joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e926
Capabilities:
Delete file

Disassembly:
push 0x7c
mov eax, 0x46537e
call fcn.0044aa72
mov ebx, ecx
lea edi, [ebx + 0x1ac]
push str.Bootstrapper::forceMFCStudioCleanup___deleteCurVersionKeys
mov esi, edi
call fcn.0040892e
pop ecx
lea eax, [ebp - 0x84]
push eax
call fcn.004298a8
pop ecx
and dword [ebp - 4], 0
cmp dword [eax + 0x18], 8
jb 0x41e963
mov eax, dword [eax + 4]
jmp 0x41e966
add eax, 4
mov cl, byte [ebx + 0x59]
mov byte [ebp - 0x68], cl
push eax
push dword [ebp - 0x68]
mov ecx, edi
call fcn.0042941d
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x84]
call fcn.00409047
call fcn.0041ea8f
mov al, byte [ebx + 0x59]
mov byte [ebp - 0x68], al
push dword [ebp - 0x68]
lea eax, [ebp - 0x64]
push eax
call fcn.0041970f
xor ebx, ebx
inc ebx
push str.RobloxStudioLauncher.exe
lea eax, [ebp - 0x48]
mov dword [ebp - 4], ebx
call fcn.00407b1d
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 2
call fcn.0040ac59
add esp, 0xc
mov byte [ebp - 4], 3
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x41e9de
lea eax, [ebp - 0x28]
push eax
push str.Bootstrapper::forceMFCStudioCleanup___deleting_studio_stub:__S
mov esi, edi
call fcn.0040892e
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
pop ecx
pop ecx
jae 0x41e9f9
lea eax, [ebp - 0x28]
push eax
call fcn.0042be58
pop ecx
test al, al
je 0x41ea17
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x41ea10
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
push edi
push ebx
lea esi, [ebp - 0x2c]
call fcn.00409047
push edi
push ebx
lea esi, [ebp - 0x48]
call fcn.00409047
push edi
push ebx
lea esi, [ebp - 0x64]
call fcn.00409047
call fcn.0044aaf5
ret

Function at 0x42730c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x427323
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x427358
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x427354
cmp edi, eax
jae 0x427358
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x427346
cmp edi, eax
jb 0x42735c
xor eax, eax
jmp 0x427365
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x4274c1
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x497ae8], 0
jne 0x4274f1
push 0x475448
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4274ea
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x497aec], eax
mov byte [0x497ae8], 1
mov eax, dword [0x497aec]
test eax, eax
je 0x427509
push 0
push dword [esi + 4]
push dword [esp + 0xc]
push dword [esi]
call eax
jmp 0x427515
push dword [esp + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
ret 4
Function at 0x427518
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x48d190]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
push ecx
push dword [edi]
mov dword [ebp - 0x21c], ecx
xor esi, esi
or eax, 0x2001f
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
call fcn.0040c2f0
mov ebx, eax
cmp ebx, esi
je 0x427581
lea esi, [ebp - 0x214]
call fcn.0040c32e
mov eax, ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004465ad
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x42759f
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.00427518
cmp eax, esi
jne 0x4275e6
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call ebx
test eax, eax
je 0x427589
lea esi, [ebp - 0x214]
call fcn.0040c32e
push dword [ebp - 0x21c]
mov esi, edi
call fcn.004274c1
lea esi, [ebp - 0x214]
mov edi, eax
call fcn.0040c32e
mov eax, edi
jmp 0x427570

Function at 0x42781f
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
mov edi, eax
call fcn.0042777a
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
cmp dword [edi + 0x18], 8
lea ebx, [edi + 4]
jb 0x427846
mov eax, dword [ebx]
jmp 0x427848
mov eax, ebx
lea ecx, [ebp - 8]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 4], eax
test eax, eax
je 0x4278dd
push eax
call fcn.00445b86
mov dword [esi + 4], eax
cmp dword [edi + 0x18], 8
pop ecx
jb 0x42786f
mov ebx, dword [ebx]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4278dd
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x10]
push eax
push 0x46daec
push dword [esi + 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4278dd
lea eax, [ebp - 4]
push eax
lea edi, [esi + 8]
push edi
push str.VarFileInfoTranslation
push dword [esi + 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4278d4
mov eax, dword [ebp - 4]
cmp eax, 4
jb 0x4278d4
shr eax, 2
mov dword [esi + 0xc], eax
mov eax, dword [edi]
mov cx, word [eax]
mov word [esi], cx
mov ax, word [eax + 2]
mov word [esi + 2], ax
mov dword [ebp - 0xc], 1
jmp 0x4278ef
mov eax, dword [esi + 4]
test eax, eax
je 0x4278ef
push eax
call fcn.00446969
and dword [esi + 4], 0
pop ecx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x428cfd
Capabilities:
Delete registry key

Disassembly:
push 0x4c
mov eax, 0x4652fc
call fcn.0044aa09
test edi, edi
jne 0x428d38
push str.Attempt_to_delete_a_null_key
lea ecx, [ebp - 0x30]
call fcn.00407a73
and dword [ebp - 4], edi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0040127e
push 0x47faa0
lea eax, [ebp - 0x58]
push eax
call fcn.0044ab13
push edi
lea eax, [ebp - 0x30]
call fcn.00407b1d
cmp dword [eax + 0x14], 0
push 0
push 1
lea esi, [ebp - 0x30]
sete byte [ebp - 0xd]
call fcn.00409047
cmp byte [ebp - 0xd], 0
je 0x428d71
push str.Attempt_to_delete_an_empty_key
lea ecx, [ebp - 0x30]
call fcn.00407a73
mov dword [ebp - 4], 1
jmp 0x428d1d
push edi
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jge 0x428dab
lea eax, [ebp - 0x14]
push eax
call fcn.00428b0d
pop ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 2
push dword [eax]
push edi
push str.Failed_to_delete_key__S__S
call fcn.0040892e
add esp, 0xc
lea eax, [ebp - 0x14]
call fcn.0040e477
call fcn.0044aae1
ret

Function at 0x42941d
Capabilities:
Delete registry value

Disassembly:
push 0x24
mov eax, 0x4652c9
call fcn.0044aa09
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
push str.deleteCurVersionKeys
mov dword [ebp - 4], ebx
call fcn.0040892e
xor eax, eax
cmp byte [ebp + 8], bl
mov dword [esp], 0x46db78
sete al
lea ecx, [ebp - 0x14]
add eax, 0x80000001
push eax
mov eax, 0x20006
call fcn.0040c2f0
test eax, eax
jl 0x4294d1
push str.deleteCurVersionKeys___key_Opened
call fcn.0040892e
pop ecx
push dword [ebp + 0xc]
lea eax, [ebp - 0x30]
push eax
call fcn.00429325
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x42948a
mov eax, dword [eax + 4]
jmp 0x42948d
add eax, 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
push dword [ebp - 0x14]
call edi
push ebx
push 1
lea esi, [ebp - 0x30]
call fcn.00409047
push dword [ebp + 0xc]
lea eax, [ebp - 0x30]
push eax
call fcn.004293a1
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x4294bd
mov eax, dword [eax + 4]
jmp 0x4294c0
add eax, 4
push eax
push dword [ebp - 0x14]
call edi
push ebx
push 1
lea esi, [ebp - 0x30]
call fcn.00409047
lea esi, [ebp - 0x14]
call fcn.0040c32e
call fcn.0044aae1
ret
Function at 0x42a574
Capabilities:
Delete file

Disassembly:
push 0x2c
mov eax, 0x4650ee
call fcn.0044aa72
mov esi, ecx
push edi
mov ebx, str.deleteDesktopShortcut____S
push ebx
mov dword [ebp - 0x34], esi
call fcn.0040892e
xor esi, esi
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push 6
push eax
call fcn.0042b98c
add esp, 0x1c
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], esi
je 0x42a637
mov eax, dword [0x496ae4]
mov ecx, 0x496ae4
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x42a5d3
lea eax, [ebp - 0x28]
push edi
push eax
push str._s_s.lnk
lea eax, [ebp - 0x30]
call fcn.00422ec8
add esp, 0xc
push dword [ebp - 0x30]
call fcn.0042be58
pop ecx
test al, al
je 0x42a62f
push dword [ebp - 0x30]
mov esi, dword [ebp - 0x34]
push ebx
call fcn.0040892e
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
lea eax, [ebp - 0x30]
inc bl
call fcn.0040e477
xor esi, esi
push esi
push 1
lea esi, [ebp - 0x2c]
call fcn.00409047
mov al, bl
call fcn.0044aaf5
ret
lea eax, [ebp - 0x30]
call fcn.0040e477
xor bl, bl
jmp 0x42a61c

Function at 0x42a63b
Capabilities:
Delete file

Disassembly:
push 0x2c
mov eax, 0x4650ee
call fcn.0044aa72
mov eax, dword [ebp + 0xc]
push eax
mov edi, str.deleteProgramsShortcut____S
mov esi, ecx
push edi
mov dword [ebp - 0x34], eax
call fcn.0040892e
xor eax, eax
xor ebx, ebx
cmp byte [ebp + 8], bl
push 1
sete al
push ebx
push ebx
add eax, 3
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0042b98c
add esp, 0x1c
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x42a6e1
mov eax, dword [0x496ae4]
mov ecx, 0x496ae4
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x42a6a4
lea eax, [ebp - 0x28]
push dword [ebp - 0x34]
push eax
push str._s_s.lnk
lea eax, [ebp - 0x30]
call fcn.00422ec8
add esp, 0xc
push dword [ebp - 0x30]
call fcn.0042be58
pop ecx
test al, al
je 0x42a6d9
push dword [ebp - 0x30]
push edi
call fcn.0040892e
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x30]
call fcn.0040e477
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.00409047
call fcn.0044aaf5
ret
Function at 0x42ae97
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2898
call fcn.00459df0
mov eax, dword [0x48d190]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2898], 0
push esi
lea eax, [ebp - 0x2898]
push eax
lea eax, [ebp - 0x2894]
push eax
mov esi, ecx
mov dword [ebp - 0x2898], 0x2880
call sub.IPHLPAPI.DLL_GetAdaptersInfo
lea eax, [ebp - 0x2894]
mov ecx, dword [eax + 0x1a0]
cmp ecx, 6
je 0x42af17
cmp ecx, 0x47
je 0x42af17
mov eax, dword [eax]
test eax, eax
jne 0x42aedb
and dword [ebp - 0x14], eax
push edi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
push dword [ebp - 0x14]
push str._08X
call fcn.0042b5ba
pop ecx
pop ecx
pop edi
jmp 0x42af64
movzx ecx, byte [eax + 0x19b]
push ecx
movzx ecx, byte [eax + 0x19a]
push ecx
movzx ecx, byte [eax + 0x199]
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
push str._02x_02x_02x_02x_02x_02x_02x_02x
call fcn.0042b5ba
add esp, 0x24
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004465ad
leave
ret
Function at 0x42cd72
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x48d190]
xor eax, esp
mov dword [esp + 0x194], eax
push 0x497b0c
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x42cdb4
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push eax
push 0x497b10
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.004465ad
mov esp, ebp
pop ebp
ret

Function at 0x42cf68
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
push 0xffffffffffffffff
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x497af4
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0
push dword [esi + 4]
test eax, eax
je 0x42cfb0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
leave
ret
push method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_52
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
leave
ret
Function at 0x42cfc8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
xor edi, edi
push edi
push edi
push 1
push edi
call ebx
mov dword [esp + 8], eax
mov dword [esi + 4], eax
cmp eax, edi
jne 0x42d020
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
call fcn.004126fd
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
mov ecx, str.thread.entry_event
call fcn.0042cc19
pop ecx
push edi
push edi
push 1
push edi
call ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 8], eax
mov dword [esi + 8], eax
cmp dword [ebx + 8], edi
jne 0x42d068
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
call fcn.004126fd
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
mov ecx, str.thread.exit_event
call fcn.0042cc19
pop ecx
lea eax, [esp + 0x14]
push eax
push edi
push esi
push 0x42d0fe
push edi
push edi
mov dword [esp + 0x2c], edi
call fcn.0044956f
add esp, 0x18
mov dword [ebx + 4], eax
cmp eax, edi
jne 0x42d0da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
cmp dword [esp + 8], edi
je 0x42d0ab
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebx + 8]
cmp ebx, edi
je 0x42d0b9
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
call fcn.004126fd
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
mov ecx, str.thread
call fcn.0042cc19
pop ecx
cmp dword [esp + 8], edi
je 0x42d0f6
push 0xffffffffffffffff
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42d8bd
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
push edi
mov esi, eax
je 0x42d982
cmp byte [ebp + 0x10], 0
je 0x42d906
mov edi, dword [ebp + 0xc]
test byte [edi], 8
je 0x42d906
xor eax, eax
mov word [ebp - 8], ax
mov word [ebp - 6], ax
call fcn.004126fd
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov eax, edi
call fcn.0042dd35
pop ecx
pop ecx
mov edi, dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
call edi
push dword [ebp + 8]
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
call ebx
push eax
call fcn.004343b8
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x42d982
call fcn.004126fd
cmp dword [esi + 4], eax
jne 0x42d93b
cmp dword [esi], 0x2733
je 0x42d94d
call fcn.004126fd
cmp dword [esi + 4], eax
jne 0x42d97c
cmp dword [esi], 0x4d5
jne 0x42d97c
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x8004667e
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp + 0xc]
and byte [eax], 0xfc
push 0
call edi
push dword [ebp + 8]
call ebx
push eax
call fcn.004343b8
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42d98e
xor edi, edi
call fcn.004126fd
mov dword [esi], edi
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42d996
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, eax
cmp ebx, 0xffffffff
jne 0x42d9ac
mov edi, 0x2719
jmp 0x42d9cd
xor edi, edi
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.WS2_32.dll_connect]
push eax
call fcn.004343b8
pop ecx
test eax, eax
jne 0x42d9d7
call fcn.004126fd
mov dword [esi + 4], eax
mov dword [esi], edi
mov edi, 0x2734
call fcn.004126fd
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov ecx, esi
mov dword [ebp - 0xc], edi
call fcn.0042cbfa
test al, al
je 0x42da0f
dec edi
call fcn.004126fd
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov ecx, esi
mov dword [ebp - 0xc], edi
call fcn.0042cbfa
test al, al
jne 0x42da4a
mov eax, esi
mov ecx, ebx
call fcn.0042defd
test eax, eax
jl 0x42da4a
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push ebx
mov eax, esi
lea ecx, [ebp - 8]
mov dword [ebp - 8], 4
call fcn.0042dd98
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x42da4a
call fcn.004126fd
mov ecx, dword [ebp - 4]
mov dword [esi], ecx
mov dword [esi + 4], eax
pop edi
pop esi
leave
ret
Function at 0x42de09
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
mov edi, ecx
mov esi, eax
cmp edi, 0xffffffff
jne 0x42de32
mov edi, 0x2719
call fcn.004126fd
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
jmp 0x42de7e
xor ebx, ebx
push ebx
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0x110], 1
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x110]
push eax
inc edi
push edi
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.004343b8
mov edi, eax
pop ecx
cmp edi, ebx
je 0x42de72
jle 0x42de7c
call fcn.004126fd
mov dword [esi + 4], eax
mov dword [esi], ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42de83
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
mov edi, ecx
mov esi, eax
cmp edi, 0xffffffff
jne 0x42deac
mov edi, 0x2719
call fcn.004126fd
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
jmp 0x42def8
xor ebx, ebx
push ebx
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0x110], 1
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
push ebx
lea eax, [ebp - 0x110]
push eax
push ebx
inc edi
push edi
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.004343b8
mov edi, eax
pop ecx
cmp edi, ebx
je 0x42deec
jle 0x42def6
call fcn.004126fd
mov dword [esi + 4], eax
mov dword [esi], ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42defd
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
push edi
mov edi, ecx
mov esi, eax
cmp edi, 0xffffffff
jne 0x42df25
mov edi, 0x2719
call fcn.004126fd
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
jmp 0x42df7f
xor eax, eax
inc eax
push 0
mov dword [ebp - 0x208], edi
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x104], edi
mov dword [ebp - 0x108], eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
inc edi
push edi
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.004343b8
pop ecx
mov dword [ebp - 4], eax
test eax, eax
jl 0x42df7c
xor edi, edi
call fcn.004126fd
mov dword [esi], edi
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x432e85
Capabilities:
Resolve dns

Disassembly:
push 0x64
mov eax, 0x465ecc
call fcn.0044aa09
mov edi, ecx
lea eax, [ebp - 0x70]
xor ebx, ebx
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
call fcn.004338f3
mov esi, eax
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 1
call fcn.004338d8
cmp dword [esi + 0x18], 0x10
jb 0x432ec7
mov ecx, dword [esi + 4]
jmp 0x432eca
lea ecx, [esi + 4]
cmp dword [eax + 0x18], 0x10
jb 0x432ed5
mov esi, dword [eax + 4]
jmp 0x432ed8
lea esi, [eax + 4]
mov dword [ebp - 0x1c], ecx
cmp esi, ebx
je 0x432ee4
cmp byte [esi], 0
jne 0x432ee6
xor esi, esi
cmp ecx, ebx
je 0x432eef
cmp byte [ecx], 0
jne 0x432ef2
mov dword [ebp - 0x1c], ebx
push ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov ecx, eax
lea esi, [ebp - 0x20]
call fcn.0042df83
mov ecx, dword [eax]
mov dword [edi], ecx
mov eax, dword [eax + 4]
push ebx
push 1
lea ecx, [ebp - 0x54]
mov dword [edi + 4], eax
call fcn.00408daf
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.00408daf
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], esi
push 2
pop ebx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
neg eax
sbb eax, eax
test eax, fcn.004132ce
je 0x432f68
xor edi, edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], 1
jmp 0x432fb5
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp + 0xc]
call fcn.004338f3
mov edi, eax
lea eax, [ebp - 0x70]
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 4
mov dword [ebp - 0x14], ebx
call fcn.004338d8
mov dword [ebp - 4], 5
push dword [ebp - 0x18]
lea ecx, [ebp - 0x38]
push ecx
mov edx, edi
mov ecx, eax
mov dword [ebp - 0x14], 6
call fcn.0043390e
pop ecx
pop ecx
mov dword [ebp - 0x14], 0xe
xor edi, edi
mov edx, eax
mov eax, dword [ebp + 8]
call fcn.00431d58
or dword [ebp - 0x14], 0x10
test byte [ebp - 0x14], 8
je 0x432fd5
and dword [ebp - 0x14], 0xfffffff7
lea eax, [ebp - 0x34]
call fcn.00401940
test byte [ebp - 0x14], 4
je 0x432fea
and dword [ebp - 0x14], 0xfffffffb
push edi
push 1
lea ecx, [ebp - 0x70]
call fcn.00408daf
test byte [ebp - 0x14], bl
je 0x432ffe
and dword [ebp - 0x14], 0xfffffffd
push edi
push 1
lea ecx, [ebp - 0x54]
call fcn.00408daf
mov dword [ebp - 4], ebx
test byte [ebp - 0x14], 1
je 0x433013
and dword [ebp - 0x14], 0xfffffffe
lea eax, [ebp - 0x28]
call fcn.00401940
cmp esi, edi
je 0x43301e
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, dword [ebp + 8]
call fcn.0044aae1
ret 8