joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424e50
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x32c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov ebx, dword [edi + 0x4f8]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], eax
push ecx
mov eax, edi
mov dword [esp + 0x18], ebx
call fcn.00424dc0
mov edx, dword [ebp + 0xc]
xor esi, esi
add esp, 4
cmp eax, esi
mov dword [edx], esi
jg 0x424ea7
mov eax, dword [esp + 0x10]
push str.TFTP_response_timeout
call fcn.0040f9d0
add esp, 4
lea eax, [esi + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x18]
cmp ecx, 0xffffffff
je 0x424edb
mov eax, ebx
call fcn.00424910
cmp eax, esi
jne 0x425036
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp dword [ebx], 3
sete al
mov dword [ecx], eax
cmp eax, esi
je 0x425034
push esi
push esi
jmp 0x425020
mov ebx, dword [ebx + 0x14]
cmp ebx, 0xffffffff
je 0x425034
mov eax, 1
xor ecx, ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x128], eax
mov dword [esp + 0x230], ecx
lea edi, [ebx + 1]
jmp 0x424f1d
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x230]
xor esi, esi
lea edx, [esp + 0x18]
push edx
neg ecx
sbb ecx, ecx
lea edx, [esp + 0x12c]
push edx
lea edx, [esp + 0x238]
and ecx, edx
push ecx
neg eax
sbb eax, eax
lea ecx, [esp + 0x2c]
and eax, ecx
push eax
push edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
cmp esi, 0xffffffff
jne 0x424f73
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x424f10
cmp dword [0x77e3a4], 0
jne 0x424f73
cmp eax, 0x2714
je 0x424f10
test esi, esi
jl 0x424fad
je 0x425034
lea edx, [esp + 0x20]
push edx
push ebx
xor esi, esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x424f93
mov esi, 1
lea eax, [esp + 0x128]
push eax
push ebx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x424fa8
or esi, 4
cmp esi, 0xffffffff
jne 0x424fe7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp + 8]
push ecx
mov edi, eax
call fcn.00431bd0
add esp, 4
push eax
mov eax, dword [esp + 0x14]
push 0x71f628
call fcn.0040f9d0
mov edx, dword [esp + 0x1c]
add esp, 8
mov dword [edx + 0xc], 5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x425034
mov edi, dword [ebp + 8]
push edi
call fcn.00424ba0
add esp, 4
test eax, eax
jne 0x425036
mov esi, dword [esp + 0x14]
mov ecx, dword [esi + 0xc]
mov eax, esi
call fcn.00424910
test eax, eax
jne 0x425036
cmp dword [esi], 3
mov ecx, dword [ebp + 0xc]
sete al
mov dword [ecx], eax
test eax, eax
je 0x425034
push 0
push 0
push 0xffffffffffffffff
or ecx, 0xffffffff
push 0xffffffffffffffff
push edi
xor edx, edx
or eax, ecx
call fcn.00416530
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427d50
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
sub esp, 0x20
mov eax, dword [0x751f00]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
mov ebp, dword [esi]
push edi
mov edi, dword [esi + 0x1a4]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
push edi
or ebx, 0xffffffff
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x427da4
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
push edi
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov ebx, eax
cmp dword [esi + 0x38], 0
je 0x427dc5
cmp edi, dword [esi + 0x1a4]
jne 0x427e00
cmp dword [esi + 0x1b4], 0
je 0x427e00
mov dword [esi + 0x1b4], 0
push esi
call fcn.00404030
add esp, 4
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
cmp ebx, 0xffffffff
jne 0x427e18
push str.Error_accept__ing_server_connect
mov eax, ebp
call fcn.0040f9d0
add esp, 4
mov eax, 0x1e
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0055e7fd
add esp, 0x20
ret
push esi
call fcn.00404030
mov ecx, dword [esi + 0x3c]
mov edx, dword [esi + 0x38]
add esp, 4
push edi
push ecx
call edx
add esp, 8
jmp 0x427dd5
push str.Connection_accepted_from_server_n
mov ecx, ebp
call fcn.0040f940
add esp, 4
lea eax, [esp + 0x10]
push eax
push 0x8004667e
mov edi, 1
push ebx
mov dword [esi + 0x2c8], 0
mov dword [esi + 0x1a4], ebx
mov dword [esp + 0x1c], edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [esi + 0x1b4], edi
mov eax, dword [ebp + 0x1b0]
test eax, eax
je 0x427e8f
mov ecx, dword [ebp + 0x1b4]
push edi
push ebx
push ecx
call eax
add esp, 0xc
test eax, eax
je 0x427e8f
mov eax, esi
call fcn.00427c80
lea eax, [edi + 0x29]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0055e7fd
add esp, 0x20
ret
mov ecx, dword [esp + 0x24]
pop edi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0055e7fd
add esp, 0x20
ret
Function at 0x42a0a0
Capabilities:
Check http status code

Disassembly:
mov ecx, dword [edi]
mov eax, 0x51eb851f
imul ebx
sar edx, 5
mov eax, edx
push ebp
mov ebp, dword [esp + 8]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x42a0d5
push str.Couldnt_set_desired_mode
mov eax, ecx
call fcn.0040f9d0
add esp, 4
lea eax, [esi + 0x11]
pop esi
pop ebp
ret
cmp ebx, 0xc8
je 0x42a0eb
push ebx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.0040f940
add esp, 8
cmp ebp, 0x13
jne 0x42a0fe
push edi
call fcn.00428fe0
add esp, 4
mov esi, eax
pop esi
pop ebp
ret
cmp ebp, 0x14
jne 0x42a111
push edi
call fcn.00429070
add esp, 4
mov esi, eax
pop esi
pop ebp
ret
cmp ebp, 0x15
jne 0x42a128
push 0xd
push 1
push edi
call fcn.00429490
add esp, 0xc
mov esi, eax
pop esi
pop ebp
ret
cmp ebp, 0x16
jne 0x42a13c
push 0xe
push 1
push edi
call fcn.00429490
add esp, 0xc
mov esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x42cd10
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x19c
mov eax, dword [0x751f00]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x42cd46
push eax
push str.WSAStartup_failed___d_
mov eax, esi
call fcn.0040f9d0
add esp, 8
jmp 0x42cd80
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [esp]
cmp al, 2
jne 0x42cd71
shr eax, 8
test al, al
jne 0x42cd71
xor eax, eax
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.0055e7fd
add esp, 0x19c
ret
push str.insufficient_winsock_version_to_support_telnet
mov eax, esi
call fcn.0040f9d0
add esp, 4
mov ecx, dword [esp + 0x194]
xor ecx, esp
mov eax, 2
call fcn.0055e7fd
add esp, 0x19c
ret

Function at 0x42cf60
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov edx, dword [edi + 0x1a0]
mov al, byte [esp + 8]
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [esp + 0xc]
push ecx
push edx
mov byte [esp + 0x14], 0xff
mov byte [esp + 0x15], al
mov byte [esp + 0x16], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x42cfa5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
mov eax, esi
call fcn.0040f9d0
add esp, 8
mov esi, dword [esp + 0xc]
mov ecx, dword [edi]
push str.SENT
mov eax, ebx
call fcn.0042ce60
add esp, 4
pop esi
pop ecx
ret
Function at 0x42da10
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x914
mov eax, dword [0x751f00]
xor eax, esp
mov dword [esp + 0x90c], eax
push ebx
push ebp
push esi
push edi
push 0x7f
lea eax, [esp + 0x9d]
mov ebx, ecx
push 0
push eax
mov dword [esp + 0x20], ebx
mov byte [esp + 0xa4], 0
call fcn.0055e5f0
add esp, 0xc
push 0x7f
lea ecx, [esp + 0x1d]
push 0
push ecx
mov byte [esp + 0x24], 0
call fcn.0055e5f0
mov ebp, dword [ebx]
mov edi, dword [ebp + 0x128]
mov edx, dword [edi + 0x1eb4]
sub edx, dword [edi + 0x1eb0]
add esp, 0xc
add edx, 2
push edx
lea eax, [edi + 0x1cb0]
push 0x3c
mov esi, ebp
mov dword [esp + 0x18], ebp
call fcn.0042d3d0
mov eax, dword [edi + 0x1eb0]
movzx ecx, byte [eax]
inc eax
add esp, 8
mov dword [edi + 0x1eb0], eax
cmp ecx, 0x18
je 0x42dbf8
cmp ecx, 0x23
je 0x42dbd1
cmp ecx, 0x27
jne 0x42dc8b
push 0
push ecx
push 0xfa
push 0xff
push 0x723814
lea eax, [esp + 0x12c]
push 0x800
push eax
call fcn.0041e370
mov esi, dword [edi + 0x1cac]
add esp, 0x1c
mov ebp, 4
test esi, esi
je 0x42db66
nop
mov ebx, dword [esi]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42daf7
sub eax, edx
lea edi, [eax + ebp + 1]
cmp edi, 0x7fa
jae 0x42db5b
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x9c]
push edx
push str._127_____127s
push ebx
call fcn.00562348
add esp, 0x10
test eax, eax
je 0x42db5b
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0xa0]
push ecx
push 0
mov edx, 0x800
push str._c_s_c_s
sub edx, ebp
push edx
lea eax, [esp + ebp + 0x130]
push eax
call fcn.0041e370
add esp, 0x1c
mov ebp, edi
mov esi, dword [esi + 4]
test esi, esi
jne 0x42daf0
mov ebx, dword [esp + 0x14]
push 0xf0
push 0xff
mov ecx, 0x800
push 0x72383c
sub ecx, ebp
push ecx
lea edx, [esp + ebp + 0x128]
push edx
call fcn.0041e370
mov ecx, dword [ebx + 0x1a0]
add esp, 0x14
push 0
add ebp, 2
push ebp
lea eax, [esp + 0x120]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x42dbc4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov eax, dword [esp + 0x14]
push str.Sending_data_failed___d_
call fcn.0040f9d0
add esp, 8
mov esi, dword [esp + 0x10]
add ebp, 0xfffffffe
push ebp
jmp 0x42dc7a
lea ecx, [edi + 0x1c28]
mov eax, ecx
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42dbe0
push 0xf0
push 0xff
push ecx
push 0
push 0x23
jmp 0x42dc19
lea ecx, [edi + 0x1c08]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42dc03
push 0xf0
push 0xff
push ecx
push 0
push 0x18
push 0xfa
push 0xff
push str._c_c_c_c_s_c_c
lea edx, [esp + 0x138]
sub eax, esi
push 0x800
push edx
lea edi, [eax + 6]
call fcn.0041e370
mov ecx, dword [ebx + 0x1a0]
add esp, 0x28
push 0
push edi
lea eax, [esp + 0x120]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x42dc74
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
mov eax, ebp
call fcn.0040f9d0
add esp, 8
add edi, 0xfffffffe
mov esi, ebp
push edi
push 0x3e
lea eax, [esp + 0x122]
call fcn.0042d3d0
add esp, 8
mov ecx, dword [esp + 0x91c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0055e7fd
add esp, 0x914
ret
Function at 0x42dcb0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
mov eax, dword [esp + 8]
mov eax, dword [eax]
push ebx
push ebp
push esi
push edi
mov edi, dword [eax + 0x128]
mov dword [esp + 0x10], eax
jne 0x42ddf7
lea ebp, [edi + 0x1cb0]
lea esi, [edi + 0x1eb0]
mov dword [esi], ebp
cmp ebp, esi
jae 0x42dce8
mov byte [ebp], 0xff
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x42dcf3
mov byte [eax], 0xfa
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x42dcfe
mov byte [eax], 0x1f
inc dword [esi]
movzx ecx, word [edi + 0x1ca8]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
movzx edx, word [edi + 0x1caa]
push edx
movzx ebx, ax
call dword [sym.imp.WS2_32.dll_htons]
movzx ecx, ax
mov eax, dword [esi]
cmp eax, esi
jae 0x42dd2a
mov byte [eax], bl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x42dd34
mov byte [eax], bh
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x42dd3e
mov byte [eax], cl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x42dd48
mov byte [eax], ch
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x42dd53
mov byte [eax], 0xff
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x42dd5e
mov byte [eax], 0xf0
inc dword [esi]
mov eax, dword [esi]
mov ebx, dword [esp + 0x10]
mov ecx, eax
sub ecx, ebp
sub ecx, 2
push ecx
mov dword [edi + 0x1eb4], eax
mov dword [esi], ebp
lea eax, [edi + 0x1cb2]
push 0x3e
mov esi, ebx
call fcn.0042d3d0
mov esi, dword [esp + 0x20]
mov edx, dword [esi + 0x1a0]
add esp, 8
push 0
push 3
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_send]
push edx
call ebp
test eax, eax
jge 0x42ddb8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
mov eax, ebx
call fcn.0040f9d0
add esp, 8
lea eax, [edi + 0x1cb3]
push 4
push eax
call fcn.0042e300
mov ecx, dword [esi + 0x1a0]
add esp, 8
push 0
push 2
add edi, 0x1cb7
push edi
push ecx
call ebp
test eax, eax
jge 0x42ddf7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
mov eax, ebx
call fcn.0040f9d0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x42e950
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x751f00]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.0058e11a
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x42e9b5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x42e9b5
lea edx, [esp]
push edx
call dword [0x75ccd4]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0055e7fd
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.0055e7fd
add esp, 0x108
ret
Function at 0x4311c0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push esi
push str.kernel32
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x4311da
pop esi
pop ebx
pop ecx
ret
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadLibraryExA
push esi
call edi
mov ebp, eax
push 0x723dc4
push str.WS2_32.DLL
mov dword [esp + 0x18], ebp
call fcn.0056adf4
add esp, 8
test eax, eax
je 0x431230
test ebp, ebp
je 0x43121d
push 8
push 0
push str.WS2_32.DLL
call ebp
pop edi
pop ebp
pop esi
mov ebx, eax
pop ebx
pop ecx
ret
push str.WS2_32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop ebp
pop esi
mov ebx, eax
pop ebx
pop ecx
ret
test ebp, ebp
je 0x431256
push str.AddDllDirectory
push esi
call edi
test eax, eax
je 0x431256
push 0x800
push 0
push str.WS2_32.DLL
call ebp
pop edi
pop ebp
pop esi
mov ebx, eax
pop ebx
pop ecx
ret
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
push 0
call ebp
mov edi, eax
test edi, edi
je 0x431310
mov eax, str.WS2_32.DLL
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x431274
sub eax, edx
lea eax, [eax + edi + 1]
push eax
call dword [0x75ccc8]
mov esi, eax
add esp, 4
test esi, esi
je 0x431306
push edi
push esi
call ebp
test eax, eax
je 0x431306
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4312a0
sub eax, edx
mov ecx, 0x5c
mov word [eax + esi], cx
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4312b7
sub eax, edx
mov ecx, str.WS2_32.DLL
lea edx, [eax + esi]
sub edx, ecx
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x4312d0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4312fd
push 8
push 0
push esi
call eax
push esi
mov ebx, eax
call dword [0x75cccc]
add esp, 4
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
push esi
call dword [0x75cccc]
add esp, 4
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x431db0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
push ebx
push ebp
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [esp + 0x20]
push edx
push eax
push ecx
mov dword [esp + 0x18], ebx
xor ebp, ebp
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [esp + 0xc], eax
cmp eax, ebx
jne 0x431f50
push edi
mov edi, dword [esp + 0x14]
cmp edi, ebx
je 0x431f2e
push esi
cmp dword [edi + 4], 2
jne 0x431eab
cmp dword [edi + 0x18], ebx
je 0x431eab
mov eax, dword [edi + 0x10]
cmp eax, ebx
jbe 0x431eab
cmp eax, 0x10
jb 0x431eab
push 0x20
call dword [0x75ccc8]
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x431eb8
mov edx, dword [edi]
mov dword [esi], edx
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov edx, dword [edi + 0xc]
push 0x10
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x10
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
call dword [0x75ccc8]
add esp, 4
mov dword [esi + 0x18], eax
cmp eax, ebx
je 0x431ec2
mov ecx, dword [edi + 0x18]
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
mov eax, dword [edi + 0x14]
cmp eax, ebx
je 0x431e98
push eax
call dword [0x75ccd4]
add esp, 4
mov dword [esi + 0x14], eax
cmp eax, ebx
je 0x431ed6
cmp dword [esp + 0x10], ebx
jne 0x431ea2
mov dword [esp + 0x10], esi
cmp ebp, ebx
je 0x431ea9
mov dword [ebp + 0x1c], esi
mov ebp, esi
mov edi, dword [edi + 0x1c]
cmp edi, ebx
jne 0x431df3
jmp 0x431ef2
mov dword [esp + 0x14], 8
jmp 0x431ef2
push esi
mov dword [esp + 0x18], 8
call dword [0x75cccc]
add esp, 4
jmp 0x431ef2
mov edx, dword [esi + 0x18]
push edx
mov dword [esp + 0x18], 8
call dword [0x75cccc]
push esi
call dword [0x75cccc]
add esp, 8
mov eax, dword [esp + 0x18]
pop esi
cmp eax, ebx
je 0x431f02
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [esp + 0x10], ebx
je 0x431f28
mov eax, dword [esp + 0xc]
call fcn.00431d70
mov ecx, dword [esp + 0x24]
mov eax, ebx
pop edi
pop ebp
mov dword [esp + 4], ebx
mov dword [ecx], eax
mov eax, dword [esp + 8]
pop ebx
add esp, 0xc
ret
cmp dword [esp + 0xc], ebx
jne 0x431f41
push 0x2af9
mov dword [esp + 0x14], 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x432840
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
mov edx, dword [ecx + 0x1a0]
push 2
push 1
lea eax, [esp + 0xb]
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x4328b6
cmp eax, 1
jne 0x432867
mov eax, 1
pop ecx
ret
cmp eax, 0xffffffff
jne 0x4328ba
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2734
je 0x432860
cmp eax, 0xb
je 0x432860
cmp eax, 0x2733
je 0x432860
cmp eax, 0x2746
je 0x4328b6
cmp eax, 0x2745
je 0x4328b6
cmp eax, 0x2742
je 0x4328b6
cmp eax, 0x2744
je 0x4328b6
cmp eax, 0x274a
je 0x4328b6
cmp eax, 0x274c
je 0x4328b6
cmp eax, 0x2749
jne 0x4328ba
xor eax, eax
pop ecx
ret
or eax, 0xffffffff
pop ecx
ret
Function at 0x43b0a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, eax
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov eax, dword [eax + 0x1ec]
push edi
test eax, eax
jne 0x43b0c3
mov eax, dword [esi + 0x28]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov edi, edx
mov ebx, dword [esi + 0x20]
mov esi, dword [esi + 0x24]
shr edi, 6
mov edx, edi
imul edx, edx, 0x3e8
sub ecx, edx
imul ecx, ecx, 0x3e8
mov eax, ecx
push 0xffffffffffffffff
sub eax, esi
cdq
push 0xfffffc18
push edx
push eax
call fcn.0056a120
mov ebp, eax
mov eax, edi
sub eax, ebx
imul eax, eax, 0x3e8
mov esi, edx
cdq
sub ebp, eax
mov eax, dword [esp + 0x14]
sbb esi, edx
cdq
add ebp, eax
mov eax, dword [esp + 0x18]
adc esi, edx
cmp dword [eax + 0x1e0], 0
je 0x43b1b6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov eax, dword [esp + 0x1c]
mov edi, edx
shr edi, 6
mov edx, edi
imul edx, edx, 0x3e8
sub ecx, edx
mov edx, dword [eax + 0x190]
imul ecx, ecx, 0x3e8
mov dword [esp + 0x1c], edx
mov edx, dword [eax + 0x194]
mov eax, ecx
push 0xffffffffffffffff
sub eax, edx
cdq
push 0xfffffc18
push edx
push eax
call fcn.0056a120
mov ebx, eax
mov eax, edi
sub eax, dword [esp + 0x1c]
mov ecx, edx
imul eax, eax, 0x3e8
cdq
sub ebx, eax
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x1e0]
sbb ecx, edx
cdq
add ebx, eax
adc ecx, edx
cmp esi, ecx
jl 0x43b1b6
jg 0x43b1aa
cmp ebp, ebx
jb 0x43b1b6
mov eax, ebx
mov edx, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
pop edi
mov edx, esi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x43e330
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push 0xd4
mov ebx, eax
mov edi, ecx
call dword [0x75ccc8]
mov esi, eax
add esp, 4
test esi, esi
jne 0x43e355
pop edi
pop esi
pop ebx
add esp, 8
ret
lea eax, [esi + 0xc]
lea ecx, [eax + 0x5c]
mov dword [esi], fcn.0059b0c0
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
cmp ebx, 0x40
jbe 0x43e398
push eax
call dword [0x71d62c]
mov edx, dword [esi + 4]
push ebx
push edi
push edx
call dword [0x71d630]
mov edi, dword [esi + 8]
mov eax, dword [esi + 4]
push eax
add edi, 0x5c
push edi
call dword [0x71d634]
add esp, 0x18
mov ebx, 0x10
mov ecx, dword [esi + 4]
push ecx
call dword [0x71d62c]
mov edx, dword [esi + 8]
push edx
call dword [0x71d62c]
add esp, 8
xor eax, eax
test ebx, ebx
jbe 0x43e407
push ebp
mov ebp, ebx
mov dword [esp + 0x14], ebx
lea esp, [esp]
movzx eax, byte [edi]
xor al, 0x36
push 1
lea ecx, [esp + 0x17]
mov byte [esp + 0x17], al
mov edx, dword [esi + 4]
push ecx
push edx
call dword [0x71d630]
movzx eax, byte [edi]
xor al, 0x5c
push 1
lea ecx, [esp + 0x23]
mov byte [esp + 0x23], al
mov edx, dword [esi + 8]
push ecx
push edx
inc edi
call dword [0x71d630]
add esp, 0x18
sub ebp, 1
jne 0x43e3c0
pop ebp
cmp ebx, 0x40
jae 0x43e43a
mov eax, dword [esp + 0x10]
mov edi, 0x40
sub edi, eax
mov edi, edi
mov eax, dword [esi + 4]
push 1
push str.6_unzip_1.01_Copyright_1998_2004_Gilles_Vollant___http:__www.winimage.com_zLibDll
push eax
call dword [0x71d630]
mov ecx, dword [esi + 8]
push 1
push 0x71d621
push ecx
call dword [0x71d630]
add esp, 0x18
sub edi, 1
jne 0x43e410
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4427f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x80000000
jae 0x4428a6
mov dword [ebp - 8], 1
push 0x94
call fcn.0055e733
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4428a1
push 0x94
push 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.0055e5f0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword [ecx], 0x94
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 4
jne 0x442861
mov dword [ebp - 8], 5
jmp 0x442895
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 4], 5
jne 0x44287c
mov edx, dword [ebp - 0xc]
cmp dword [edx + 8], 0
jne 0x44287c
mov dword [ebp - 8], 6
jmp 0x442895
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 5
jne 0x442895
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 8], 1
jne 0x442895
mov dword [ebp - 8], 7
mov edx, dword [ebp - 0xc]
push edx
call fcn.0055e55d
add esp, 4
jmp 0x44294e
mov eax, dword [ebp - 4]
and eax, 0xffff
movzx ecx, ax
and ecx, 0xff
movzx edx, cl
cmp edx, 4
jge 0x4428cb
mov dword [ebp - 8], 0
jmp 0x44294e
mov dword [ebp - 8], 2
push 0x94
call fcn.0055e733
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x44294e
push 0x94
push 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.0055e5f0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword [ecx], 0x94
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 4
jne 0x442929
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 8], 0xa
jne 0x442929
mov dword [ebp - 8], 3
jmp 0x442942
mov edx, dword [ebp - 0xc]
cmp dword [edx + 4], 4
jne 0x442942
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0x5a
jne 0x442942
mov dword [ebp - 8], 4
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0055e55d
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret