joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d2e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 1
pop edi
xor ebx, ebx
cmp dword [0x4339cc], edi
mov byte [ebp - 0x14], 0x5c
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x5c
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xf], 0x44
mov byte [ebp - 0xe], 0x53
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x56
mov byte [ebp - 0xa], 0x58
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
jne 0x41d35c
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0041c5cd
add esp, 0x1c
cmp eax, 0xffffffff
mov dword [0x4339cc], eax
jne 0x41d35c
mov eax, 0x7532
jmp 0x41d413
cmp dword [0x4339bc], ebx
jne 0x41d3b9
xor esi, esi
push dword [ebp + 0x10]
push 0x4339cc
push dword [ebp + 8]
call fcn.0041d475
add esp, 0xc
cmp eax, ebx
je 0x41d395
cmp eax, 0x6688
jne 0x41d3a1
push 0x1f4
call fcn.0041d418
inc esi
pop ecx
cmp esi, 3
jl 0x41d366
cmp esi, 3
jne 0x41d3b9
mov esi, 0x4f1a
jmp 0x41d3a3
mov esi, eax
push dword [0x4339cc]
call fcn.0041c6f6
pop ecx
mov dword [0x4339cc], edi
mov eax, esi
jmp 0x41d413
push dword [ebp + 8]
push dword [ebp + 0x10]
call fcn.0041a622
lea eax, [ebp - 4]
push ebx
push eax
push 0x80
push dword [ebp + 0xc]
push 0x90
push dword [ebp + 8]
push 5
push dword [0x4339cc]
call fcn.0041c658
add esp, 0x28
test eax, eax
je 0x41d3fc
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.0041c8e5
pop ecx
pop ecx
jmp 0x41d413
push dword [0x4339cc]
call fcn.0041c6f6
pop ecx
mov dword [0x4339cc], edi
call fcn.0041c76f
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41d7e9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4339cc]
push ebx
xor ebx, ebx
cmp eax, 1
mov byte [ebp - 0x14], 0x5c
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x5c
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xf], 0x44
mov byte [ebp - 0xe], 0x53
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x56
mov byte [ebp - 0xa], 0x58
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
jne 0x41d85f
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0041c5cd
add esp, 0x1c
cmp eax, 0xffffffff
mov dword [0x4339cc], eax
jne 0x41d85f
mov eax, 0x7532
jmp 0x41d8ad
lea ecx, [ebp - 4]
push ebx
push ecx
push 0x80
push dword [ebp + 0xc]
push 0x90
push dword [ebp + 8]
push 5
push eax
call fcn.0041c658
add esp, 0x20
test eax, eax
je 0x41d892
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.0041c8e5
pop ecx
pop ecx
jmp 0x41d8ad
push dword [0x4339cc]
call fcn.0041c6f6
pop ecx
mov dword [0x4339cc], 1
call fcn.0041c76f
pop ebx
leave
ret
Function at 0x41e31b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0041a58e
and byte [ebp - 0xa], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x65
call fcn.0041a5bd
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x41e373
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0041a58e
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x41e390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0041a58e
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x41
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x6f
call fcn.0041a5bd
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x41e3ec
leave
ret
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0041a58e
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x41e40c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 4], 0
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x12], 0x44
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0x1d], 0x75
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0x1b], 0x44
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 0x19], 0x44
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 9], 0x6f
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 8], 0x4c
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 7], 0x69
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 6], 0x73
mov byte [ebp - 0x13], 0x79
mov byte [ebp - 5], 0x74
call fcn.0041e4bf
test eax, eax
je 0x41e49e
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x41e4a2
xor eax, eax
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1d
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.0041a58e
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x41e4bf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0041a58e
and byte [ebp - 8], 0
add esp, 0xc
cmp dword [0x4339ac], 1
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x11], 0x75
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 9], 0x6c
jne 0x41e521
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4339ac], eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0041a58e
mov eax, dword [0x4339ac]
add esp, 0xc
leave
ret

Function at 0x41e538
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and byte [ebp - 1], 0
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 4], 0x63
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x13], 0x75
mov byte [ebp - 0xb], 0x49
mov byte [ebp - 3], 0x65
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 2], 0x73
mov byte [ebp - 0x19], 0x75
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x17], 0x44
mov byte [ebp - 0xf], 0x76
mov byte [ebp - 7], 0x72
mov byte [ebp - 0x16], 0x69
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x15], 0x45
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 5], 0x61
call fcn.0041e4bf
test eax, eax
je 0x41e5c6
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x41e5ca
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1c
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.0041a58e
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x41e5f3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and byte [ebp - 4], 0
mov byte [ebp - 0x18], 0x53
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 6], 0x73
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x11], 0x47
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 5], 0x41
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 0x15], 0x75
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 9], 0x44
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 7], 0x76
call fcn.0041e4bf
test eax, eax
je 0x41e66a
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, fcn.0041e5f3
test ecx, ecx
jne 0x41e66e
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x15
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.0041a58e
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x41e72b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and byte [ebp - 4], 0
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x18], 0x76
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x21], 0x75
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x20], 0x70
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 8], 0x61
mov byte [ebp - 0x1f], 0x44
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 7], 0x69
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 6], 0x6c
mov byte [ebp - 0x1d], 0x47
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 5], 0x41
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0xd], 0x63
call fcn.0041e4bf
test eax, eax
je 0x41e7cd
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x41e7d1
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x21
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0041a58e
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x41eb20
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x104
mov al, byte [0x433f60]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x14], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x15]
push 0x100
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x18]
push ecx
stosb byte es:[edi], al
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x41ebb5
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
mov dword [esp + 0x10], esi
je 0x41ebb5
mov edi, dword [esp + 0x11c]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
xor ebx, ebx
mov eax, dword [esi + 0xc]
mov eax, dword [eax + ebx]
test eax, eax
je 0x41ebb5
mov ecx, dword [eax]
push ecx
call ebp
xor ecx, ecx
test edi, edi
jle 0x41ebad
mov esi, dword [esp + 0x118]
mov edx, dword [esi]
test edx, edx
jbe 0x41eba1
cmp edx, eax
je 0x41ebc2
inc ecx
add esi, 4
cmp ecx, edi
jl 0x41eb97
mov esi, dword [esp + 0x10]
add ebx, 4
cmp ebx, 0x40
jl 0x41eb7b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x104
ret
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x104
ret

Function at 0x4227d1
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x14]
mov ecx, edi
call fcn.004270d0
test al, al
jne 0x42285d
mov al, byte [esi + 0xa58]
test al, al
jne 0x422831
call sub.KERNEL32.dll_GetTickCount
cmp dword [esi + 0xa50], eax
jbe 0x422804
mov dword [esi + 0xa50], 0
mov edx, dword [esi + 0xa50]
mov ecx, eax
sub ecx, edx
cmp ecx, 0x7d0
jbe 0x422831
lea edx, [esp + 0xb]
push 1
push edx
push 0x73
mov ecx, edi
mov byte [esp + 0x17], 0
mov dword [esi + 0xa50], eax
call fcn.00424b60
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
push eax
push ecx
push edx
lea ecx, [esi + 0x220]
call fcn.00425de0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x24]
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0x298], eax
pop edi
xor eax, eax
pop esi
pop ecx
ret 0x1c
Function at 0x422d60
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov al, byte [esi + 0x29c]
xor ebx, ebx
test al, al
mov byte [esp + 0x28], 0
mov dword [esp + 0x14], edi
mov byte [esp + 0x24], 0
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
jne 0x422ed5
mov al, byte [esi + 0x1e8]
test al, al
je 0x422ed5
mov eax, dword [esi + 0x23c]
cmp eax, edi
mov dword [esp + 0x10], eax
jbe 0x422ebd
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x24]
push ecx
lea eax, [esp + 0x2c]
push edx
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x24]
push ecx
lea eax, [esp + 0x3c]
push edx
push eax
lea ecx, [esi + 0x220]
mov dword [esp + 0x2c], edi
call fcn.00426000
test al, al
je 0x422ea7
call sub.KERNEL32.dll_GetTickCount
lea edi, [esi + 0x27c]
mov ebp, eax
mov ecx, edi
call fcn.0040d5b0
mov ecx, dword [esi + 0x278]
test ecx, ecx
je 0x422e32
mov eax, dword [esp + 0x18]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
add eax, 0xc
push eax
call dword [edx]
mov ecx, edi
call fcn.0040d5c0
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00403f90
add esp, 4
call sub.KERNEL32.dll_GetTickCount
mov edx, dword [esi + 0x224]
mov edi, dword [esp + 0x18]
sub eax, ebp
test ebx, ebx
jne 0x422e5d
mov ebx, edi
mov ecx, edi
sub ecx, eax
sub ecx, ebx
cmp edx, 0x64
mov ebx, edi
jl 0x422e77
mov eax, dword [esp + 0x1c]
lea edi, [edx + edx]
cmp eax, edi
jb 0x422e89
jmp 0x422e85
mov eax, dword [esp + 0x1c]
cmp eax, 0x64
jb 0x422e89
mov edx, 0x64
sub edx, eax
add ecx, edx
cmp ecx, 0x12c
jle 0x422e98
mov ecx, 0x12c
jmp 0x422e9c
test ecx, ecx
jle 0x422ea5
push ecx
call fcn.0040d110
add esp, 4
xor edi, edi
mov eax, dword [esi + 0x228]
cmp eax, edi
jle 0x422ec7
push eax
push 0x11
mov ecx, esi
call fcn.00422b90
jmp 0x422ec7
push 1
call fcn.0040d110
add esp, 4
mov al, byte [esi + 0x29c]
test al, al
je 0x422d95
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x427d60
Capabilities:
Get socket status

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call fcn.004284b0
test eax, eax
jne 0x427d82
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret
lea esi, [ebp + 0x60]
mov ecx, 0x41
lea edi, [esp + 0x1c]
xor bl, bl
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push 0
push 0
inc eax
push edx
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x427dc9
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret
mov al, byte [ebp + 0x14]
test al, al
je 0x427ddd
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret
lea edi, [ebp + 0x28]
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0040d5b0
mov eax, dword [ebp + 0x1c]
mov esi, dword [eax]
cmp esi, eax
je 0x427e79
mov ecx, dword [0x434500]
mov edi, dword [esi + 0x10]
test edi, edi
je 0x427e3e
mov ecx, edi
call fcn.004287e0
test al, al
jne 0x427e38
mov ecx, edi
call fcn.00428760
cmp eax, 0xffffffff
je 0x427e38
lea ecx, [esp + 0x1c]
push ecx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x427e38
mov ecx, edi
call fcn.00428770
test al, al
je 0x427e38
mov bl, 1
mov ecx, dword [0x434500]
mov eax, dword [esi + 8]
cmp eax, ecx
je 0x427e57
mov esi, eax
mov eax, dword [esi]
cmp eax, ecx
je 0x427e70
mov esi, eax
mov eax, dword [esi]
cmp eax, ecx
jne 0x427e4d
jmp 0x427e70
mov eax, dword [esi + 4]
cmp esi, dword [eax + 8]
jne 0x427e69
mov esi, eax
mov eax, dword [eax + 4]
cmp esi, dword [eax + 8]
je 0x427e5f
cmp dword [esi + 8], eax
je 0x427e70
mov esi, eax
cmp esi, dword [ebp + 0x1c]
jne 0x427dfe
mov edi, dword [esp + 0x10]
mov ecx, edi
call fcn.0040d5c0
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0x110
ret
Function at 0x428500
Capabilities:
Get socket status

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call fcn.004284b0
test eax, eax
jne 0x428522
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret
lea esi, [ebp + 0x44]
mov ecx, 0x41
lea edi, [esp + 0x1c]
lea edx, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x14]
xor bl, bl
push ecx
push 0
push edx
inc eax
push 0
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x428569
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret
mov al, byte [ebp + 0x14]
test al, al
je 0x42857d
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret
lea edi, [ebp + 0x28]
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0040d5b0
mov eax, dword [ebp + 0x1c]
mov esi, dword [eax]
cmp esi, eax
je 0x428619
mov ecx, dword [0x434500]
mov edi, dword [esi + 0x10]
test edi, edi
je 0x4285de
mov ecx, edi
call fcn.004287e0
test al, al
jne 0x4285d8
mov ecx, edi
call fcn.00428760
cmp eax, 0xffffffff
je 0x4285d8
lea ecx, [esp + 0x1c]
push ecx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4285d8
mov ecx, edi
call fcn.00428690
test al, al
je 0x4285d8
mov bl, 1
mov ecx, dword [0x434500]
mov eax, dword [esi + 8]
cmp eax, ecx
je 0x4285f7
mov esi, eax
mov eax, dword [esi]
cmp eax, ecx
je 0x428610
mov esi, eax
mov eax, dword [esi]
cmp eax, ecx
jne 0x4285ed
jmp 0x428610
mov eax, dword [esi + 4]
cmp esi, dword [eax + 8]
jne 0x428609
mov esi, eax
mov eax, dword [eax + 4]
cmp esi, dword [eax + 8]
je 0x4285ff
cmp dword [esi + 8], eax
je 0x428610
mov esi, eax
cmp esi, dword [ebp + 0x1c]
jne 0x42859e
mov edi, dword [esp + 0x10]
mov ecx, edi
call fcn.0040d5c0
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0x110
ret
Function at 0x40f824
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4db6a7
call fcn.004d34a0
push ecx
push ebx
push esi
xor ebx, ebx
mov esi, ecx
inc ebx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], ebx
xor edi, edi
lea ecx, [esi + 0x14]
mov dword [ebp - 4], edi
mov dword [esi], 0x50068c
call dword [0x4eb6ec]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], bl
call dword [0x4eb6ec]
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 2
call dword [0x4eb6ec]
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea eax, [esi + 0x80]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
push dword [ebp + 8]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 5
mov dword [esi + 8], ebx
call dword [0x4eb76c]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x78], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x7c], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x412c04
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4dc6c4
call fcn.004d34a0
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi + 0x10], 0x4f70a0
mov dword [esi], str.luacodeHostWndHelper.lua
mov dword [esi + 4], 0x4eed6c
mov dword [esi + 8], 0x4eed54
mov dword [esi + 0xc], str.ImportUnfinishedTask.RegisterObj
mov dword [esi + 0x10], 0x4eed1c
mov byte [esi + 0x17], bl
mov byte [esi + 0x18], bl
mov byte [esi + 0x19], bl
mov byte [esi + 0x1a], bl
mov byte [esi + 0x1b], bl
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov byte [ebp - 4], 0xc
mov dword [esi + 0x98], ebx
mov dword [esi + 0x2a4], 0xfefefefe
call fcn.0042163e
push 0x104
lea edi, [esi + 0x9c]
push edi
push ebx
call dword [0x4eb3d4]
push 0x4eecf0
push edi
call dword [0x4ebaec]
push ebx
push 0x4ec294
push edi
call fcn.0049037c
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x412c12
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4dc6c4
call fcn.004d34a0
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi + 0x10], 0x4f70a0
mov dword [esi], str.luacodeHostWndHelper.lua
mov dword [esi + 4], 0x4eed6c
mov dword [esi + 8], 0x4eed54
mov dword [esi + 0xc], str.ImportUnfinishedTask.RegisterObj
mov dword [esi + 0x10], 0x4eed1c
mov byte [esi + 0x17], bl
mov byte [esi + 0x18], bl
mov byte [esi + 0x19], bl
mov byte [esi + 0x1a], bl
mov byte [esi + 0x1b], bl
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov byte [ebp - 4], 0xc
mov dword [esi + 0x98], ebx
mov dword [esi + 0x2a4], 0xfefefefe
call fcn.0042163e
push 0x104
lea edi, [esi + 0x9c]
push edi
push ebx
call dword [0x4eb3d4]
push 0x4eecf0
push edi
call dword [0x4ebaec]
push ebx
push 0x4ec294
push edi
call fcn.0049037c
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x425618
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4ddbde
call fcn.004d34a0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi], 0x4f1b20
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea ecx, [esi + 0x14]
mov dword [ebp - 4], ebx
call dword [0x4eb6ec]
mov byte [esi + 0x30], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
lea edi, [esi + 0x48]
mov ecx, edi
mov byte [ebp - 4], 2
mov byte [esi + 0x44], bl
call dword [0x4eb6c8]
push dword [ebp + 8]
mov ecx, edi
mov byte [ebp - 4], 3
call dword [0x4eb748]
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4