joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472c40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 8], esi
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
push eax
push ecx
push 1
call fcn.00474630
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x472c73
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0xf4240
mov dword [edx + 0x258], eax
mov ecx, dword [ebp - 4]
push 0x40
mov dword [ecx + 0x25c], eax
push fcn.0045a5b4
mov edx, dword [ebp - 4]
push edx
call fcn.00470ff0
push esi
push eax
call fcn.0045a630
add esp, 0x14
test eax, eax
je 0x472caf
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push eax
push ecx
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00474850
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004710b0
mov edi, dword [ebp + 8]
add esp, 0x20
cmp edi, esi
mov ebx, 0x20000
je 0x472d19
push 0
call fcn.004717e0
mov dl, byte [esi + edi]
mov cl, byte [eax + esi]
add esp, 4
cmp dl, cl
je 0x472d07
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x70]
or ecx, ebx
mov dword [eax + 0x70], ecx
push 0
call fcn.004717e0
mov al, byte [eax + esi]
add esp, 4
inc esi
test al, al
jne 0x472ce8
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x70]
test ebx, eax
je 0x472d91
test edi, edi
je 0x472d8a
mov bl, byte [edi]
push 0
call fcn.004717e0
mov cl, byte [eax]
add esp, 4
cmp bl, cl
jne 0x472d5d
cmp bl, 0x31
jne 0x472d52
push 0
call fcn.004717e0
mov dl, byte [edi + 2]
mov cl, byte [eax + 2]
add esp, 4
cmp dl, cl
jne 0x472d5d
cmp byte [edi], 0x30
jne 0x472d91
cmp byte [edi + 2], 0x39
jge 0x472d91
test edi, edi
je 0x472d8a
push 0
call fcn.004717e0
push eax
push edi
push str.Application_built_with_libpng__.20s_but_running_with__.20s
lea eax, [ebp - 0x58]
push 0x50
push eax
call fcn.0045abc5
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00470e10
add esp, 0x20
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 8]
test eax, eax
jne 0x472ddf
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xb4]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00474820
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xb0]
test eax, eax
jne 0x472dd8
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
test eax, eax
je 0x472e1c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xb0]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004747d0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x20]
push ecx
mov dword [eax + 0xb0], 0
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004746d0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.004745b0
mov edx, dword [ebp - 4]
push edx
call fcn.00473340
add esp, 0x14
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47fef0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x47ff20
push esi
call fcn.004803f0
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x47ff19
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x47ffa3
mov eax, dword [esi + 0x1a0]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x47ff8f
mov eax, dword [esi + 8]
test eax, eax
je 0x47ff44
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1a0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x47ff8b
cmp eax, 2
je 0x47ff8f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x47ff37
cmp eax, 3
je 0x47ff6a
cmp eax, 1
jne 0x47ff37
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x47ff37
mov edx, dword [esi + 0x120]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x47ff37
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0047ffd0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x47ffc3
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.0047ffd0
add esp, 4
pop esi
ret
Function at 0x4b0adf
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b0b17
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004afae4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004afabb
jmp 0x4b0b23
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4b2423
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b2465
call fcn.004c22eb
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x4b2465
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b245c
xor eax, eax
jmp 0x4b246d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b2473
pop edi
pop esi
pop ebx
ret 4

Function at 0x4b99e7
Capabilities:
Set registry value

Disassembly:
mov eax, 0x4cb1cc
call fcn.004571b8
push ecx
push ecx
push esi
push 0x10
call fcn.004afbfa
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
and dword [ebp - 4], 0
test esi, esi
je 0x4b9a34
mov ecx, esi
call fcn.004b4c13
mov eax, dword [0x4fc7b0]
lea ecx, [esi + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
mov byte [ebp - 4], 2
mov dword [esi], vtable.CArchiveException.0
mov dword [esi + 8], eax
call fcn.004af7bd
jmp 0x4b9a36
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x10]
push 0x4e7e90
push eax
mov dword [ebp - 0x10], esi
call fcn.0045880f
pop esi
Function at 0x40cdd0
Capabilities:
Terminate process

Disassembly:
push esi
push 1
call fcn.00401430
add esp, 4
mov esi, eax
cmp dword [0x522cac], 0
jne 0x40ce0f
call fcn.00425070
cmp byte [esi], 0
jne 0x40cdf5
mov esi, str.Server_quit
push esi
call fcn.00438c70
call fcn.00425060
call fcn.0040d090
push 1
call fcn.00415e40
add esp, 8
pop esi
jmp 0x43de10
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
call fcn.0043f9c0
push 0
call fcn.0047800d
int3
Function at 0x414e70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x5cf490], 0
jne 0x414e8c
push str.Filesystem_call_made_without_initialization
push 0
call fcn.0040aa80
add esp, 8
mov ecx, dword [ebp + 0x10]
lea eax, [ecx - 1]
cmp eax, 0x3e
ja 0x414f40
mov eax, dword [ebp + 0xc]
add dword [0x5cf494], eax
imul ecx, ecx, 0x124
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp dword [ecx + 0x5cf4c4], 0
jne 0x414f2b
mov dword [ebp + 0x10], 0
push esi
push edi
mov edi, eax
test eax, eax
je 0x414f1a
lea esp, [esp]
push dword [ecx + 0x5cf4b8]
push edi
push 1
push ebx
call fcn.004729cb
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x414ef6
cmp dword [ebp + 0x10], eax
jne 0x414f15
mov dword [ebp + 0x10], 1
jmp 0x414f0a
cmp esi, 0xffffffff
jne 0x414f0a
push str.FS_Read:__1_bytes_read
push 0
call fcn.0040aa80
add esp, 8
add ebx, esi
sub edi, esi
je 0x414f21
mov ecx, dword [ebp - 4]
jmp 0x414ed0
mov eax, dword [ebp + 0xc]
sub eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ebx
push dword [ecx + 0x5cf4b8]
call fcn.004231d0
add esp, 0xc
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x415420
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
mov eax, dword [0x5cf474]
push 0x5cf370
push dword [eax + 4]
call fcn.00411970
add esp, 0xc
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0043de30
Function at 0x416ce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x5cf490], 0
jne 0x416cfc
push str.Filesystem_call_made_without_initialization
push 0
call fcn.0040aa80
add esp, 8
push ebx
push esi
push edi
push dword [ebp + 0x10]
call fcn.004127a0
mov ecx, dword [ebp + 0xc]
add esp, 4
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], eax
mov esi, ecx
test ecx, ecx
je 0x416d76
push eax
push esi
push 1
push edi
call fcn.0047356b
add esp, 0x10
test eax, eax
jne 0x416d3c
test ebx, ebx
jne 0x416d4a
add edi, eax
lea ebx, [eax + 1]
sub esi, eax
mov eax, dword [ebp - 4]
jmp 0x416d19
cmp eax, 0xffffffff
je 0x416d60
add edi, eax
sub esi, eax
mov eax, dword [ebp - 4]
jmp 0x416d19
push str.FS_Write:_0_bytes_written_n
call fcn.0040cbe0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.FS_Write:__1_bytes_written_n
call fcn.0040cbe0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
imul ecx, dword [ebp + 0x10], 0x124
cmp dword [ecx + 0x5cf4c0], 0
je 0x416d8f
push eax
call fcn.004727a6
add esp, 4
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418090
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x4af890]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x58]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], 0x67452301
mov dword [ebp - 0x54], 0xefcdab89
mov dword [ebp - 0x50], 0x98badcfe
mov dword [ebp - 0x4c], 0x10325476
mov dword [ebp - 0x48], 0
mov dword [0x5f7990], eax
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
jne 0x4180ea
push esi
push edi
call fcn.00418880
add esp, 8
jmp 0x41814f
cmp esi, 0x40
jl 0x41814f
mov ebx, esi
shr ebx, 6
mov eax, ebx
shl eax, 6
sub esi, eax
mov dword [ebp + 0x10], esi
mov edi, edi
xor esi, esi
lea eax, [edi + 2]
movzx edx, byte [eax + 1]
lea eax, [eax + 4]
movzx ecx, byte [eax - 4]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 5]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 6]
shl edx, 8
or edx, ecx
mov dword [ebp + esi*4 - 0x44], edx
inc esi
cmp esi, 0x10
jl 0x418105
lea eax, [ebp - 0x44]
push eax
call fcn.004181e0
add dword [ebp - 0x48], 0x40
add esp, 4
add edi, 0x40
sub ebx, 1
jne 0x418100
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp - 0x5c]
push esi
push edi
call fcn.00418880
mov ecx, dword [ebp - 0x58]
add esp, 8
mov byte [ebx], cl
mov eax, ecx
shr eax, 8
mov byte [ebx + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 2], al
shr ecx, 0x18
mov byte [ebx + 3], cl
mov ecx, dword [ebp - 0x54]
mov eax, ecx
mov byte [ebx + 4], cl
shr eax, 8
mov byte [ebx + 5], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 6], al
shr ecx, 0x18
mov byte [ebx + 7], cl
mov ecx, dword [ebp - 0x50]
mov eax, ecx
shr eax, 8
mov byte [ebx + 9], al
mov eax, ecx
mov byte [ebx + 8], cl
shr ecx, 0x18
mov byte [ebx + 0xb], cl
mov ecx, dword [ebp - 0x4c]
shr eax, 0x10
mov byte [ebx + 0xa], al
mov eax, ecx
shr eax, 8
mov byte [ebx + 0xc], cl
mov byte [ebx + 0xd], al
mov eax, ecx
shr ecx, 0x18
mov byte [ebx + 0xf], cl
mov ecx, dword [ebp - 4]
pop edi
shr eax, 0x10
xor ecx, ebp
pop esi
mov byte [ebx + 0xe], al
pop ebx
call fcn.0046cfaf
mov esp, ebp
pop ebp
ret

Function at 0x418a50
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x4af890]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.0043e040
push 0x40
lea eax, [ebp - 0x84]
mov dword [0x5f79e0], 0x67452301
push eax
push 0x5f79e0
mov dword [0x5f79e4], 0xefcdab89
mov dword [0x5f79e8], 0x98badcfe
mov dword [0x5f79ec], 0x10325476
mov dword [0x5f79f0], 0
mov dword [0x5f79f4], 0
call fcn.00419240
push 0x40
lea eax, [ebp - 0x44]
mov dword [0x5f7a38], 0x67452301
push eax
push 0x5f7a38
mov dword [0x5f7a3c], 0xefcdab89
mov dword [0x5f7a40], 0x98badcfe
mov dword [0x5f7a44], 0x10325476
mov dword [0x5f7a48], 0
mov dword [0x5f7a4c], 0
call fcn.00419240
mov ecx, dword [ebp - 4]
add esp, 0x20
xor ecx, ebp
call fcn.0046cfaf
mov esp, ebp
pop ebp
ret
Function at 0x41c030
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x4af890]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x100
lea eax, [ebp - 0x134]
mov dword [ebp - 0x138], 0
push eax
mov dword [0x5fcc28], 0
call dword [sym.imp.WSOCK32.dll_gethostname]
cmp eax, 0xffffffff
je 0x41c265
lea eax, [ebp - 0x134]
push eax
push str.Hostname:__s_n
call fcn.0040cbe0
xor eax, eax
mov dword [ebp - 0x164], 2
mov dword [ebp - 0x16c], eax
add esp, 8
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
mov eax, dword [0x5fa698]
test eax, eax
jne 0x41c0d0
push eax
call fcn.0041db80
mov dword [0x5fa698], eax
push esi
lea ecx, [ebp - 0x138]
push ecx
lea ecx, [ebp - 0x16c]
push ecx
push 0
lea ecx, [ebp - 0x134]
push ecx
call eax
mov esi, eax
push esi
call dword [sym.imp.WSOCK32.dll_WSASetLastError]
test esi, esi
jne 0x41c242
mov esi, dword [ebp - 0x138]
xor eax, eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov eax, 2
mov word [ebp - 0x14c], ax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], eax
mov eax, 0x17
mov dword [ebp - 0x148], 0xffffffff
mov word [ebp - 0x20], ax
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
test esi, esi
je 0x41c190
nop
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x41c170
lea eax, [ebp - 0x14c]
jmp 0x41c178
cmp eax, 0x17
jne 0x41c189
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0x18]
push 0x48b3d2
call fcn.0041b070
add esp, 0xc
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x41c160
cmp dword [0x5fcc28], 0
mov dword [ebp - 0x13c], 0
jle 0x41c242
push ebx
push edi
mov edi, 0x5fa940
mov edi, edi
mov eax, dword [0x5fa69c]
xor ebx, ebx
cmp word [edi], 0x17
sete bl
dec ebx
and ebx, 0xfffffff4
add ebx, 0x1c
test eax, eax
jne 0x41c1d5
push 1
call fcn.0041db80
mov dword [0x5fa69c], eax
push 2
push 0
push 0
push 0x30
lea ecx, [ebp - 0x34]
push ecx
push ebx
push edi
call eax
mov esi, eax
push esi
call dword [sym.imp.WSOCK32.dll_WSASetLastError]
test esi, esi
setne al
dec al
and byte [ebp - 0x34], al
mov eax, dword [edi - 8]
cmp eax, 4
jne 0x41c20b
lea eax, [ebp - 0x34]
push eax
push str.IP:__s_n
jmp 0x41c219
cmp eax, 5
jne 0x41c221
lea eax, [ebp - 0x34]
push eax
push str.IP6:__s_n
call fcn.0040cbe0
add esp, 8
mov ecx, dword [ebp - 0x13c]
add edi, 0x118
inc ecx
mov dword [ebp - 0x13c], ecx
cmp ecx, dword [0x5fcc28]
jl 0x41c1b0
pop edi
pop ebx
mov esi, dword [ebp - 0x138]
test esi, esi
je 0x41c264
mov eax, dword [0x5fa6a0]
test eax, eax
jne 0x41c261
push 2
call fcn.0041db80
mov dword [0x5fa6a0], eax
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046cfaf
mov esp, ebp
pop ebp
ret
Function at 0x41c4a0
Capabilities:
Initialize winsock library

Disassembly:
push 0x5fa6a8
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x41c4c0
push eax
push str.3WARNING:_Winsock_initialization_failed__returned__d_n
call fcn.0040cbe0
add esp, 8
ret
push str.Winsock_Initialized_n
mov dword [0x5fa838], 1
call fcn.0040a6f0
push 1
call fcn.0041b450
push 0x41cdb0
push str.net_restart
call fcn.004013a0
add esp, 0x10
ret

Function at 0x41c500
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x4ae1ec]
cmp ecx, 0xffffffff
je 0x41c660
cmp dword [0x4ae1f0], 0xffffffff
jne 0x41c660
mov eax, dword [0x5fa844]
test byte [eax + 0x20], 8
jne 0x41c660
mov ax, word [0x5fa914]
cmp al, 0xff
je 0x41c5b8
test ax, ax
jne 0x41c57d
cmp word [0x5fa916], ax
jne 0x41c57d
cmp word [0x5fa918], ax
jne 0x41c57d
cmp word [0x5fa91a], ax
jne 0x41c57d
cmp word [0x5fa91c], ax
jne 0x41c57d
cmp word [0x5fa91e], ax
jne 0x41c57d
cmp word [0x5fa920], ax
jne 0x41c57d
cmp word [0x5fa922], ax
je 0x41c5b8
lea eax, [ebp - 4]
push eax
movzx eax, word [0x5fa90e]
push 0
push eax
call dword [sym.imp.WSOCK32.dll_ntohs]
movzx eax, ax
push eax
mov eax, dword [0x5fa86c]
push dword [eax + 4]
call fcn.0041c280
mov ecx, eax
add esp, 0x10
mov dword [0x4ae1f0], ecx
cmp ecx, 0xffffffff
jne 0x41c5be
mov ecx, dword [0x4ae1ec]
mov dword [0x4ae1f0], ecx
cmp dword [0x5fa908], 0
je 0x41c619
push 4
push 0x5fa908
push 9
push 0x29
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
jns 0x41c613
call fcn.0041b5f0
push eax
push str.NET_JoinMulticast6:_Couldnt_set_scope_on_multicast_socket:__s_n
call fcn.0040cbe0
mov ecx, dword [0x4ae1f0]
add esp, 8
cmp ecx, dword [0x4ae1ec]
je 0x41c619
push ecx
call dword [sym.imp.WSOCK32.dll_closesocket]
mov dword [0x4ae1f0], 0xffffffff
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4ae1f0]
push 0x14
push 0x5fa8f8
push 0xc
push 0x29
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
je 0x41c660
call fcn.0041b5f0
push eax
push str.NET_JoinMulticast6:_Couldnt_join_multicast_group:__s_n
call fcn.0040cbe0
mov eax, dword [0x4ae1f0]
add esp, 8
cmp eax, dword [0x4ae1ec]
je 0x41c660
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
mov dword [0x4ae1f0], 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x41cdc0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4af890]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
or esi, 0xffffffff
test eax, eax
sets bl
xor ecx, ecx
dec ebx
mov dword [ebp - 0x108], ecx
and ebx, eax
mov eax, dword [0x4ae1e4]
cmp eax, 0xffffffff
je 0x41ce0a
mov ecx, 1
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x108], ecx
mov esi, eax
mov edx, dword [0x4ae1ec]
cmp edx, 0xffffffff
je 0x41ce4f
xor eax, eax
test ecx, ecx
je 0x41ce2e
jmp 0x41ce20
cmp dword [ebp + eax*4 - 0x104], edx
je 0x41ce2e
inc eax
cmp eax, ecx
jb 0x41ce20
cmp eax, ecx
jne 0x41ce44
cmp ecx, 0x40
jae 0x41ce44
mov dword [ebp + eax*4 - 0x104], edx
inc dword [ebp - 0x108]
cmp esi, 0xffffffff
je 0x41ce4d
cmp edx, esi
jbe 0x41ce4f
mov esi, edx
cmp esi, 0xffffffff
jne 0x41ce6e
mov eax, 0x10624dd3
imul ebx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41ceec
mov eax, 0x431bde83
imul ebx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x110], eax
imul eax, eax, 0xf4240
sub ebx, eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], ebx
push eax
lea eax, [esi + 1]
push eax
call dword [sym.imp.WSOCK32.dll_select]
test eax, eax
jle 0x41ced4
lea eax, [ebp - 0x108]
push eax
call fcn.0041b850
add esp, 4
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046cfaf
mov esp, ebp
pop ebp
ret
cmp eax, 0xffffffff
jne 0x41ceec
call fcn.0041b5f0
push eax
push str.3Warning:_select___syscall_failed:__s_n
call fcn.0040cbe0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.0046cfaf
mov esp, ebp
pop ebp
ret
Function at 0x41d180
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x870
mov eax, dword [0x4af890]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x870], eax
mov esi, dword [edi]
lea eax, [esi - 3]
cmp eax, 3
ja 0x41d30c
push ebx
mov ebx, dword [0x4ae1e4]
cmp ebx, 0xffffffff
jne 0x41d1c5
cmp esi, 4
je 0x41d1d8
cmp esi, 3
je 0x41d1d8
cmp dword [0x4ae1ec], 0xffffffff
jne 0x41d1e9
cmp esi, 5
je 0x41d1d8
cmp esi, 6
jne 0x41d1f9
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046cfaf
mov esp, ebp
pop ebp
ret
cmp esi, 6
jne 0x41d1f9
mov eax, dword [0x5fa844]
test byte [eax + 0x20], 8
jne 0x41d1d8
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.0041cf10
add esp, 8
cmp dword [0x5fa83c], 0
je 0x41d274
cmp esi, 4
jne 0x41d274
mov esi, dword [ebp + 8]
cmp esi, 0x7d0
ja 0x41d2c7
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x868], eax
mov ax, word [ebp - 0x82]
push esi
push dword [ebp - 0x870]
mov word [ebp - 0x864], ax
lea eax, [ebp - 0x862]
push eax
mov dword [ebp - 0x86c], 0x1000000
call fcn.0046dbd0
add esp, 0xc
lea eax, [esi + 0xa]
push 0x10
push 0x5fa878
push 0
push eax
lea eax, [ebp - 0x86c]
push eax
push ebx
jmp 0x41d2b8
mov ax, word [ebp - 0x84]
cmp ax, 2
jne 0x41d298
push 0x10
lea eax, [ebp - 0x84]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 0x870]
push ebx
jmp 0x41d2b8
cmp ax, 0x17
jne 0x41d2c7
push 0x1c
lea eax, [ebp - 0x84]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 0x870]
push dword [0x4ae1ec]
call dword [sym.imp.WSOCK32.dll_sendto]
cmp eax, 0xffffffff
jne 0x41d1d8
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x41d1d8
cmp eax, 0x2741
jne 0x41d2e8
cmp dword [edi], 3
je 0x41d1d8
call fcn.0041b5f0
push eax
push str.Sys_SendPacket:__s_n
call fcn.0040cbe0
add esp, 8
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046cfaf
mov esp, ebp
pop ebp
ret
push esi
push str.Sys_SendPacket:_bad_address_type__i
push 0
call fcn.0040aa80
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
call fcn.0046cfaf
mov esp, ebp
pop ebp
ret
Function at 0x41db80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4af890]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5fa694], 0
mov dword [ebp - 0x230], str.getaddrinfo
mov dword [ebp - 0x22c], 0x41d5d0
mov dword [ebp - 0x228], str.getnameinfo
mov dword [ebp - 0x224], 0x41d940
mov dword [ebp - 0x220], str.freeaddrinfo
mov dword [ebp - 0x21c], fcn.0041d580
jne 0x41dd02
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x41dcf8
push ebx
push esi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.00473922
push str.ws2_32
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.0047397c
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x41dc58
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x41dcad
push edi
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.00473922
push str.wship6
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.0047397c
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41dcf5
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x41dcad
push edi
call esi
jmp 0x41dcf5
xor esi, esi
nop
push dword [ebp + esi*8 - 0x230]
push edi
call ebx
mov dword [ebp + esi*8 - 0x22c], eax
test eax, eax
je 0x41dcee
inc esi
cmp esi, 3
jl 0x41dcb0
mov eax, dword [ebp - 0x22c]
mov dword [0x4ae1d0], eax
mov eax, dword [ebp - 0x224]
mov dword [0x4ae1d8], eax
mov eax, dword [ebp - 0x21c]
mov dword [fcn.0041d580], eax
jmp 0x41dcf5
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
mov dword [0x5fa694], 1
movzx eax, word [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, dword [eax*8 + 0x4ae1d0]
call fcn.0046cfaf
mov esp, ebp
pop ebp
ret 4