joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b590
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
push eax
mov ecx, dword [esp + 0xc]
push ecx
push 2
mov dword [esi], 0x44e324
mov dword [esi + 0x40], 0
call dword [sym.imp.WS2_32.dll_socket]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x3c], edx
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x44], eax
lea eax, [esi + 0x18]
xor edx, edx
mov dword [esi + 0x28], 0
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
lea edx, [esi + 8]
mov eax, esi
pop esi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
ret 0x14

Function at 0x40b9e0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
mov ecx, dword [esp + 0x10]
push eax
push edi
push ecx
mov ecx, esi
call fcn.0040b620
mov eax, 0x14000
lea edx, [esp + 0x10]
push 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov eax, dword [esi + 4]
push edx
push 0x1002
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 0xffff
push eax
mov dword [esi], 0x44e340
call edi
mov edx, dword [esi + 4]
lea ecx, [esp + 0xc]
push 4
push ecx
push 0x1001
push 0xffff
push edx
call edi
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
lea eax, [esi + 8]
pop edi
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, esi
pop esi
ret 0x18

Function at 0x40ba90
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
push eax
push ecx
push edi
push 6
push 1
mov ecx, esi
call fcn.0040b590
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, 0x14000
lea edx, [esp + 0x1c]
push 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 4]
push edx
push 0x1002
xor ebp, ebp
push 0xffff
push eax
mov dword [esi], 0x44e340
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], ebp
mov dword [esi + 0x30], ebp
call ebx
mov edx, dword [esi + 4]
lea ecx, [esp + 0x18]
push 4
push ecx
push 0x1001
push 0xffff
push edx
call ebx
mov word [esi + 8], 2
mov eax, dword [edi + 8]
mov dword [esi + 0xc], eax
mov cx, word [edi + 0x34]
mov word [esi + 0xa], cx
mov dword [esi + 0x48], ebp
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x40bec0
Capabilities:
Access peb ldr_data
Check for time delay via gettickcount
Set socket configuration

Disassembly:
push 0xffffffffffffffff
push 0x44a983
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x20]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x28]
push edi
push eax
push ecx
push ebp
push 0x11
push 2
mov ecx, esi
mov dword [esp + 0x24], esi
call fcn.0040b590
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dl, byte [esp + 0x2c]
lea edi, [esi + 0x58]
mov dword [esi + 0x50], eax
mov al, byte [esp + 0x2c]
lea ecx, [edi + 0x1c]
mov dword [esp + 0x14], edi
mov byte [ecx], dl
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.0040e3b0
mov dl, byte [esp + 0x2c]
mov al, byte [esp + 0x2c]
lea ecx, [edi + 0x2c]
mov byte [esp + 0x20], 1
mov byte [ecx], dl
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.0040e3b0
mov dword [edi + 0xc], ebx
mov dword [edi + 8], ebx
mov dword [edi + 4], ebx
mov dword [edi], ebx
mov dword [edi + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x14], eax
mov dword [edi + 0x10], eax
mov eax, 0x5000
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [esi], 0x44e35c
mov ecx, dword [ebp + 8]
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x30]
push 4
mov dword [esi + 0xc], ecx
mov ecx, dword [esi + 4]
push eax
mov word [esi + 8], 2
mov dx, word [ebp + 0x34]
push 0x1002
push 0xffff
push ecx
mov word [esi + 0xa], dx
call edi
mov eax, dword [esi + 4]
lea edx, [esp + 0x28]
push 4
push edx
push 0x1001
push 0xffff
push eax
call edi
cmp dword [esp + 0x2c], ebx
jne 0x40bfd4
push 0x3e8
mov ecx, esi
call fcn.0040b6e0
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc

Function at 0x40cdc0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
push edi
call fcn.0040cd30
mov eax, dword [0x45f554]
mov cx, word [0x45f318]
lea edx, [esp + 8]
mov dword [esp + 0xc], eax
mov ax, word [edi]
push 0x10
push edx
push 0
push eax
mov word [esp + 0x18], 2
mov word [esp + 0x1a], cx
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [esi + 4]
and eax, 0xffff
push eax
push edi
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 4
Function at 0x40d000
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x18
push ebp
mov ebp, ecx
mov dword [esp + 8], ebp
mov eax, dword [ebp + 0x3c]
test eax, eax
jne 0x40d01b
call fcn.0040b840
pop ebp
add esp, 0x18
ret
push ebx
push esi
push edi
push 0xd
call fcn.0043a0eb
add esp, 4
mov esi, eax
push 0xd
mov dword [esi + 4], 0
mov byte [esi + 0xc], 1
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [esi + 4]
add ebp, 0x74
mov dword [esi], eax
mov edx, dword [0x45ad18]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp + 4]
mov eax, 0xd
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
mov edi, dword [ecx + 4]
cmp edi, edx
mov ebx, ecx
mov al, 1
je 0x40d085
mov eax, dword [esp + 0x1c]
mov ebx, edi
cmp eax, dword [edi + 0xc]
setb al
test al, al
je 0x40d07e
mov edi, dword [edi]
jmp 0x40d081
mov edi, dword [edi + 8]
cmp edi, edx
jne 0x40d06a
mov dl, byte [ebp + 8]
test dl, dl
je 0x40d099
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push ebx
push edi
jmp 0x40d0d6
test al, al
mov dword [esp + 0x10], ebx
je 0x40d0bc
cmp ebx, dword [ecx]
jne 0x40d0b3
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ebx
push edi
push ecx
jmp 0x40d0d7
lea ecx, [esp + 0x10]
call fcn.0040e840
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov eax, dword [edx + 0xc]
cmp eax, ecx
jae 0x40d0de
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push ebx
push edi
push edx
mov ecx, ebp
call fcn.0040e450
mov edi, dword [esp + 0x14]
push 0x10
mov ecx, dword [edi + 4]
lea eax, [edi + 8]
push eax
push 0
push 0xd
push esi
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
mov eax, dword [edi + 0x5c]
inc eax
mov dword [edi + 0x5c], eax
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x18
ret
Function at 0x410be0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x204
mov eax, dword [esp + 0x208]
push esi
push 0x200
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.0043b1e0
lea edx, [esp + 0x14]
push 0x3a
push edx
mov byte [esp + 0x21b], 0
call fcn.0043b5e0
add esp, 0x14
test eax, eax
je 0x410c44
mov byte [eax], 0
lea ecx, [esp + 4]
push 0xa
inc eax
push ecx
push eax
mov dword [esp + 0x10], 0
call fcn.0043b3a5
mov esi, eax
mov eax, dword [esp + 0x10]
add esp, 0xc
test eax, eax
je 0x410c51
cmp byte [eax], 0
je 0x410c51
mov esi, dword [esp + 0x218]
and esi, 0xffff
cmp esi, 0x400
jge 0x410c63
xor al, al
pop esi
add esp, 0x204
ret
cmp esi, 0xffff
jl 0x410c75
xor al, al
pop esi
add esp, 0x204
ret
movsx edx, byte [esp + 8]
push edx
call fcn.0043b355
add esp, 4
test eax, eax
je 0x410c97
lea eax, [esp + 8]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
jmp 0x410d44
lea edx, [esp + 8]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x410d3d
push edi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.error_was
push 0x45fb78
call fcn.004126b0
add esp, 8
mov ecx, eax
call fcn.00411f80
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00412400
mov eax, dword [esi]
xor edi, edi
mov ecx, dword [eax + 4]
lea eax, [ecx + esi]
mov cl, byte [ecx + esi + 4]
test cl, 6
jne 0x410cfd
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x410cfd
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
test edi, edi
je 0x410d1e
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x28]
or eax, edi
test edx, edx
jne 0x410d16
or al, 4
push 0
push eax
call fcn.00448183
push 0x7f000001
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword [ecx], eax
xor al, al
add esp, 0x204
ret
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [esp + 0x210]
mov edx, dword [esp + 0x214]
mov dword [ecx], eax
mov word [edx], si
mov al, 1
pop esi
add esp, 0x204
ret
Function at 0x4158a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov ecx, dword [ecx + 0x5f]
test ecx, ecx
je 0x4158ac
jmp fcn.004099e0
xor eax, eax
ret

Function at 0x415d40
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x44aec0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x10]
lea eax, [edi + 0xc7]
push eax
call fcn.00401000
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.00401020
mov eax, dword [edi + 0x67]
mov edx, dword [edi + 0x6b]
mov ebx, dword [esp + 0x28]
cmp eax, edx
je 0x415da5
mov esi, dword [eax]
mov ebp, dword [esi + 0x38]
mov ecx, dword [esi + 0x3c]
cmp ebp, edi
jne 0x415e0e
cmp dword [ecx + 8], ebx
je 0x415e15
add eax, 4
cmp eax, edx
jne 0x415d8d
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.00401010
lea ecx, [edi + 0xaf]
push ecx
lea ecx, [esp + 0x2c]
call fcn.00401000
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 1
call fcn.00401020
mov esi, dword [edi + 0xa3]
mov eax, dword [esi]
cmp eax, esi
je 0x415e83
mov edx, dword [0x45ad40]
mov ecx, dword [eax + 0xc]
cmp dword [ecx + 8], ebx
je 0x415e49
mov ecx, dword [eax + 8]
cmp ecx, edx
je 0x415e2a
mov eax, ecx
mov ecx, dword [eax]
cmp ecx, edx
je 0x415e43
mov eax, ecx
mov ecx, dword [eax]
cmp ecx, edx
jne 0x415e04
jmp 0x415e43
push 0
call fcn.0043b95b
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.00401010
mov eax, esi
jmp 0x415e96
mov ecx, dword [eax + 4]
cmp eax, dword [ecx + 8]
jne 0x415e3c
mov eax, ecx
mov ecx, dword [ecx + 4]
cmp eax, dword [ecx + 8]
je 0x415e32
cmp dword [eax + 8], ecx
je 0x415e43
mov eax, ecx
cmp eax, esi
jne 0x415ded
jmp 0x415e83
mov ecx, dword [eax + 8]
mov esi, eax
cmp ecx, edx
je 0x415e60
mov eax, dword [ecx]
cmp eax, edx
je 0x415e72
mov eax, dword [eax]
cmp eax, edx
jne 0x415e58
jmp 0x415e72
mov ecx, dword [eax + 4]
cmp eax, dword [ecx + 8]
jne 0x415e72
mov eax, ecx
mov ecx, dword [ecx + 4]
cmp eax, dword [ecx + 8]
je 0x415e68
lea edx, [esp + 0x14]
push esi
push edx
lea ecx, [edi + 0x9f]
call fcn.0041bf00
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.00401010
xor eax, eax
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x415eb0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x44aee0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
lea eax, [esi + 0xc7]
mov dword [esp + 0x14], esi
push eax
call fcn.00401000
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0
call fcn.00401020
mov eax, dword [esi + 0x67]
mov ebp, dword [esi + 0x6b]
cmp eax, ebp
je 0x415f3a
mov ebx, dword [eax]
mov ecx, dword [ebx + 0x38]
mov edx, dword [ebx + 0x3c]
cmp ecx, esi
jne 0x415fc2
mov esi, dword [esp + 0x2c]
mov ecx, 0xc
lea edi, [esi + 8]
lea esi, [edx + 0x14]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x415f27
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
je 0x415fc9
mov esi, dword [esp + 0x14]
add eax, 4
cmp eax, ebp
jne 0x415efd
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00401010
lea ecx, [esi + 0xaf]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00401000
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 1
call fcn.00401020
mov esi, dword [esi + 0xa3]
mov dword [esp + 0x10], esi
mov eax, dword [esi]
cmp eax, esi
je 0x41603d
mov edx, dword [esp + 0x2c]
mov ebx, dword [0x45ad40]
lea ebp, [edx + 8]
mov edx, dword [eax + 0xc]
mov ecx, 0xc
mov edi, ebp
lea esi, [edx + 0x14]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x415fa5
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
je 0x415fff
mov ecx, dword [eax + 8]
cmp ecx, ebx
je 0x415fde
mov eax, ecx
mov ecx, dword [eax]
cmp ecx, ebx
je 0x415ff7
mov eax, ecx
mov ecx, dword [eax]
cmp ecx, ebx
jne 0x415fb8
jmp 0x415ff7
push 0
call fcn.0043b95b
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00401010
mov eax, ebx
jmp 0x416050
mov ecx, dword [eax + 4]
cmp eax, dword [ecx + 8]
jne 0x415ff0
mov eax, ecx
mov ecx, dword [ecx + 4]
cmp eax, dword [ecx + 8]
je 0x415fe6
cmp dword [eax + 8], ecx
je 0x415ff7
mov eax, ecx
cmp eax, dword [esp + 0x10]
jne 0x415f8d
jmp 0x41603d
mov ecx, dword [eax + 8]
mov edx, eax
cmp ecx, ebx
je 0x416016
mov eax, dword [ecx]
cmp eax, ebx
je 0x416028
mov eax, dword [eax]
cmp eax, ebx
jne 0x41600e
jmp 0x416028
mov ecx, dword [eax + 4]
cmp eax, dword [ecx + 8]
jne 0x416028
mov eax, ecx
mov ecx, dword [ecx + 4]
cmp eax, dword [ecx + 8]
je 0x41601e
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x2c]
push edx
push eax
add ecx, 0x9f
call fcn.0041bf00
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0xffffffff
call fcn.00401010
xor eax, eax
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x4225f0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
lea edx, [esp]
push esi
push edx
mov ecx, dword [eax + 4]
add eax, 0xb
mov dword [esp + 0x10], ecx
push eax
mov ecx, 0x45f438
mov dword [esp + 0xc], 0
call fcn.0041f0a0
mov esi, dword [sym.imp.WS2_32.dll_htonl]
push 0xc
call esi
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
push eax
call esi
mov edx, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0xc]
push 0xc
push ecx
push edx
mov dword [esp + 0x20], eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
setg al
pop esi
add esp, 0x10
ret
Function at 0x422a60
Capabilities:
Send data
Send data on socket

Disassembly:
push 0xffffffffffffffff
push 0x44bab8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
push 0xc
mov eax, dword [edi + 4]
mov dword [esp + 0x20], eax
call dword [sym.imp.WS2_32.dll_htonl]
push 0x45f300
lea ecx, [esp + 0x38]
mov dword [esp + 0x1c], eax
call fcn.00401000
xor esi, esi
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], esi
call fcn.00401030
test eax, eax
jne 0x422abe
mov byte [esp + 0x20], 1
jmp 0x422b7d
mov cl, byte [esp + 0x34]
sub esp, 0x10
mov ebp, esp
add edi, 0xb
xor eax, eax
mov dword [esp + 0x20], edi
mov byte [ebp], cl
or ecx, 0xffffffff
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
mov dword [esp + 0x24], esp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 0xfffffffd
jbe 0x422af4
call fcn.00446f90
mov ecx, dword [ebp + 4]
cmp ecx, esi
je 0x422b19
mov al, byte [ecx - 1]
test al, al
je 0x422b19
cmp al, 0xff
je 0x422b19
cmp ebx, esi
jne 0x422b3d
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebp
call fcn.00401ff0
jmp 0x422b6a
cmp ebx, esi
jne 0x422b28
push 1
mov ecx, ebp
call fcn.00401ff0
jmp 0x422b6a
mov eax, dword [ebp + 0xc]
cmp eax, 0x1f
ja 0x422b34
cmp eax, ebx
jae 0x422b45
push 1
mov ecx, ebp
call fcn.00401ff0
push ebx
mov ecx, ebp
call fcn.004022a0
mov edi, dword [ebp + 4]
mov esi, dword [esp + 0x20]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], ebx
mov ebp, dword [ebp + 4]
add ebp, ebx
xor esi, esi
mov byte [ebp], 0
mov ecx, 0x45f438
call fcn.0041e1e0
mov byte [esp + 0x20], al
call fcn.00434130
mov ecx, dword [esp + 0x38]
push esi
lea eax, [esp + 0x1c]
push 0xc
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [esp + 0x34]
jg 0x422bba
call fcn.00401010
xor al, al
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
call fcn.00401010
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret
Function at 0x422f90
Capabilities:
Create thread
Send data
Send data on socket

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
push 0xc
mov eax, dword [esi + 4]
mov dword [esp + 0xc], eax
call dword [sym.imp.WS2_32.dll_htonl]
add esi, 0xb
mov dword [esp + 4], eax
push esi
push 0
push 0x433820
mov byte [esp + 0x18], 0
call fcn.0043a873
mov ecx, dword [0x45f2ec]
add esp, 0xc
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x18]
push 0
lea edx, [esp + 8]
push 0xc
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
setg al
pop esi
add esp, 0xc
ret

Function at 0x422ff0
Capabilities:
Send data
Send data on socket

Disassembly:
push 0xffffffffffffffff
push 0x44bb28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, dword [esp + 0x20]
push 0xc
mov eax, dword [esi + 4]
mov dword [esp + 0xc], eax
call dword [sym.imp.WS2_32.dll_htonl]
push 0x45f300
lea ecx, [esp + 0x24]
mov dword [esp + 8], eax
call fcn.00401000
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0
call fcn.00401030
test eax, eax
jne 0x42304a
mov byte [esp + 0xc], 1
jmp 0x423067
mov cl, byte [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x45f438
call fcn.0041ecf0
mov byte [esp + 0xc], al
mov ecx, dword [esp + 0x24]
push 0
lea eax, [esp + 8]
push 0xc
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
pop esi
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x1c]
jg 0x4230a2
call fcn.00401010
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
call fcn.00401010
mov ecx, dword [esp + 0xc]
mov al, 1
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x4230c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push esi
push edi
push 0xfa000
call fcn.0043a0eb
mov edi, dword [sym.imp.WS2_32.dll_htonl]
add esp, 4
mov esi, eax
push 0x40a
mov dword [esp + 0xc], esi
call edi
mov ecx, dword [esp + 0x10]
mov dword [esi + 4], eax
mov edx, dword [esp + 8]
lea eax, [esp + 8]
push eax
add edx, 8
push ecx
mov ecx, 0x45f438
mov dword [esp + 0x10], edx
call fcn.0041f1c0
mov edx, dword [esp + 8]
sub edx, esi
push edx
call edi
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov eax, dword [esp + 8]
push 0
sub eax, esi
push eax
push esi
push ecx
call dword [sym.imp.WS2_32.dll_send]
push esi
mov edi, eax
call fcn.00439308
mov edx, dword [esp + 0xc]
add esp, 4
sub edx, esi
cmp edi, edx
pop edi
sete al
pop esi
pop ecx
ret
Function at 0x423140
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push esi
push edi
push 0x19000
call fcn.0043a0eb
mov edi, dword [sym.imp.WS2_32.dll_htonl]
add esp, 4
mov esi, eax
push 0x40a
mov dword [esp + 0xc], esi
call edi
mov ecx, dword [esp + 0x10]
mov dword [esi + 4], eax
mov edx, dword [esp + 8]
lea eax, [esp + 8]
push eax
add edx, 8
push ecx
mov ecx, 0x45f438
mov dword [esp + 0x10], edx
call fcn.0041f990
mov edx, dword [esp + 8]
sub edx, esi
push edx
call edi
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov eax, dword [esp + 8]
push 0
sub eax, esi
push eax
push esi
push ecx
call dword [sym.imp.WS2_32.dll_send]
push esi
mov edi, eax
call fcn.00439308
mov edx, dword [esp + 0xc]
add esp, 4
sub edx, esi
cmp edi, edx
pop edi
sete al
pop esi
pop ecx
ret

Function at 0x4231c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push esi
push edi
push 0x19000
call fcn.0043a0eb
mov edi, dword [sym.imp.WS2_32.dll_htonl]
add esp, 4
mov esi, eax
push 0x40a
mov dword [esp + 0xc], esi
call edi
mov ecx, dword [esp + 0x10]
mov dword [esi + 4], eax
mov edx, dword [esp + 8]
lea eax, [esp + 8]
push eax
add edx, 8
push ecx
mov ecx, 0x45f438
mov dword [esp + 0x10], edx
call fcn.0041ff90
mov edx, dword [esp + 8]
sub edx, esi
push edx
call edi
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov eax, dword [esp + 8]
push 0
sub eax, esi
push eax
push esi
push ecx
call dword [sym.imp.WS2_32.dll_send]
push esi
mov edi, eax
call fcn.00439308
mov edx, dword [esp + 0xc]
add esp, 4
sub edx, esi
cmp edi, edx
pop edi
sete al
pop esi
pop ecx
ret

Function at 0x423240
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push esi
push edi
push 0x2800
call fcn.0043a0eb
mov esi, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], esi
add esp, 4
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov edx, dword [esp + 8]
add edx, 8
mov ecx, 0x45f438
mov dword [esp + 8], edx
lea edx, [esp + 8]
push edx
push eax
call fcn.00420690
mov eax, dword [esp + 8]
sub eax, esi
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov edx, dword [esp + 0x14]
mov dword [esi], eax
mov ecx, dword [esp + 8]
push 0
sub ecx, esi
push ecx
push esi
push edx
call dword [sym.imp.WS2_32.dll_send]
push esi
mov edi, eax
call fcn.00439308
mov eax, dword [esp + 0xc]
add esp, 4
sub eax, esi
cmp edi, eax
pop edi
sete al
pop esi
pop ecx
ret
Function at 0x4232c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebx
push esi
push edi
push 0x2800
call fcn.0043a0eb
mov esi, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], esi
add esp, 4
mov ecx, dword [eax + 4]
lea edx, [esp + 0xc]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0xc]
add ecx, 0xc
push edx
mov dword [esp + 0x10], ecx
push eax
mov ecx, 0x45f438
call fcn.00420790
mov ebx, eax
mov eax, dword [esp + 0xc]
sub eax, esi
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov edx, dword [esp + 0x18]
mov dword [esi], eax
mov byte [esi + 8], bl
mov ecx, dword [esp + 0xc]
sub ecx, esi
push 0
push ecx
push esi
push edx
call dword [sym.imp.WS2_32.dll_send]
push esi
mov edi, eax
call fcn.00439308
mov eax, dword [esp + 0x10]
add esp, 4
sub eax, esi
cmp edi, eax
pop edi
pop esi
pop ebx
sete al
pop ecx
ret

Function at 0x423340
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebx
push esi
push edi
push 0x200400
call fcn.0043a0eb
mov esi, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], esi
add esp, 4
mov ecx, dword [eax + 4]
lea edx, [esp + 0xc]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0xc]
add ecx, 0xc
push edx
mov dword [esp + 0x10], ecx
push eax
mov ecx, 0x45f438
call fcn.00420950
mov ebx, eax
mov eax, dword [esp + 0xc]
sub eax, esi
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov edx, dword [esp + 0x18]
mov dword [esi], eax
mov byte [esi + 8], bl
mov ecx, dword [esp + 0xc]
sub ecx, esi
push 0
push ecx
push esi
push edx
call dword [sym.imp.WS2_32.dll_send]
push esi
mov edi, eax
call fcn.00439308
mov eax, dword [esp + 0x10]
add esp, 4
sub eax, esi
cmp edi, eax
pop edi
pop esi
pop ebx
sete al
pop ecx
ret

Function at 0x4233c0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
push 0xc
mov eax, dword [esi + 4]
mov dword [esp + 0xc], eax
call dword [sym.imp.WS2_32.dll_htonl]
push esi
mov ecx, 0x45f438
mov dword [esp + 8], eax
call fcn.00420a80
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 8]
push 0xc
push ecx
push edx
mov byte [esp + 0x1c], al
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
setg al
pop esi
add esp, 0xc
ret