joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4143c6
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x482c7b
call fcn.004801f0
sub esp, 0xa0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], esi
jmp 0x4143e6
lea edi, [esi + 0x10]
xor ebx, ebx
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0042283a
cmp byte [edi], bl
jne 0x41458c
mov eax, dword [0x4b5458]
push 0x4a8500
xor eax, 0xfe7ded7b
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040baed
add esp, 0xc
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004311c6
push eax
lea ecx, [esi + 0x6c]
call fcn.0042e9fa
mov ecx, esi
call fcn.00413782
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DrawMenuBar]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.0042f3db
jmp 0x41458c
cmp byte [esi + 0x10], bl
push ebx
push ebx
je 0x414723
push 0x10
mov dword [ebp - 4], 8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0040c10b
pop ecx
pop ecx
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 9
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040b540
pop ecx
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040c049
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xb
call fcn.00430b8e
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xa
call fcn.00430a4d
lea ecx, [ebp - 0x18]
call fcn.004311c6
push ebx
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.00430f4c
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x88]
push ecx
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebx
jne 0x41467e
lea ecx, [ebp - 0x14]
call fcn.004311c6
push eax
lea ecx, [ebp - 0x24]
call fcn.0042f493
mov ecx, eax
mov byte [ebp - 4], 0xc
call fcn.004311c6
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea eax, [ebp - 0x34]
push str.Cant_run__s_error_d
push eax
call fcn.0042c02a
add esp, 0x10
lea eax, [ebp - 0x34]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 9
call fcn.00430a4d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 8
call fcn.00430a4d
mov byte [0x4b5395], 1
jmp 0x414734
mov ecx, 0x4b5510
mov dword [ebp - 4], 0x10
call fcn.0040abf5
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x418373
Capabilities:
Create process on windows

Disassembly:
xor eax, eax
push 1
push eax
push eax
push str.http:__www.ammyy.com
push 0x4a88b4
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret

Function at 0x41b390
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x483844
call fcn.004801f0
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x28]
call fcn.0042e914
and dword [ebp - 4], 0
mov ecx, eax
call fcn.0042e9ea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], eax
call fcn.0042e942
push 0
lea ecx, [ebp - 0x1c]
call fcn.0042e914
push dword [ebp - 0x10]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push 0xa2
push 0x7e
push ebx
push edi
push 7
push 0x3c
push dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 1
push eax
call fcn.0041b2d5
push dword [ebp - 0x10]
add ebx, 0x15
add edi, 0xa
mov ecx, esi
push 0xa
push 0x71
push ebx
mov dword [ebp + 0x10], edi
push edi
mov edi, 0x10003
push edi
push 0xe
push dword [ebp + 8]
push esi
call fcn.0041b2d5
push dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
add ebx, 0x10
add eax, 0x17
push 0xa
push 0x5e
push ebx
push eax
push edi
push 0xf
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
lea eax, [esi + 0xc]
mov ecx, esi
push eax
call fcn.0041b2d5
push dword [ebp - 0x10]
add ebx, 0x10
lea eax, [esi + 0x18]
mov ecx, esi
push 0xa
push 0x5e
push ebx
push dword [ebp + 0xc]
push edi
push 0x10
push dword [ebp + 8]
push eax
call fcn.0041b2d5
push dword [ebp - 0x10]
add ebx, 0x10
push 0xa
push 0x5e
push ebx
push dword [ebp + 0xc]
lea eax, [esi + 0x24]
mov ecx, esi
push edi
push 0x11
push dword [ebp + 8]
push eax
call fcn.0041b2d5
push dword [ebp - 0x10]
add ebx, 0x14
lea eax, [esi + 0x30]
mov ecx, esi
push 0xa
push 0x71
push ebx
push dword [ebp + 0x10]
push edi
push 0x12
push dword [ebp + 8]
push eax
call fcn.0041b2d5
push dword [ebp - 0x10]
add ebx, 0x10
lea eax, [esi + 0x3c]
mov ecx, esi
push 0xa
push 0x71
push ebx
push dword [ebp + 0x10]
push edi
push 0x13
push dword [ebp + 8]
push eax
call fcn.0041b2d5
push dword [ebp - 0x10]
add ebx, 0x10
lea eax, [esi + 0x48]
mov ecx, esi
push 0xa
push 0x71
push ebx
push dword [ebp + 0x10]
push edi
push 0x14
push dword [ebp + 8]
push eax
call fcn.0041b2d5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0042e942
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x41ddcf
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push esi
xor esi, esi
push edi
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x41ddef
xor eax, eax
jmp 0x41de40
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
jmp 0x41de2b
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
je 0x41de31
lea eax, [ebp - 0x128]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x41de08
jmp 0x41de37
mov esi, dword [ebp - 0x120]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x41e04b
Capabilities:
Get session user name
Impersonate user

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 8], esi
mov dword [esi], edi
mov dword [esi + 4], edi
cmp byte [0x4b5394], 0
je 0x41e17d
mov ecx, 0x4b5568
call fcn.0041de44
cmp eax, edi
mov dword [esi + 4], eax
je 0x41e17d
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x41e0ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR__d_ImpersonateLoggedOnUser__
push str.S:Ammyy_sourcesmainImpersonateWrapper.cpp
push edi
push 0x4b5b78
jmp 0x41e175
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x80
push eax
lea eax, [ebp - 0xac]
push eax
mov byte [ebp - 1], 1
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
mov ebx, str.S:Ammyy_sourcesmainImpersonateWrapper.cpp
mov esi, 0x4b5b78
jne 0x41e0f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR__d_GetUserName__
push ebx
push edi
push esi
call fcn.0041e1ee
add esp, 0x14
and byte [ebp - 1], 0
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x41e112
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR__d_RevertToSelf__
push ebx
push edi
push esi
call fcn.0041e1ee
add esp, 0x14
cmp byte [ebp - 1], 0
je 0x41e17d
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 8]
lea eax, [ebp - 0xac]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 0x20
push dword [edi + 4]
mov dword [ebp - 0x28], 1
call dword [sym.imp.USERENV.dll_LoadUserProfileA]
test eax, eax
jne 0x41e15b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR__d_LoadUserProfile__
jmp 0x41e171
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x41e16b
cmp eax, 0xffffffff
je 0x41e16b
mov dword [edi], eax
jmp 0x41e17d
push eax
push str.Invalid_profile_X
push ebx
push 0
push esi
call fcn.0041e1ee
add esp, 0x14
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41e2ef
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, 0x483c07
call fcn.004801f0
mov eax, 0x1de4
call fcn.004802b0
push ebx
push esi
push edi
mov esi, ecx
push 0x200
lea ecx, [ebp - 0x24]
call fcn.0042d769
and dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00456d84
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
push 0x3d
mov edi, ebx
lea ecx, [ebp - 0x24]
shr edi, 7
call fcn.0042d908
push ebx
lea ecx, [ebp - 0x24]
call fcn.0042d917
lea eax, [ebp - 0x38]
push 0x10
push eax
lea ecx, [ebp - 0x24]
call fcn.0042d8d0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
test al, al
sete cl
inc cl
test al, al
mov byte [ebp - 0x28], cl
je 0x41e369
push 0x37
pop ebx
jmp 0x41e36c
mov ebx, dword [esi + 8]
push edi
lea ecx, [ebp - 0x24]
call fcn.0042d917
push 0
lea ecx, [ebp - 0x24]
call fcn.0042d917
call fcn.0042587f
push eax
lea ecx, [ebp - 0x24]
call fcn.0042d926
push dword [ebp - 0x28]
lea ecx, [ebp - 0x24]
call fcn.0042d908
mov eax, dword [0x4b5458]
lea ecx, [ebp - 0x24]
xor eax, 0xfe7ded7b
push eax
call fcn.0042d926
push ebx
lea ecx, [ebp - 0x24]
call fcn.0042d926
mov eax, dword [esi]
lea ecx, [ebp - 0x24]
push ecx
mov ecx, esi
call dword [eax + 0x14]
mov ecx, dword [esi + 0xc]
push 1
push 0x4a92ec
add ecx, 0xc
call fcn.0042bb83
lea ecx, [ebp - 0x1df0]
call fcn.0042a092
mov eax, dword [esi + 0xc]
lea ecx, [ebp - 0x1df0]
add eax, 0xc
mov byte [ebp - 4], 1
push eax
call fcn.0042a095
push 0x12
lea ecx, [ebp - 0x24]
call fcn.0042e949
inc eax
lea ecx, [ebp - 0x1df0]
push eax
call fcn.0042ba33
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x24]
add eax, 0xffffffed
push eax
call fcn.0042e949
mov ecx, dword [esi + 0xc]
add eax, 0x13
push eax
add ecx, 0xc
call fcn.0042ba33
push 0
lea ecx, [ebp - 0x24]
push dword [ebp - 0x18]
call fcn.0042e949
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
je 0x41e46c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea eax, [ebp - 0x34]
push str.error_d__while_sending_Initial_msg
push eax
call fcn.0041f186
add esp, 0xc
lea eax, [ebp - 0x34]
push 0x498418
push eax
call sub.MSVCRT.dll__CxxThrowException
and byte [ebp - 4], 0
lea ecx, [ebp - 0x1df0]
call fcn.0042d57a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0042d7f5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x41ef0f
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, dword [ebp + 0x14]
mov ebx, eax
and dword [ebp + 0x14], 0
lea eax, [ebp + 0x14]
push eax
push 0x4004667f
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp dword [ebp + 0x14], esi
jae 0x41ef71
call edi
sub eax, ebx
cmp eax, dword [ebp + 0xc]
ja 0x41ef53
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41ef25
lea eax, [ebp - 0xc]
push str.Routers_Initial_reply_timeout_is_expired
push eax
call fcn.0041f186
pop ecx
lea eax, [ebp - 0xc]
pop ecx
push 0x498418
push eax
call sub.MSVCRT.dll__CxxThrowException
push 0
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, esi
je 0x41efaa
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea eax, [ebp - 0xc]
push str.ReadNonBlock___error_d
push eax
call fcn.0041f186
add esp, 0xc
lea eax, [ebp - 0xc]
push 0x498418
push eax
call sub.MSVCRT.dll__CxxThrowException
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x41f0ff
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 0
push ecx
push 0x41f178
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x41f145
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x10]
push str.CreateThread___Error__d
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0x10]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x41f176
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x10]
push str.CloseHandle___Error__d
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0x10]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
leave
ret
Function at 0x41f6b9
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x483df8
call fcn.004801f0
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [esi + 8], ebx
je 0x41f872
push str.Get_Router_IP
call fcn.0041efb1
pop ecx
lea ecx, [ebp - 0x48]
call fcn.0040885f
mov eax, dword [0x4b5458]
lea ecx, [ebp - 0x48]
xor eax, 0xfe7ded7b
mov dword [ebp - 4], ebx
mov dword [ebp - 0x3c], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x38], eax
call fcn.0040836a
lea ecx, [ebp - 0x34]
call fcn.0042fbb1
test eax, eax
jne 0x41f785
lea eax, [ebp - 0x34]
push str.NOT_FOUND
push eax
call fcn.0042fc66
pop ecx
test al, al
pop ecx
je 0x41f763
push edi
lea eax, [ebp + 8]
push 7
push eax
mov ecx, 0x4b5578
call fcn.00421465
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.004311c6
lea ecx, [ebp + 8]
mov edi, eax
mov byte [ebp - 4], bl
call fcn.00430a4d
push dword [esi + 8]
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.00412175
add esp, 0xc
lea eax, [ebp - 0x1c]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
pop edi
push dword [ebp - 0x34]
lea eax, [ebp - 0x1c]
push str.Couldnt_get_router_ip__status_s
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0x1c]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
lea ecx, [ebp - 0x2c]
call fcn.004311c6
push eax
lea ecx, [ebp - 0x10]
call fcn.00430b0d
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004311b6
test eax, eax
jne 0x41f7c9
push dword [ebp - 0x28]
mov ecx, 0x4b539c
call fcn.004311c6
push eax
lea ecx, [ebp - 0x10]
call fcn.004311c6
push eax
push dword [0x4b53a8]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x24]
call fcn.0042fbb1
test eax, eax
jne 0x41f7ee
push 1
push ebx
push ebx
lea ecx, [ebp - 0x24]
call fcn.004311c6
push eax
push 0x4a88b4
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp byte [ebp - 0x20], bl
jne 0x41f82e
lea ecx, [ebp - 0x10]
call fcn.004311b6
test eax, eax
je 0x41f80c
push str.Access_denied_by_server.
lea ecx, [ebp - 0x10]
call fcn.00430c41
lea ecx, [ebp - 0x10]
call fcn.004311c6
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00412175
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
cmp byte [0x4b5ac3], bl
je 0x41f85b
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
call fcn.0042f0e6
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00430a4d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.004088f1
jmp 0x41f87f
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00430a4d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.004088f1
push dword [ebp + 8]
mov ecx, 0x4b5a58
call fcn.00425c69
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x420833
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x483f90
call fcn.004801f0
sub esp, 0x78
and byte [ebp - 0x4c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov esi, dword [esi + 0xc]
lea ecx, [ebp - 0x48]
mov ebx, eax
call fcn.0042d733
mov eax, dword [edi + 0x14]
and dword [ebp - 4], 0
add eax, 0x400
lea ecx, [ebp - 0x48]
push eax
call fcn.0042d843
lea ecx, [ebp - 0x48]
call fcn.0042e949
push 0x40
mov dword [ebp + 8], eax
pop ecx
mov eax, ebx
cmp esi, ecx
ja 0x42088b
mov ecx, esi
add ecx, ebx
cmp ebx, ecx
jae 0x420899
xor byte [eax], 0x7f
inc eax
cmp eax, ecx
jb 0x420891
lea eax, [esi + esi*4]
lea ecx, [ebp - 0x84]
shl eax, 2
push eax
push esi
push dword [ebp + 8]
push ebx
call fcn.00420972
mov esi, eax
mov eax, dword [edi + 0x14]
cmp esi, eax
push esi
je 0x4208da
push eax
lea eax, [ebp - 0x20]
push str.NTS_filesize_shoule_be__u_instead_of__u
push eax
call fcn.0042c02a
add esp, 0x10
lea eax, [ebp - 0x20]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
push dword [ebp + 8]
lea ecx, [ebp - 0x30]
call fcn.00456dab
lea eax, [edi + 0x18]
push 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
je 0x420919
lea eax, [ebp - 0x20]
push str.NTS_MD5_error_for_new_downloaded_file
push eax
call fcn.0042c02a
pop ecx
lea eax, [ebp - 0x20]
pop ecx
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
lea ecx, [ebp - 0x14]
call fcn.0042c355
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.004311c6
push eax
lea ecx, [ebp - 0x14]
call fcn.0042c39a
push esi
lea ecx, [ebp - 0x14]
push dword [ebp + 8]
call fcn.0042c487
lea ecx, [ebp - 0x14]
call fcn.0042c30d
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0042c2d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.0042d7f5
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x420bd9
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
test eax, eax
je 0x420c44
push 2
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 4
push eax
push 0xffffff7f
push 0xffff
push dword [esi + 0x24]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x420c2a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.setsockopt_SO_DONTLINGER__error_d
push 0x4b5b78
call fcn.0042d050
add esp, 0xc
push dword [esi + 0x24]
call dword [sym.imp.WS2_32.dll_closesocket]
and dword [esi + 0x24], 0
push 0x18e
lea ecx, [esi + 4]
call fcn.0042d917
pop esi
leave
ret
Function at 0x420f8d
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
push 0
push 0x4000
push dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
push esi
push dword [esp + 0xc]
push str.ReTranslator::SimpleRead1__X__read__d_bytes
push 0x4b5b78
call fcn.0042d068
add esp, 0x10
test esi, esi
jle 0x420fc4
mov eax, esi
pop esi
ret
jge 0x420fd7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x420fd7
xor eax, eax
pop esi
ret
or eax, 0xffffffff
pop esi
ret

Function at 0x420fdc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
lea esi, [ebx + 4]
push edi
mov edi, dword [esi + 0xc]
sub edi, dword [esi + 0x10]
test edi, edi
jle 0x421033
mov eax, 0x4000
cmp edi, eax
jg 0x420ffa
mov eax, edi
push 0
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_send]
mov ebp, eax
push ebp
push dword [ebx]
push str.ReTranslator::SimpleSend___X__send__d_bytes
push 0x4b5b78
call fcn.0042d068
add esp, 0x10
test ebp, ebp
jle 0x421044
cmp ebp, edi
mov ecx, esi
jne 0x42103a
mov eax, dword [esi]
call dword [eax + 8]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
ret
push ebp
push 0
call fcn.0042da3d
jmp 0x421033
jge 0x421053
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x421033
xor al, al
jmp 0x421035
Function at 0x421057
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x24]
mov eax, dword [esi]
mov ecx, dword [edi]
xor ebx, ebx
xor edx, edx
inc ebx
mov dword [ebp - 0x104], edx
mov dword [ebp - 0x204], eax
mov dword [ebp - 0x208], ebx
cmp dword [ebp + edx*4 - 0x204], ecx
je 0x421091
inc edx
cmp edx, ebx
jb 0x421083
cmp edx, ebx
jne 0x4210a5
mov dword [ebp - 0x200], ecx
mov dword [ebp - 0x208], 2
mov edx, dword [esi + 0x10]
sub edx, dword [esi + 0x14]
je 0x4210bd
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x104], 1
mov eax, dword [esi + 0x34]
sub eax, dword [esi + 0x38]
je 0x4210f5
mov edx, dword [ebp - 0x104]
xor eax, eax
test edx, edx
jbe 0x4210df
cmp dword [ebp + eax*4 - 0x100], ecx
je 0x4210df
inc eax
cmp eax, edx
jb 0x4210d1
cmp eax, edx
jne 0x4210f5
cmp edx, 0x40
jae 0x4210f5
mov dword [ebp + eax*4 - 0x100], ecx
inc dword [ebp - 0x104]
xor ebx, ebx
lea eax, [ebp - 0x104]
push ebx
push ebx
push eax
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, ebx
jle 0x421179
cmp eax, 4
jg 0x421179
lea eax, [ebp - 0x208]
push eax
push dword [esi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x42113a
lea eax, [esi + 0x28]
push eax
push dword [esi]
call fcn.00421198
pop ecx
test al, al
pop ecx
je 0x421193
lea eax, [ebp - 0x208]
push eax
push dword [edi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x42115d
lea eax, [esi + 4]
push eax
push dword [edi]
call fcn.00421198
pop ecx
test al, al
pop ecx
je 0x421193
mov ecx, edi
call fcn.00420fdc
test al, al
je 0x421193
mov ecx, esi
call fcn.00420fdc
test al, al
jne 0x421068
jmp 0x421193
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReTranslate__1_error_d__d
push 0x4b5b78
call fcn.0042d050
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret

Function at 0x421198
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, 0x4000
mov ecx, dword [esi + 0xc]
mov eax, dword [esi]
add ecx, edi
push ecx
mov ecx, esi
call dword [eax + 4]
mov eax, dword [esi]
push 0
push edi
mov ecx, esi
call dword [eax + 0x18]
push eax
push dword [esp + 0x18]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4211d7
push eax
push 0
mov ecx, esi
call fcn.0042d8d0
mov al, 1
jmp 0x421209
jge 0x421207
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4211d3
cmp eax, 0x2746
je 0x421207
cmp eax, 0x2745
je 0x421207
push eax
push str.ReTranslator::SimpleRead__1_error_d
push 0x4b5b78
call fcn.0042d050
add esp, 0xc
xor al, al
pop edi
pop esi
ret

Function at 0x42154a
Capabilities:
Identify system language via api

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edx, 0x3ff
mov ecx, 0x4a9d9c
and eax, edx
xor esi, esi
mov di, word [ecx]
and di, dx
cmp ax, di
je 0x421580
add ecx, 0x18
inc esi
cmp ecx, 0x4a9f4c
jl 0x421560
mov ax, word [0x4a9d9c]
pop edi
pop esi
ret
lea eax, [esi + esi*2]
mov ax, word [eax*8 + 0x4a9d9c]
jmp 0x42157d
Function at 0x423c8f
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0x14]
mov byte [eax], bl
mov eax, dword [ebp + 0xc]
push edi
push 0xf003f
push ebx
mov byte [eax], bl
mov eax, dword [ebp + 0x10]
push ebx
mov edi, ecx
mov byte [eax], bl
mov byte [esi], bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [ebp + 0x14], eax
je 0x423d21
push 0xf01ff
lea ecx, [edi + 4]
call fcn.004311c6
push eax
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
cmp edi, ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x423d16
lea eax, [ebp - 0x1c]
mov byte [esi], 1
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x423d11
cmp dword [ebp - 0x18], 4
jne 0x423d05
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
cmp dword [ebp - 0x18], 1
jne 0x423d11
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
push edi
call ebx
jmp 0x423d1c
mov eax, dword [ebp + 8]
mov byte [eax], 1
push dword [ebp + 0x14]
call ebx
pop edi
pop esi
pop ebx
leave
ret 0x10