joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430500
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
mov esi, ecx
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x430550
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
mov ecx, eax
call fcn.00408040
push eax
call esi
push eax
push str.ERROR:_could_not_set_listen_socket_to_non_blocking_mode
push str._s:__d___s_
push 0
call fcn.0041dc40
add esp, 0x14
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 5
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x430577
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
mov ecx, eax
call fcn.00408040
push eax
call esi
push eax
push str.ERROR:_could_not_listen_on_listen_socket
jmp 0x43053a
mov dword [0x44f4f8], esi
mov dword [0x44f4e8], 0x430400
push 0
push 0x437bf0
mov edx, 0x28
mov ecx, esi
call fcn.00438400
test eax, eax
je 0x4305b8
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
mov ecx, eax
call fcn.00408040
push eax
call esi
push eax
push str.ERROR:_could_not_add_listen_socket_to_event_loop
jmp 0x43053a
cmp dword [0x44f480], 0
je 0x4305d1
push esi
push str._3d:_Listening_for_incoming_Unix_Domain_Socket_client_requests
push 1
call fcn.0041dc40
add esp, 0xc
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4305e0
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [0x44f480], 0
push esi
je 0x4305ff
push str.udsserver_init
push 3
call fcn.0041dc40
add esp, 8
push 0x44adf4
push str._var_run_mDNSResponder.pid
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x430637
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__getpid]
push eax
push 0x44adf8
push esi
call fcn.00428a70
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [0x44f03c], eax
cmp eax, 0xffffffff
jne 0x43069d
call esi
mov ecx, eax
call fcn.00408040
push eax
call esi
push eax
push str.ERROR:_socket_AF_DNSSD__SOCK_STREAM__0___failed
push str._s:__d___s_
push 0
call fcn.0041dc40
add esp, 0x14
call esi
mov ecx, eax
call fcn.00408040
push eax
call esi
push eax
push str.ERROR:_udsserver_init
push str._s:__d___s_
push 0
call fcn.0041dc40
add esp, 0x14
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
mov eax, 2
movups xmmword [ebp - 0x14], xmm0
push 0
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push str.127.0.0.1
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [0x44f03c]
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x4306f4
call esi
mov ecx, eax
call fcn.00408040
push eax
call esi
push eax
push str.ERROR:_bind_listenfd___struct_sockaddr___laddr__sizeof_laddr____failed
jmp 0x430665
mov ecx, dword [0x44f03c]
call fcn.00430500
test eax, eax
je 0x430674
movups xmm0, xmmword [0x43d988]
mov eax, dword [0x43d998]
mov ecx, 0x47006c
mov edx, dword [str.lb._dns_sd._udp.]
movups xmmword [0x470054], xmm0
mov dword [0x470050], 0xfffffffe
xorps xmm0, xmm0
mov dword [0x470064], eax
mov dword [0x47016c], 0x1000c
movups xmmword [0x470170], xmm0
mov dword [0x470180], 0
mov dword [0x470188], 0
mov dword [0x470184], 0
mov dword [0x470190], 0
mov dword [0x470194], 0x42cef0
mov dword [0x470198], 0
mov byte [0x47006c], 0
call fcn.00401c90
test eax, eax
je 0x4307b6
mov edx, 0x43c6bc
mov ecx, 0x47006c
call fcn.00401e50
test eax, eax
je 0x4307b6
mov edx, 0x46ff38
mov ecx, 0x46dca0
call fcn.004199a0
push 3
mov edx, 0x43c6bc
mov ecx, 0x46dca0
call fcn.0042c3e0
push 0
mov edx, 0x43c6bc
mov ecx, 0x46dca0
call fcn.0042c3e0
mov edx, 0x43c6bc
xor ecx, ecx
call fcn.0042c580
mov ecx, 0x46dca0
call fcn.0042ca20
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x24]
push eax
push dword [0x44f03c]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
js 0x430674
mov eax, dword [ebp - 0x22]
test ax, ax
je 0x430674
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, eax
call fcn.00435be0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x430d70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
cmp dword [ebx + 0x4c], 0
mov edi, dword [ebx + 0x58]
je 0x430d8f
pop edi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push dword [edi + 0xc]
mov esi, dword [sym.imp.WS2_32.dll_htonl]
call esi
push dword [edi + 0x10]
mov dword [edi + 0xc], eax
call esi
push dword [edi + 0x14]
mov dword [edi + 0x10], eax
call esi
push dword [edi + 0x18]
mov dword [edi + 0x14], eax
call esi
push dword [edi + 0x24]
mov dword [edi + 0x18], eax
call esi
mov dword [edi + 0x24], eax
mov eax, dword [edi + 4]
sub eax, dword [edi + 8]
push 0
push eax
lea eax, [edi + 0xc]
add eax, dword [edi + 8]
push eax
push dword [ebx + 8]
call dword [sym.imp.WS2_32.dll_send]
push dword [edi + 0xc]
mov ebx, eax
call esi
push dword [edi + 0x10]
mov dword [edi + 0xc], eax
call esi
push dword [edi + 0x14]
mov dword [edi + 0x10], eax
call esi
push dword [edi + 0x18]
mov dword [edi + 0x14], eax
call esi
push dword [edi + 0x24]
mov dword [edi + 0x18], eax
call esi
mov dword [edi + 0x24], eax
test ebx, ebx
jns 0x430e55
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
cmp eax, 0x2714
je 0x430e53
call ebx
cmp eax, 0x2733
je 0x430e53
mov esi, dword [edi + 4]
call ebx
mov ecx, eax
call fcn.00408040
push eax
call ebx
push eax
mov eax, dword [ebp - 4]
push dword [eax + 8]
push esi
sub esi, dword [edi + 8]
push esi
push str.send_msg_ERROR:_failed_to_write__d_of__d_bytes_to_fd__d_errno__d___s_
push 0
call fcn.0041dc40
add esp, 0x1c
mov eax, 3
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
add dword [edi + 8], ebx
xor eax, eax
mov ecx, dword [edi + 8]
cmp ecx, dword [edi + 4]
pop esi
sete al
pop edi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431850
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 1
push ebx
push esi
push edi
mov edi, ecx
test edx, edx
jne 0x431979
push 0x1c
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x43197b
xorps xmm0, xmm0
mov eax, 2
movups xmmword [esi], xmm0
push 0
movq qword [esi + 0x10], xmm0
mov dword [esi + 0x18], 0
mov dword [esi + 4], 0xffffffff
mov dword [esi], 0
mov dword [esi + 0x18], edi
movups xmmword [ebp - 0x1c], xmm0
mov word [ebp - 0x1c], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov ebx, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], eax
push 1
mov ax, word [ebx]
push 2
mov word [ebp - 0x1a], ax
call dword [sym.imp.WS2_32.dll_socket]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x4318e9
call edi
test eax, eax
je 0x431959
call edi
test eax, eax
jne 0x431959
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x431908
call edi
test eax, eax
je 0x431959
call edi
test eax, eax
jne 0x431959
lea eax, [ebp - 8]
push eax
push 0x8004667e
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x43192a
call edi
test eax, eax
je 0x431959
call edi
test eax, eax
jne 0x431959
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x10
push eax
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x1c], xmm0
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x431984
call edi
test eax, eax
je 0x431959
call edi
test eax, eax
je 0x431984
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x43196f
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ax, word [ebp - 0x1a]
mov word [ebx], ax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4319a0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push esi
mov esi, ecx
movups xmmword [ebp - 0x10], xmm0
push edi
push 0x10
mov dword [esi + 0x10], eax
mov eax, 2
mov word [ebp - 0x10], ax
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], fcn.0041fc70
mov ax, word [eax]
mov word [ebp - 0xe], ax
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
mov edi, eax
test edi, edi
je 0x431a06
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x431a06
mov eax, 0xfffeff04
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
xor eax, eax
test edi, edi
mov edx, 0x31
push esi
sete al
push 0x431b20
mov dword [esi + 8], eax
call fcn.00438400
test eax, eax
jne 0x431a34
cmp dword [esi + 8], eax
sete al
lea eax, [eax*2 - 0x100fd]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x431a40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push 0
push dword [ebp + 8]
mov dword [ebx], 0
push edx
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
js 0x431a67
xor eax, eax
jmp 0x431a7e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x431a79
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x431a7e
mov eax, 0xfffeffff
test esi, esi
jg 0x431a8a
jne 0x431a92
mov dword [ebx], 1
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
cmp eax, 0x2746
jne 0x431aa7
mov dword [ebx], 1
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
cmp eax, 0x2733
je 0x431a9f
push eax
push str.ERROR:_mDNSPlatformReadTCP___recv:__d_n
push 0
call fcn.0041dc40
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ebx
pop ebp
ret 8

Function at 0x431da0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x80
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
sub esi, edx
mov eax, dword [edi]
cmp eax, 4
jne 0x431dfa
mov eax, 2
mov word [esp + 8], ax
mov ax, word [ebp + 0x18]
mov word [esp + 0xa], ax
mov eax, dword [edi + 4]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x431de6
mov eax, dword [eax + 0xa0]
jmp 0x431dee
mov eax, dword [ecx]
mov eax, dword [eax + 0x1528]
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x431e46
mov eax, dword [ecx + 0x18]
jmp 0x431e46
cmp eax, 6
jne 0x431f0b
movups xmm0, xmmword [edi + 4]
mov eax, 0x17
mov dword [esp + 0xc], 0
mov word [esp + 8], ax
mov ax, word [ebp + 0x18]
mov word [esp + 0xa], ax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x20], 0
movups xmmword [esp + 0x10], xmm0
test eax, eax
je 0x431e3e
mov eax, dword [eax + 0xa0]
jmp 0x431e46
mov eax, dword [ecx]
mov eax, dword [eax + 0x384c]
cmp eax, 0xffffffff
je 0x431e64
push 0x80
lea ecx, [esp + 0xc]
push ecx
push 0
push esi
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jle 0x431e6e
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x431e8c
call esi
mov esi, eax
test esi, esi
jne 0x431e91
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov esi, 0xffffe5a5
mov ecx, dword [edi]
cmp ecx, 4
jne 0x431ea3
mov eax, dword [edi + 4]
cmp eax, dword [0x43da18]
je 0x431e82
cmp ecx, 6
jne 0x431ed4
mov eax, dword [edi + 4]
cmp eax, dword [0x43d978]
jne 0x431ed4
mov eax, dword [edi + 8]
cmp eax, dword [0x43d97c]
jne 0x431ed4
mov eax, dword [edi + 0xc]
cmp eax, dword [0x43d980]
jne 0x431ed4
mov eax, dword [edi + 0x10]
cmp eax, dword [0x43d984]
je 0x431e82
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2750
je 0x431efe
call edi
cmp eax, 0x2742
je 0x431efe
call edi
cmp eax, 0x2751
je 0x431efe
call edi
cmp eax, 0x2743
jne 0x431e82
mov eax, 0xfffeffe6
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov eax, 0xfffefffc
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x432230
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3fc
push ebx
push esi
mov ebx, edx
mov dword [ebp - 8], 0
push ecx
lea edx, [ebp - 0x3fc]
call fcn.00401fb0
cmp byte [ebp - 0x3fc], 0
lea esi, [ebp - 0x3fc]
je 0x432285
push edi
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
movsx eax, byte [esi]
push eax
call edi
add esp, 4
mov byte [esi], al
cmp byte [esi + 1], 0
jne 0x43227e
cmp al, 0x2e
jne 0x43227e
mov byte [esi], 0
inc esi
cmp byte [esi], 0
jne 0x432266
pop edi
lea eax, [ebp - 8]
push eax
push str.SOFTWARENational_InstrumentsNI_ZeroconfDynDNSStateHostNames
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4322bb
push 4
lea eax, [ebp - 1]
test ebx, ebx
push eax
push 4
push 0
push str.Status
push dword [ebp - 8]
sete byte [ebp - 1]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 8]
pop esi
pop ebx
test eax, eax
je 0x4322cb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x4328d0
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], 0
push edi
xor edi, edi
mov dword [ebp - 4], ebx
xor esi, esi
nop dword [eax]
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x432922
push dword [ebp - 0xc]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov edi, eax
add esp, 8
test edi, edi
je 0x432a51
inc esi
cmp esi, 0x64
jl 0x4328f0
jmp 0x432a35
test eax, eax
jne 0x432a35
call fcn.004345a0
mov edx, eax
mov eax, edi
test edi, edi
je 0x432a51
nop dword [eax + eax]
lea ecx, [eax + 0x1b0]
test ecx, ecx
je 0x432968
cmp byte [ecx], bl
je 0x432968
lea ecx, [eax + 0x1d8]
test ecx, ecx
je 0x432968
cmp byte [ecx], bl
je 0x432968
test edx, edx
je 0x432973
cmp dword [eax + 0x19c], edx
je 0x432973
mov eax, dword [eax]
test eax, eax
jne 0x432940
jmp 0x432a35
add eax, 8
push eax
push str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces_
push str._s_s
lea eax, [ebp - 0x510]
push 0x400
push eax
call fcn.00431110
add esp, 0x14
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x510]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x432a35
mov ecx, dword [ebp - 8]
mov edx, str.Domain
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
call fcn.004347e0
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4329e6
cmp byte [ebx], 0
jne 0x432a00
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x10]
push 0
push eax
lea eax, [ebp - 4]
mov edx, str.DhcpDomain
push eax
call fcn.004347e0
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x432a35
cmp byte [ebx], 0
je 0x432a35
mov edx, ebx
mov byte [ebp - 0x110], 0
lea ecx, [ebp - 0x110]
call fcn.00401c90
test eax, eax
je 0x432a35
cmp byte [ebp - 0x110], 0
je 0x432a35
lea ecx, [ebp - 0x110]
call fcn.00427f10
test edi, edi
je 0x432a43
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
test ebx, ebx
je 0x432a51
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x432a5f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432a70
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movups xmm0, xmmword [0x43d988]
mov eax, dword [0x43d998]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], ecx
movups xmmword [esi], xmm0
mov dword [esi + 0x10], eax
xor esi, esi
mov dword [ebp - 4], ebx
nop dword [eax + eax]
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov edi, eax
mov dword [ebp + 8], edi
cmp edi, 0x6f
jne 0x432ade
push dword [ebp - 4]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x432ad0
inc esi
cmp esi, 0x64
jl 0x432aa0
jmp 0x432b40
mov eax, 0xffffe5b8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test edi, edi
jne 0x432b40
call fcn.004345a0
mov dword [ebp - 0xc], eax
mov esi, ebx
test ebx, ebx
je 0x432b4e
lea edx, [esi + 0x1b0]
test edx, edx
je 0x432b37
cmp byte [edx], 0
je 0x432b37
lea edi, [esi + 0x1d8]
test edi, edi
je 0x432b37
cmp byte [edi], 0
je 0x432b37
mov ecx, dword [ebp - 8]
call fcn.00434890
test eax, eax
jne 0x432b37
mov ecx, dword [ebp + 0xc]
mov edx, edi
call fcn.00434890
test eax, eax
jne 0x432b37
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x432b59
cmp dword [esi + 0x19c], eax
je 0x432b59
mov esi, dword [esi]
test esi, esi
jne 0x432af0
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x432b4e
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 0x190], 6
mov edi, dword [ebp + 8]
jne 0x432b40
mov ecx, dword [ebp - 0x10]
mov eax, dword [esi + 0x194]
mov dword [ecx + 0x1c], eax
mov ax, word [esi + 0x198]
mov word [ecx + 0x20], ax
jmp 0x432b40
Function at 0x432dc0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov byte [ebp - 0x148], 0
push eax
lea eax, [ebp - 0x148]
mov dword [ebp - 4], pe_nt_image_headers32
push eax
mov ebx, ecx
push 5
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
test eax, eax
je 0x432dfa
xor esi, esi
jmp 0x432e0e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x432e19
call esi
mov esi, eax
test esi, esi
jne 0x432e1e
cmp byte [ebp - 0x148], 0
jne 0x432e34
jmp 0x432e1e
mov esi, 0xffffe5a8
xor ecx, ecx
mov al, byte [ecx + str.My_Computer]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x149], al
test al, al
jne 0x432e20
lea ecx, [ebp - 0x148]
mov byte [ebp - 0x49], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x432e41
sub ecx, edx
mov eax, 0x3f
cmp ecx, eax
cmovb eax, ecx
mov byte [ebp - 0x48], al
movzx eax, al
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x47]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0x48]
add ebx, 0x1914
mov edx, ebx
call fcn.004020a0
cmp byte [ebx], 0
jne 0x432ea6
lea eax, [ebx + 1]
mov edx, str.My_Computer
lea edi, [ebx + 0x40]
sub edx, eax
cmp eax, edi
jae 0x432ea0
mov cl, byte [edx + eax]
mov byte [eax], cl
inc eax
cmp byte [edx + eax], 0
jne 0x432e90
sub al, bl
dec al
mov byte [ebx], al
mov ecx, dword [ebp - 8]
call fcn.0041a5c0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4345a0
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], 0
push edi
lea eax, [ebp - 4]
xor esi, esi
push eax
push edi
call dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
cmp eax, 0x7a
jne 0x43461e
push ebx
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x434615
push edi
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
test eax, eax
jne 0x43460b
mov edx, dword [ebx]
test edx, edx
je 0x43460b
lea ecx, [ebx + 0x28]
nop
cmp dword [ecx - 0x24], 0
jne 0x434603
test esi, esi
je 0x4345fe
cmp dword [ecx], edi
jae 0x434603
mov esi, dword [ecx - 0x14]
mov edi, dword [ecx]
add ecx, 0x38
sub edx, 1
jne 0x4345f0
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x434700
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
setne al
test eax, eax
je 0x434762
xorps xmm0, xmm0
mov eax, 2
movups xmmword [ebp - 0x10], xmm0
mov word [ebp - 0x10], ax
mov ax, word [0x43da44]
push 0
mov word [ebp - 0xe], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push 0x10
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
neg eax
push edi
sbb esi, esi
call dword [sym.imp.WS2_32.dll_closesocket]
lea eax, [esi + 1]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4347e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
mov dword [ebx], 0x3f1
mov dword [edi], 0
mov eax, dword [edi]
test eax, eax
je 0x434813
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push dword [ebx]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [edi], eax
test eax, eax
je 0x434882
push ebx
push eax
lea eax, [ebp + 8]
push eax
push 0
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
inc esi
cmp eax, 0xea
jne 0x43484e
cmp esi, 0x64
jl 0x434803
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x434887
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x434887
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 4
push eax
push ecx
push 0
push 0
push 0x44b6d4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xfffefffd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc