joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428960
Capabilities:
Get common file path
Get disk information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4289a5
lea eax, [ebp - 0x108]
push eax
push 0x103
call sub.KERNEL32.dll_GetCurrentDirectoryA
test eax, eax
je 0x428994
cmp eax, dword [ebp + 0x10]
jle 0x428a4c
mov dword [0x46cdf8], 8
xor eax, eax
jmp 0x428ab6
cmp dword [0x461c9c], 2
jne 0x4289ea
mov eax, ebx
mov edx, eax
add dl, 0x40
mov byte [ebp - 0x108], dl
mov byte [ebp - 0x107], 0x3a
mov byte [ebp - 0x106], 0x5c
mov byte [ebp - 0x105], 0
lea edx, [ebp - 0x108]
add edx, 3
mov esi, edx
mov dl, al
mov ah, 0x47
int 0x21
jae 0x428a4c
xor eax, eax
jmp 0x428ab6
call sub.KERNEL32.dll_GetLogicalDrives
lea ecx, [ebx - 1]
mov edx, 1
shl edx, cl
test edx, eax
je 0x428a48
mov byte [ebp - 4], 0x3d
add bl, 0x40
mov byte [ebp - 3], bl
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push 0x103
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 4]
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableA
test eax, eax
jne 0x428a4c
mov al, byte [ebp - 3]
mov byte [ebp - 0x108], al
mov byte [ebp - 0x107], 0x3a
mov byte [ebp - 0x106], 0x5c
mov byte [ebp - 0x105], 0
jmp 0x428a4c
xor eax, eax
jmp 0x428ab6
lea eax, [ebp - 0x108]
push eax
call fcn.00424390
pop ecx
mov ebx, dword [ebp + 0x10]
cmp eax, ebx
jb 0x428a6e
mov dword [0x46cdf8], 0x22
xor eax, eax
jmp 0x428ab6
test edi, edi
jne 0x428a8d
push ebx
call fcn.0042ab7c
pop ecx
mov edi, eax
test edi, edi
jne 0x428a8d
mov dword [0x46cdf8], 8
xor eax, eax
jmp 0x428ab6
push edi
mov esi, edi
lea edi, [ebp - 0x108]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x428ac0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test al, al
jne 0x428ad6
xor esi, esi
jmp 0x428aea
add al, 0x40
mov byte [ebp - 4], al
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], 0
lea esi, [ebp - 4]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
call sub.KERNEL32.dll_GetDiskFreeSpaceA
dec eax
je 0x428b0c
mov dword [ebx + 0xc], 0xffffffff
jmp 0x428b23
mov eax, dword [ebp - 0x14]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 8], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x428e6c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_CreateDirectoryA
dec eax
je 0x428e9a
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
jne 0x428e93
push 5
call fcn.00428df4
pop ecx
pop ebp
ret
call fcn.00428e58
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x428fa4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x428fc0
call fcn.00428e58
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x428fdb
test bl, 1
je 0x428fdb
mov dword [0x46cdf8], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x4290c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x4290e6
mov eax, dword [0x46b688]
mov eax, dword [eax]
and eax, 0xc000
or dword [ebp + 0xc], eax
test byte [ebp + 0xd], 0x80
jne 0x4290f3
or dword [ebp + 0xc], 0x4000
mov eax, dword [ebp + 0xc]
and eax, 0x700
cmp eax, 0x500
jg 0x42911b
je 0x42912b
sub eax, 0x100
je 0x429139
sub eax, 0x100
je 0x429140
sub eax, 0x100
je 0x429132
jmp 0x429147
sub eax, 0x600
je 0x429140
sub eax, 0x100
je 0x42912b
jmp 0x429147
mov edi, 1
jmp 0x42914c
mov edi, 2
jmp 0x42914c
mov edi, 4
jmp 0x42914c
mov edi, 5
jmp 0x42914c
mov edi, 3
test byte [ebp + 0xd], 1
je 0x429173
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x46bc04]
test al, 0x80
je 0x42916c
mov ebx, 0x80
jmp 0x429185
mov ebx, 1
jmp 0x429185
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x429185
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x429197
je 0x4291a0
dec eax
je 0x4291a9
jmp 0x4291b2
mov dword [ebp - 4], 0x80000000
jmp 0x4291c1
mov dword [ebp - 4], 0x40000000
jmp 0x4291c1
mov dword [ebp - 4], 0xc0000000
jmp 0x4291c1
push 1
call fcn.00428df4
pop ecx
mov ebx, eax
jmp 0x4292af
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4291dd
sub eax, 0x10
je 0x4291e4
sub eax, 0x10
je 0x4291ed
sub eax, 0x10
je 0x4291f6
jmp 0x4291f6
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4291fd
mov dword [ebp - 8], 1
jmp 0x4291fd
mov dword [ebp - 8], 2
jmp 0x4291fd
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb eax, eax
neg eax
mov dword [ebp - 0xc], eax
push 0
push ebx
push edi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x429266
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x42925b
mov ebx, 0x50
test byte [ebp + 0xd], 1
jne 0x42925b
add ebx, 0xffffffb2
push ebx
call fcn.00428df4
pop ecx
mov ebx, eax
jmp 0x4292af
mov edi, esi
push edi
call fcn.00429020
pop ecx
test eax, eax
je 0x42927a
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x429286
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00428b58
add esp, 8
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4292af
push 4
call fcn.00428df4
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b3c4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
mov esi, dword [ebp + 8]
cmp byte [0x461e15], 0
je 0x42b427
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x5c
lea eax, [ebp - 0x54]
push eax
call fcn.00424590
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x42b412
push 0x3a
lea eax, [ebp - 0x54]
push eax
call fcn.00424590
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x42b412
lea ebx, [ebp - 0x54]
jmp 0x42b413
inc ebx
call fcn.0042b37c
or eax, 0x10
push eax
push ebx
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x42b46b
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x46ce1c
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea eax, [ebp - 4]
push eax
push esi
call fcn.00424390
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x46ce1f
push ebx
call sub.KERNEL32.dll_WriteFile
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42ffa4
Capabilities:
Hide graphical window
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebx], fcn.00432370
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x1c], eax
cmp dword [0x4629d4], 0
jne 0x42fff2
push 0x460028
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x42fff2
cmp word [0x460028], 0x101
jne 0x42ffed
mov dword [0x4629d4], 1
jmp 0x42fff2
call sub.WSOCK32.dll_WSACleanup
cmp dword [0x4629d8], 0
jne 0x430053
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], sym.serv_u.exe__RWinSocket_DispatchProc_qp6HWND__uiuil
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x462a64
lea eax, [ebp - 0x30]
push eax
call sub.USER32.dll_RegisterClassA
push sym.serv_u.exe__RWinSocket_DispatchProc_qp6HWND__uiuil
push 0x3e8
push 0
push 0
call sub.USER32.dll_SetTimer
mov dword [0x46001c], eax
push 0
push dword [ebx + 0x1c]
push 0
push 0
push 1
push 1
push 0x80000000
push 0x80000000
push 0x400000
push 0x462a76
push 0x462a6d
push 0
call sub.USER32.dll_CreateWindowExA
mov dword [ebx + 0x10], eax
push 0
push dword [ebx + 0x10]
call sub.USER32.dll_ShowWindow
mov dword [ebp - 8], ebx
mov eax, dword [ebx + 0x10]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x460004
call fcn.00432bd4
add esp, 8
xor eax, eax
mov dword [ebx + 0x4c], eax
mov dword [ebx + 0x20], 0xffffffff
mov dword [ebx + 0x24], 0x78
mov dword [ebx + 0x28], 0x5a
mov dword [ebx + 0x2c], 0xffffffff
mov dword [ebx + 0x30], 0x5a
mov dword [ebx + 8], 0xffffffff
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x18], eax
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0xee], eax
mov dword [ebx + 0xc2], eax
mov dword [ebx + 0xa2], eax
mov dword [ebx + 0x6c], eax
xor eax, eax
mov dword [ebx + 0xf2], eax
mov dword [ebx + 0xc6], eax
xor eax, eax
mov dword [ebx + 0x112], eax
mov dword [ebx + 0xde], eax
mov eax, 0x1000
mov dword [ebx + 0x11a], eax
mov dword [ebx + 0xe6], eax
xor eax, eax
mov dword [ebx + 0x9e], eax
mov dword [ebx + 0xaa], eax
xor eax, eax
mov dword [ebx + 0xba], eax
mov dword [ebx + 0xb6], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x58], eax
xor eax, eax
mov dword [ebx + 0x68], eax
mov eax, dword [0x4629dc]
mov dword [ebx + 4], eax
inc dword [0x4629dc]
inc dword [0x4629d8]
xor eax, eax
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x50], eax
mov eax, dword [0x461910]
inc dword [eax]
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430382
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 8]
cmp dword [0x4629d4], 0
jne 0x4303a0
mov eax, 8
jmp 0x430521
cmp dword [ebx + 0xc2], 0
je 0x4303b3
mov eax, 0x10
jmp 0x430521
cmp dword [ebx + 0xee], 0
je 0x4303c6
mov eax, 0x10
jmp 0x430521
cmp dword [ebx + 0x80], 0
je 0x4303d9
mov eax, 0x10
jmp 0x430521
cmp dword [ebx + 0x6c], 0
je 0x4303e9
mov eax, 0x10
jmp 0x430521
cmp dword [ebx + 0x7c], 0
je 0x4303f9
mov eax, 0x10
jmp 0x430521
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x78], 0x37
xor eax, eax
mov dword [ebx + 0x4c], eax
push ebx
call fcn.00431344
pop ecx
cmp dword [ebx + 0xc], 7
jne 0x430425
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [ebx + 8], eax
cmp dword [ebx + 0xc], 6
jne 0x430439
push 0
push 2
push 2
call sub.WSOCK32.dll_socket
mov dword [ebx + 8], eax
cmp dword [ebx + 8], 0xffffffff
jne 0x430453
call sub.WSOCK32.dll_WSAGetLastError
push eax
push ebx
call fcn.00431982
add esp, 8
jmp 0x430521
cmp dword [ebp + 0x10], 0
je 0x430475
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0xffff
push dword [ebx + 8]
call sub.WSOCK32.dll_setsockopt
mov word [ebp - 0x14], 2
push 0
call sub.WSOCK32.dll_htonl
mov dword [ebp - 0x10], eax
mov ax, word [ebp + 0xc]
push eax
call sub.WSOCK32.dll_htons
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 8]
call sub.WSOCK32.dll_bind
inc eax
jne 0x4304b5
call sub.WSOCK32.dll_WSAGetLastError
push eax
push ebx
call fcn.00431982
add esp, 8
jmp 0x430521
cmp dword [ebx + 0xc], 7
jne 0x4304c2
mov esi, 0x28
jmp 0x4304c7
mov esi, 3
push esi
push 0x400
push dword [ebx + 0x10]
push dword [ebx + 8]
call sub.WSOCK32.dll_WSAAsyncSelect
test eax, eax
je 0x4304e3
mov eax, 0x14
jmp 0x430521
cmp dword [ebx + 0xc], 7
jne 0x430518
mov dword [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x34], eax
push 5
push dword [ebx + 8]
call sub.WSOCK32.dll_listen
inc eax
jne 0x43051f
call sub.WSOCK32.dll_WSAGetLastError
push eax
push ebx
call fcn.00431982
add esp, 8
jmp 0x430521
mov dword [ebx + 0x7c], 1
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43061d
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [0x4629d4], 0
jne 0x43063e
mov eax, 8
jmp 0x430874
cmp dword [ebx + 0x80], 0
je 0x430651
mov eax, 0x10
jmp 0x430874
cmp dword [ebx + 0x6c], 0
je 0x430661
mov eax, 0x10
jmp 0x430874
cmp dword [ebx + 0xc2], 0
je 0x430674
mov eax, 0x10
jmp 0x430874
cmp dword [ebx + 0xee], 0
je 0x43068d
cmp dword [ebx + 0xc], 7
jne 0x43068d
mov eax, 0x10
jmp 0x430874
cmp dword [ebx + 0x7c], 0
je 0x4306a3
cmp dword [ebx + 0xc], 7
jne 0x4306a3
mov eax, 0x10
jmp 0x430874
xor eax, eax
mov dword [ebx + 0x4c], eax
mov ax, word [ebp + 0x14]
mov word [ebx + 0x9c], ax
xor eax, eax
mov dword [ebx + 0xb6], eax
mov word [ebx + 0x88], 2
mov ax, word [ebp + 0x10]
push eax
call sub.WSOCK32.dll_htons
mov word [ebx + 0x8a], ax
xor eax, eax
mov dword [ebx + 0x84], eax
push esi
call sub.WSOCK32.dll_inet_addr
mov dword [ebx + 0x8c], eax
cmp eax, 0xffffffff
je 0x4306f8
mov dword [ebx + 0x84], 1
cmp dword [ebx + 0xc], 6
jne 0x4307de
cmp dword [ebx + 0x84], 0
jne 0x430715
mov eax, 0xf
jmp 0x430874
push ebx
call fcn.00431344
pop ecx
push 0
push 2
push 2
call sub.WSOCK32.dll_socket
mov dword [ebx + 8], eax
cmp dword [ebx + 8], 0xffffffff
jne 0x430744
call sub.WSOCK32.dll_WSAGetLastError
push eax
push ebx
call fcn.00431982
add esp, 8
jmp 0x430874
cmp word [ebx + 0x9c], 0
je 0x4307b0
mov word [ebp - 0x14], 2
push 0
call sub.WSOCK32.dll_htonl
mov dword [ebp - 0x10], eax
mov ax, word [ebx + 0x9c]
push eax
call sub.WSOCK32.dll_htons
mov word [ebp - 0x12], ax
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0xffff
push dword [ebx + 8]
call sub.WSOCK32.dll_setsockopt
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 8]
call sub.WSOCK32.dll_bind
inc eax
jne 0x4307b0
call sub.WSOCK32.dll_WSAGetLastError
push eax
push ebx
call fcn.00431982
add esp, 8
jmp 0x430874
push 3
push 0x400
push dword [ebx + 0x10]
push dword [ebx + 8]
call sub.WSOCK32.dll_WSAAsyncSelect
test eax, eax
je 0x4307d0
mov eax, 0x14
jmp 0x430874
mov dword [ebx + 0x7c], 1
xor eax, eax
jmp 0x430874
mov dword [ebx + 0x80], 1
cmp dword [ebx + 0x84], 0
jne 0x43086d
mov dword [ebx + 0xb6], 1
push 0x1f4
call fcn.0042b054
pop ecx
mov dword [ebx + 0x9e], eax
push 0x1f3
push esi
push dword [ebx + 0x9e]
call fcn.004244e0
add esp, 0xc
mov eax, dword [ebx + 0x9e]
mov byte [eax + 0x1f3], 0
push 0x1f4
push dword [ebx + 0x9e]
push ebx
call fcn.0043116c
add esp, 0xc
mov esi, eax
test esi, esi
je 0x43085f
push dword [ebx + 0x9e]
call fcn.0042af04
pop ecx
xor eax, eax
mov dword [ebx + 0x9e], eax
mov eax, esi
jmp 0x430874
mov dword [ebx + 0xba], 1
xor eax, eax
jmp 0x430874
push ebx
call fcn.0043087a
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43087a
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x80], 0
jne 0x430898
mov eax, 0x14
jmp 0x430aa5
mov esi, dword [ebx + 0xb6]
xor eax, eax
mov dword [ebx + 0xb6], eax
test esi, esi
je 0x4308e2
cmp dword [ebx + 0xa6], 0
jne 0x4308ce
push dword [ebx + 0x9e]
call sub.WSOCK32.dll_inet_addr
mov dword [ebx + 0x8c], eax
mov dword [ebx + 0x84], 1
push dword [ebx + 0x9e]
call fcn.0042af04
pop ecx
xor eax, eax
mov dword [ebx + 0x9e], eax
cmp dword [ebx + 0x84], 0
jne 0x43090e
xor eax, eax
mov dword [ebx + 0x80], eax
test esi, esi
je 0x430904
push 0xf
push 4
push ebx
call fcn.00431a87
add esp, 0xc
mov eax, 0xf
jmp 0x430aa5
push ebx
call fcn.00431344
pop ecx
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [ebx + 8], eax
cmp dword [ebx + 8], 0xffffffff
jne 0x430966
xor eax, eax
mov dword [ebx + 0x80], eax
call sub.WSOCK32.dll_WSAGetLastError
push eax
push ebx
call fcn.00431982
add esp, 8
mov dword [ebx + 0x98], eax
test esi, esi
je 0x43095b
push dword [ebx + 0x98]
push 4
push ebx
call fcn.00431a87
add esp, 0xc
mov eax, dword [ebx + 0x98]
jmp 0x430aa5
cmp word [ebx + 0x9c], 0
je 0x4309ff
mov word [ebp - 0x14], 2
push 0
call sub.WSOCK32.dll_htonl
mov dword [ebp - 0x10], eax
mov ax, word [ebx + 0x9c]
push eax
call sub.WSOCK32.dll_htons
mov word [ebp - 0x12], ax
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0xffff
push dword [ebx + 8]
call sub.WSOCK32.dll_setsockopt
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 8]
call sub.WSOCK32.dll_bind
inc eax
jne 0x4309ff
xor eax, eax
mov dword [ebx + 0x80], eax
call sub.WSOCK32.dll_WSAGetLastError
push eax
push ebx
call fcn.00431982
add esp, 8
mov dword [ebx + 0x98], eax
test esi, esi
je 0x4309f4
push dword [ebx + 0x98]
push 4
push ebx
call fcn.00431a87
add esp, 0xc
mov eax, dword [ebx + 0x98]
jmp 0x430aa5
push 0x30
push 0x400
push dword [ebx + 0x10]
push dword [ebx + 8]
call sub.WSOCK32.dll_WSAAsyncSelect
test eax, eax
je 0x430a44
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x98], 0x14
test esi, esi
je 0x430a3c
push dword [ebx + 0x98]
push 4
push ebx
call fcn.00431a87
add esp, 0xc
mov eax, dword [ebx + 0x98]
jmp 0x430aa5
xor eax, eax
mov dword [ebx + 0x38], eax
push 0x10
lea eax, [ebx + 0x88]
push eax
push dword [ebx + 8]
call sub.WSOCK32.dll_connect
inc eax
jne 0x430aa3
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x430aa3
xor eax, eax
mov dword [ebx + 0x80], eax
call sub.WSOCK32.dll_WSAGetLastError
push eax
push ebx
call fcn.00431982
add esp, 8
mov dword [ebx + 0x98], eax
test esi, esi
je 0x430a9b
push dword [ebx + 0x98]
push 4
push ebx
call fcn.00431a87
add esp, 0xc
mov eax, dword [ebx + 0x98]
jmp 0x430aa5
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43101e
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, dword [ebp + 8]
cmp dword [0x4629d4], 0
jne 0x43103a
mov eax, 8
jmp 0x431167
cmp dword [ebx + 0x7c], 0
jne 0x43104a
mov eax, 0x11
jmp 0x431167
xor eax, eax
mov dword [ebx + 0x4c], eax
cmp dword [ebx + 0x60], 0
jne 0x431069
mov dword [ebx + 0x60], 1
push 0
call fcn.0042d398
pop ecx
mov dword [ebx + 0x64], eax
jmp 0x431094
push 0
call fcn.0042d398
pop ecx
sub eax, dword [ebx + 0x64]
cmp eax, 0xf
jle 0x431094
push ebx
call fcn.00431344
pop ecx
push 0x18
push 6
push ebx
call fcn.00431a87
add esp, 0xc
xor eax, eax
jmp 0x431167
push 0
push 0
push dword [ebx + 0x10]
push dword [ebx + 8]
call sub.WSOCK32.dll_WSAAsyncSelect
push 2
push dword [ebx + 8]
call sub.WSOCK32.dll_shutdown
mov ax, word [ebx + 0x68]
mov word [ebp - 4], ax
mov word [ebp - 2], 0x1e
push 4
lea eax, [ebp - 4]
push eax
push 0x80
push 0xffff
push dword [ebx + 8]
call sub.WSOCK32.dll_setsockopt
push dword [ebx + 8]
call sub.WSOCK32.dll_closesocket
mov esi, eax
inc esi
jne 0x43114c
call sub.WSOCK32.dll_WSAGetLastError
mov esi, eax
cmp esi, 0x2733
jne 0x431107
push 0
push 0
push 0x403
push dword [ebx + 0x10]
call sub.USER32.dll_PostMessageA
mov eax, 0x10
jmp 0x431167
cmp dword [ebx + 0x68], 0
jne 0x43112c
mov dword [ebx + 0x68], 1
push 0
push 0
push 0x403
push dword [ebx + 0x10]
call sub.USER32.dll_PostMessageA
mov eax, 0x10
jmp 0x431167
push ebx
call fcn.00431344
pop ecx
push 0x17
push 6
push ebx
call fcn.00431a87
add esp, 0xc
push esi
push ebx
call fcn.00431982
add esp, 8
jmp 0x431167
push 0x16
push 6
push ebx
call fcn.00431a87
add esp, 0xc
xor eax, eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 8], 0xffffffff
xor eax, eax
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x431344
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 8], 0xffffffff
je 0x431397
push 0
push 0
push dword [ebx + 0x10]
push dword [ebx + 8]
call sub.WSOCK32.dll_WSAAsyncSelect
push 2
push dword [ebx + 8]
call sub.WSOCK32.dll_shutdown
mov word [ebp - 4], 1
mov word [ebp - 2], 0
push 4
lea eax, [ebp - 4]
push eax
push 0x80
push 0xffff
push dword [ebx + 8]
call sub.WSOCK32.dll_setsockopt
push dword [ebx + 8]
call sub.WSOCK32.dll_closesocket
mov dword [ebx + 8], 0xffffffff
xor eax, eax
mov dword [ebx + 0x7c], eax
xor eax, eax
mov dword [ebx + 0xde], eax
xor eax, eax
mov dword [ebx + 0x112], eax
pop ebx
pop ecx
pop ebp
ret

Function at 0x4313ff
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 8], 0xffffffff
jne 0x431413
xor eax, eax
jmp 0x43143b
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 8]
call sub.WSOCK32.dll_getsockname
inc eax
jne 0x431431
xor eax, eax
jmp 0x43143b
mov ax, word [ebp - 0x12]
push eax
call sub.WSOCK32.dll_ntohs
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43149c
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Get hostname
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x4601b6
mov byte [edi], 0
cmp dword [esi + 8], 0xffffffff
je 0x431503
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 8]
call sub.WSOCK32.dll_getsockname
inc eax
je 0x431503
push dword [ebp - 0x20]
call sub.WSOCK32.dll_inet_ntoa
push eax
push edi
call fcn.00424360
add esp, 8
push 0x462a96
push edi
call fcn.00424334
add esp, 8
test eax, eax
je 0x431503
cmp byte [edi], 0
je 0x431503
mov eax, edi
jmp 0x431647
push 0
push 2
push 2
call sub.WSOCK32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4315e5
push 0
push 0x400
push dword [esi + 0x10]
push ebx
call sub.WSOCK32.dll_WSAAsyncSelect
mov word [ebp - 0x24], 2
push 0
call sub.WSOCK32.dll_htons
mov word [ebp - 0x22], ax
push 0
call sub.WSOCK32.dll_htonl
mov dword [ebp - 0x20], eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.WSOCK32.dll_bind
inc eax
je 0x4315df
mov word [ebp - 0x24], 2
push 0x929
call sub.WSOCK32.dll_htons
mov word [ebp - 0x22], ax
push 0x462a9e
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 0x20], eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.WSOCK32.dll_connect
push 0
push 9
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.WSOCK32.dll_recv
mov dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 8]
call sub.WSOCK32.dll_getsockname
inc eax
je 0x4315df
push dword [ebp - 0x20]
call sub.WSOCK32.dll_inet_ntoa
push eax
push edi
call fcn.00424360
add esp, 8
push 0x462aae
push edi
call fcn.00424334
add esp, 8
test eax, eax
je 0x4315df
cmp byte [edi], 0
je 0x4315df
push ebx
call sub.WSOCK32.dll_closesocket
mov eax, edi
jmp 0x431647
push ebx
call sub.WSOCK32.dll_closesocket
push 0x63
lea eax, [ebp - 0x88]
push eax
call sub.WSOCK32.dll_gethostname
inc eax
jne 0x4315fd
mov eax, 0x462ab6
jmp 0x431647
lea eax, [ebp - 0x88]
push eax
call sub.WSOCK32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
jne 0x431616
mov eax, 0x462ab8
jmp 0x431647
push 0x10
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.WSOCK32.dll_inet_ntoa
push eax
push edi
call fcn.004244e0
add esp, 0xc
mov byte [edi + 0x10], 0
push edi
call fcn.00424390
pop ecx
cmp eax, 0xf
jbe 0x431645
mov eax, 0x462aba
jmp 0x431647
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret