call fcn.00402c04
push esi
push edi
lea esi, [ebp - 0x28]
lea edi, [ebp - 0x144a]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
add ebx, 0x425
sub ebx, 0x400
dec ebx
mov eax, ebx
sub eax, 4
push eax
call sub.wsock32.dll_htonl
mov dword [ebp - 0x144e], eax
push 0
push ebx
lea eax, [ebp - 0x144e]
push eax
mov eax, dword [esi + 0x430]
push eax
call sub.wsock32.dll_send
test eax, eax
jle 0x42babe
push 0
lea edx, [ebp - 0x1029]
mov ecx, 0x1000
mov eax, dword [esi + 0x430]
call fcn.00426a24
mov ebx, eax
test ebx, ebx
jle 0x42babe
lea edx, [esi + 8]
lea eax, [ebp - 0x1029]
mov ecx, ebx
call fcn.00402c04
mov edi, ebx
mov eax, edi
mov edi, dword [ebp - 0x145c]
mov esi, dword [ebp - 0x1458]
mov ebx, dword [ebp - 0x1454]
mov esp, ebp
pop ebp
ret 4
Function at 0x42bad8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb4
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x24]
push ecx
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop ecx
mov ebx, ecx
test ebx, ebx
js 0x42bb03
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x42bafc
mov edx, esp
mov dword [ebp - 4], ecx
mov esi, eax
xor eax, eax
mov ebx, dword [ebp - 4]
inc ebx
test ebx, ebx
je 0x42bb69
mov eax, edx
lea edx, [ebp - 0x425]
mov ecx, ebx
call fcn.00402c04
push esi
lea esi, [ebp - 0x24]
lea edi, [ebp - 0x445]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
add ebx, 0x425
sub ebx, 0x400
dec ebx
mov eax, ebx
sub eax, 4
push eax
call sub.wsock32.dll_htonl
mov dword [ebp - 0x449], eax
push 0
push ebx
lea eax, [ebp - 0x449]
push eax
mov eax, dword [esi + 0x430]
push eax
call sub.wsock32.dll_send
mov edi, dword [ebp - 0x458]
mov esi, dword [ebp - 0x454]
mov ebx, dword [ebp - 0x450]
mov esp, ebp
pop ebp
ret 4

Function at 0x42f9d8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffbd4
mov esi, eax
xor ebx, ebx
mov byte [esi + 0x43c], 0x2b
mov word [esi + 0x456], 0
mov eax, 0x42fad4
call fcn.004261e8
mov byte [esp + 0x425], al
mov eax, 0x42fad4
call fcn.004261e8
mov byte [esp + 0x426], al
mov eax, 0x42fae0
call fcn.004261e8
mov byte [esp + 0x427], al
mov eax, 0x42fad4
call fcn.004261e8
mov byte [esp + 0x428], al
mov eax, 0x42fae0
call fcn.004261e8
mov byte [esp + 0x429], al
mov eax, 0x42faec
call fcn.004261e8
mov byte [esp + 0x42a], al
push esi
add esi, 0x438
lea edi, [esp + 0x409]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push 0x26
call sub.wsock32.dll_htonl
mov dword [esp + 0x401], eax
push 0
push 0x2a
lea eax, [esp + 0x409]
push eax
mov eax, dword [esi + 0x430]
push eax
call sub.wsock32.dll_send
test eax, eax
jle 0x42fac0
mov bl, 1
push 0
lea edx, [esp + 4]
mov ecx, 0x400
mov eax, dword [esi + 0x430]
call fcn.00426a24
test eax, eax
jle 0x42fac0
mov eax, esp
cmp byte [eax + 8], 0x2b
sete bl
mov eax, ebx
add esp, 0x42c
pop edi
pop esi
pop ebx
ret
Function at 0x42fbdc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffbb0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x28]
push ecx
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop ecx
mov ebx, ecx
test ebx, ebx
js 0x42fc0e
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x42fc07
mov edx, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor edi, edi
mov ebx, dword [ebp - 8]
inc ebx
test ebx, ebx
je 0x42fcb2
lea edx, [ebp - 0x142a]
mov eax, dword [ebp - 4]
mov ecx, ebx
call fcn.00402c04
push esi
push edi
lea esi, [ebp - 0x28]
lea edi, [ebp - 0x144a]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
add ebx, 0x425
sub ebx, 0x400
dec ebx
mov eax, ebx
sub eax, 4
push eax
call sub.wsock32.dll_htonl
mov dword [ebp - 0x144e], eax
push 0
push ebx
lea eax, [ebp - 0x144e]
push eax
mov eax, dword [esi + 0x430]
push eax
call sub.wsock32.dll_send
test eax, eax
jle 0x42fcb2
push 0
lea edx, [ebp - 0x1029]
mov ecx, 0x1000
mov eax, dword [esi + 0x430]
call fcn.00426a24
mov ebx, eax
test ebx, ebx
jle 0x42fcb2
lea edx, [esi + 8]
lea eax, [ebp - 0x1029]
mov ecx, ebx
call fcn.00402c04
mov edi, ebx
mov eax, edi
mov edi, dword [ebp - 0x145c]
mov esi, dword [ebp - 0x1458]
mov ebx, dword [ebp - 0x1454]
mov esp, ebp
pop ebp
ret 4

Function at 0x42fccc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb4
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x24]
push ecx
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop ecx
mov ebx, ecx
test ebx, ebx
js 0x42fcf7
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x42fcf0
mov edx, esp
mov dword [ebp - 4], ecx
mov esi, eax
xor eax, eax
mov ebx, dword [ebp - 4]
inc ebx
test ebx, ebx
je 0x42fd5d
mov eax, edx
lea edx, [ebp - 0x425]
mov ecx, ebx
call fcn.00402c04
push esi
lea esi, [ebp - 0x24]
lea edi, [ebp - 0x445]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
add ebx, 0x425
sub ebx, 0x400
dec ebx
mov eax, ebx
sub eax, 4
push eax
call sub.wsock32.dll_htonl
mov dword [ebp - 0x449], eax
push 0
push ebx
lea eax, [ebp - 0x449]
push eax
mov eax, dword [esi + 0x430]
push eax
call sub.wsock32.dll_send
mov edi, dword [ebp - 0x458]
mov esi, dword [ebp - 0x454]
mov ebx, dword [ebp - 0x450]
mov esp, ebp
pop ebp
ret 4
Function at 0x43c370
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404830
xor eax, eax
push ebp
push 0x43c4b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x43c49a
xor eax, eax
push ebp
push 0x43c488
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x10
call fcn.0040b5cc
mov word [ebp - 0x28], 2
push esi
call sub.wsock32.dll_htons
mov word [ebp - 0x26], ax
mov eax, dword [ebp - 4]
call fcn.00404840
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 1
lea eax, [ebp - 0x18]
push eax
push 0x8004667e
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_ioctlsocket
push 0x10
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_connect
lea eax, [ebp - 0x12c]
mov edx, 0x104
call fcn.0040b5cc
lea eax, [ebp - 0x12c]
call fcn.0040bdf8
lea edx, [ebp - 0x12c]
mov eax, dword [ebp - 0xc]
call fcn.0040bde8
mov dword [ebp - 0x10], 0xf4240
mov eax, dword [ebx + 0x60]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x12c]
push eax
push 0
push 0
call sub.wsock32.dll_select
test eax, eax
jle 0x43c475
mov eax, dword [ebp - 0xc]
call fcn.00426680
test al, al
jne 0x43c479
xor eax, eax
jmp 0x43c47b
mov al, 1
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43c492
lea eax, [ebp - 0xc]
call fcn.00426964
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c4b7
lea eax, [ebp - 4]
call fcn.00404394
ret
Function at 0x43c4c4
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404830
xor eax, eax
push ebp
push 0x43c6e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov dword [ebp - 0x14], 3
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x43c6a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0x2710
push 4
lea eax, [ebp - 0x10]
push eax
push 0x1006
push 0xffff
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_setsockopt
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x43c549
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43c6ca
mov dword [ebp - 0x10], 0x2710
push 4
lea eax, [ebp - 0x10]
push eax
push 0x1005
push 0xffff
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_setsockopt
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x43c57f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43c6ca
xor eax, eax
mov dword [ebp - 0x10], eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x1001
push 0xffff
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_setsockopt
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x43c5b3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43c6ca
mov dword [ebp - 0x10], 0x2000
push 4
lea eax, [ebp - 0x10]
push eax
push 0x1002
push 0xffff
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_setsockopt
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x43c5e9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43c6ca
lea eax, [ebp - 0x34]
xor ecx, ecx
mov edx, 0x10
call fcn.00402de4
mov word [ebp - 0x34], 2
mov ax, word [ebp - 8]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x32], ax
mov eax, dword [ebp - 4]
call fcn.00404840
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x24]
push eax
push 0x8004667e
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_ioctlsocket
push 0x10
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_connect
lea eax, [ebp - 0x138]
call fcn.0040bdf8
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 0x18]
call fcn.0040bde8
mov dword [ebp - 0x20], 0xa
mov dword [ebp - 0x1c], 0xf4240
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0x138]
push eax
push 0
push 0
call sub.wsock32.dll_select
test eax, eax
setg byte [ebp - 9]
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push 0x8004667e
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_ioctlsocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43c6b3
lea eax, [ebp - 0x18]
call fcn.00426964
cmp byte [ebp - 9], 0
jne 0x43c6ca
dec dword [ebp - 0x14]
jne 0x43c4f7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c6e7
lea eax, [ebp - 4]
call fcn.00404394
ret
Function at 0x43ccf4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404830
xor eax, eax
push ebp
push 0x43ce65
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x94], 0
je 0x43ce4f
test ebx, ebx
je 0x43ce4f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
call fcn.00409070
xor eax, eax
push ebp
push 0x43ce3a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov edx, dword [ebp - 8]
call fcn.00409508
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.0040b158
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.0040b0e0
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
cdq
cmp edx, dword [esp + 4]
jne 0x43cd92
cmp eax, dword [esp]
pop edx
pop eax
jae 0x43ce30
jmp 0x43cd9a
pop edx
pop eax
jge 0x43ce30
call fcn.0040b158
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov edx, dword [ebp - 8]
call fcn.00409304
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x43ce1a
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040b158
mov eax, dword [ebp - 4]
fstp qword [eax + 0x78]
wait
mov ecx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc0]
mov edx, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc0]
mov edx, dword [eax]
call dword [edx + 8]
cmp eax, 0x64
jle 0x43ce10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc0]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43ce24
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
call sub.kernel32.dll_LeaveCriticalSection_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43ce44
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
call fcn.0040907c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ce6c
lea eax, [ebp - 8]
call fcn.00404394
ret