joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4273d0
Capabilities:
Enumerate devices by category

Disassembly:
sub esp, 0x2c
push ebx
push ebp
mov ebp, dword [esp + 0x40]
push esi
push edi
lea eax, [esp + 0x20]
push eax
push 0x4b8aac
xor ebx, ebx
push 1
push ebx
push 0x4b8a0c
xor edi, edi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x427577
mov eax, dword [esp + 0x20]
push ebx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], ebx
mov ecx, dword [eax]
push 0x4b8a1c
push eax
mov eax, dword [ecx + 0xc]
call eax
mov esi, eax
cmp esi, ebx
jne 0x427560
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x4c]
push edx
mov dword [esp + 0x50], ebx
mov ecx, dword [eax]
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x427550
cmp edi, ebx
jne 0x427550
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x44]
jne 0x42752c
mov eax, dword [esp + 0x48]
mov edx, dword [eax]
mov edx, dword [edx + 0x24]
lea ecx, [esp + 0x18]
push ecx
push 0x4b8b6c
push ebx
push ebx
push eax
call edx
mov esi, eax
cmp esi, ebx
jl 0x42752c
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push ebx
lea edx, [esp + 0x2c]
push edx
push str.FriendlyName
push eax
mov eax, dword [ecx + 0xc]
call eax
mov esi, eax
cmp esi, ebx
jl 0x427501
mov edi, dword [esp + 0x30]
movzx eax, word [edi]
xor esi, esi
cmp ax, bx
je 0x4274e2
movzx edx, ax
xor eax, eax
mov ecx, edi
mov word [eax + ebp], dx
mov cl, byte [ecx]
mov edx, dword [esp + 0x4c]
mov byte [esi + edx], cl
inc esi
lea eax, [esi + esi]
movzx edx, word [eax + edi]
lea ecx, [eax + edi]
cmp dx, bx
jne 0x4274c5
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push edx
push 0x4b8acc
push ebx
push ebx
push eax
mov eax, dword [ecx + 0x20]
call eax
mov esi, eax
mov edi, 1
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], ebx
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x48], ebx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
inc dword [esp + 0x1c]
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x4c]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
je 0x427450
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
cmp edi, ebx
jne 0x427577
mov eax, 0x80040216
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
Function at 0x4277c0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x1c
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4277e2
or eax, 0xffffffff
add esp, 0x1c
ret
lea ecx, [esp + 0xc]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 4]
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x80020003
push 0x12
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
dec eax
add esp, 0x1c
ret

Function at 0x427840
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push ebp
push esi
push edi
call fcn.00448d10
test al, al
je 0x427876
call fcn.00448c60
test al, al
jne 0x427876
push 1
push str._adminlockwingamma
call fcn.004484d0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x28]
xor eax, eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x18]
push 0xf003f
xor eax, eax
xor esi, esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionICM_
mov dword [esp + 0x20], eax
push reloc.WSOCK32.dll_bind
lea eax, [esp + 0x2c]
push eax
mov edx, str.GdiICMGammaRange
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], esi
call fcn.00455560
push 0xf013f
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionICM_
push reloc.WSOCK32.dll_bind
lea ecx, [esp + 0x1c]
push ecx
mov edx, str.GdiICMGammaRange
mov edi, eax
call fcn.00455560
mov ebp, eax
mov eax, dword [esp + 0x2c]
cmp eax, esi
je 0x4278f1
add eax, 4
jmp 0x4278f3
xor eax, eax
mov edx, dword [esp + 0x20]
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push eax
push 0x4cb498
push edx
call ebx
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x427913
add eax, 4
jmp 0x427915
xor eax, eax
push eax
mov eax, dword [esp + 0x14]
push 0x4cb498
push eax
call ebx
cmp edi, esi
jne 0x427946
cmp ebp, esi
jne 0x427946
lea edi, [esp + 0x10]
call fcn.004554e0
lea edi, [esp + 0x20]
call fcn.004554e0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [esp + 0x10]
call fcn.004554e0
lea edi, [esp + 0x20]
call fcn.004554e0
pop edi
or eax, 0xffffffff
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427a70
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [esp + 0x14]
push ebx
push esi
push edi
xor eax, eax
push 0xf003f
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
push eax
xor ebx, ebx
push closesocket
lea ecx, [esp + 0x24]
push ecx
mov edx, str.Data
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], ebx
call fcn.00455560
test eax, eax
je 0x427ac8
lea edi, [esp + 0x18]
call fcn.004554e0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 0x800
call fcn.0045f460
mov esi, eax
mov eax, dword [esp + 0x24]
mov edi, esi
neg edi
sbb edi, edi
and edi, 0x800
cmp eax, ebx
je 0x427aed
add eax, 4
jmp 0x427aef
xor eax, eax
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x1c]
push esi
lea ecx, [esp + 0x1c]
push ecx
push ebx
push eax
push edx
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
test ebx, ebx
jne 0x427b84
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 0xc]
cmp edx, ecx
je 0x427b42
test edi, edi
je 0x427b2d
test esi, esi
je 0x427b2d
call fcn.0045f5a0
lea edi, [esp + 0x18]
call fcn.004554e0
mov eax, 0xf4242
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub ecx, dword [ebp + 0x10]
cmp ecx, 0x14
jbe 0x427b5e
lea eax, [esi + 0x14]
add ecx, 0xffffffec
mov ebx, dword [ebp + 0x10]
mov bl, byte [eax + ebx]
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x427b50
mov eax, dword [esp + 0x24]
sub edx, dword [ebp + 0x10]
test eax, eax
je 0x427b6e
add eax, 4
jmp 0x427b70
xor eax, eax
push edx
push esi
push 3
push 0
push eax
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
test edi, edi
je 0x427b91
test esi, esi
je 0x427b91
call fcn.0045f5a0
lea edi, [esp + 0x18]
call fcn.004554e0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427bb0
Capabilities:
Contain obfuscated stackstrings
Set registry value

Disassembly:
sub esp, 0x50
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [esp + 8]
push ebx
push esi
push edi
push 0xf003f
xor eax, eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionCloudStoreStoreDefaultAccountCurrentdefault_windows.data.bluelightreduction.settingswindows.data.bluelightreduction.settings_
mov dword [esp + 0x1c], eax
xor ebx, ebx
push closesocket
lea eax, [esp + 0x18]
push eax
mov edx, str.Data
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
call fcn.00455560
test eax, eax
je 0x427c19
lea edi, [esp + 0xc]
call fcn.004554e0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0049ceb0
add esp, 0x50
ret
mov cl, 0x42
mov al, 0x2a
mov dl, 6
mov byte [esp + 0x1d], cl
mov byte [esp + 0x24], al
mov byte [esp + 0x2b], al
mov al, 0xe
mov byte [esp + 0x30], cl
mov cl, 0xca
push ebx
mov byte [esp + 0x20], 0x43
mov byte [esp + 0x22], 1
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], 0xa
mov byte [esp + 0x25], 2
mov byte [esp + 0x26], 1
mov byte [esp + 0x27], bl
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], 0xe7
mov byte [esp + 0x2b], 0xb2
mov byte [esp + 0x2c], 0xb5
mov byte [esp + 0x2d], 0x9f
mov byte [esp + 0x2e], dl
mov byte [esp + 0x30], 0x2b
mov byte [esp + 0x31], al
mov byte [esp + 0x32], 0x21
mov byte [esp + 0x33], 0x43
mov byte [esp + 0x35], 1
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], cl
mov byte [esp + 0x38], 0x14
mov byte [esp + 0x39], al
mov byte [esp + 0x3a], 0x15
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], cl
mov byte [esp + 0x3d], 0x1e
mov byte [esp + 0x3e], al
mov byte [esp + 0x3f], 7
mov byte [esp + 0x40], bl
mov byte [esp + 0x41], 0xcf
mov byte [esp + 0x42], 0x28
mov byte [esp + 0x43], 0xc4
mov byte [esp + 0x44], 0x35
mov byte [esp + 0x45], cl
mov byte [esp + 0x46], 0x32
mov byte [esp + 0x47], al
mov byte [esp + 0x48], 0x13
mov byte [esp + 0x49], 0x2e
mov byte [esp + 0x4a], 0x11
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4c], cl
mov byte [esp + 0x4d], 0x3c
mov byte [esp + 0x4e], al
mov byte [esp + 0x4f], dl
mov byte [esp + 0x50], 0x2e
mov byte [esp + 0x51], 0x26
mov byte [esp + 0x52], bl
mov byte [esp + 0x53], bl
mov byte [esp + 0x54], bl
mov byte [esp + 0x55], bl
mov byte [esp + 0x56], bl
call fcn.0049d8e4
mov edx, eax
shr edx, 7
mov cl, al
or cl, 0x80
or dl, 0x80
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2b], dl
mov ecx, eax
mov edx, eax
shr ecx, 0xe
shr edx, 0x15
or cl, 0x80
or dl, 0x80
shr eax, 0x1c
add esp, 4
and al, 0x7f
mov byte [esp + 0x28], cl
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], al
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x427d67
add eax, 4
jmp 0x427d69
xor eax, eax
mov edx, dword [esp + 0xc]
push 0x37
lea ecx, [esp + 0x20]
push ecx
push 3
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edi, [esp + 0xc]
mov esi, eax
call fcn.004554e0
mov ecx, dword [esp + 0x54]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0049ceb0
add esp, 0x50
ret
Function at 0x427f80
Capabilities:
Set registry value

Disassembly:
sub esp, 0x30
push ebx
push esi
push edi
call fcn.00427e20
test al, al
jle 0x4280c6
mov eax, dword [esp + 0x20]
xor eax, eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x30]
push 0xf013f
xor eax, eax
xor edi, edi
push str.SYSTEMControlSet001ControlClass4d36e968_e325_11ce_bfc1_08002be103180000
mov dword [esp + 0x38], eax
push reloc.WSOCK32.dll_bind
lea eax, [esp + 0x24]
push eax
mov edx, str.FeatureTestControl
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x44], edi
call fcn.00455560
push 0xf013f
push str.SYSTEMControlSet001ControlClass4d36e968_e325_11ce_bfc1_08002be103180001
push reloc.WSOCK32.dll_bind
lea ecx, [esp + 0x34]
push ecx
mov edx, str.FeatureTestControl
mov esi, eax
call fcn.00455560
mov ebx, eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], 4
cmp esi, edi
jne 0x428071
lea edx, [esp + 0x10]
push edx
lea esi, [esp + 0x18]
lea ecx, [esp + 0x1c]
call fcn.004556e0
test eax, eax
jne 0x428071
mov eax, dword [esp + 0x24]
or dword [esp + 0x10], 0x10
cmp eax, edi
je 0x428039
add eax, 4
jmp 0x42803b
xor eax, eax
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 4
push edi
push eax
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edi, [esp + 0x28]
mov esi, eax
call fcn.004554e0
lea edi, [esp + 0x18]
call fcn.004554e0
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x30
ret
cmp ebx, edi
jne 0x4280b4
lea ecx, [esp + 0x10]
push ecx
lea esi, [esp + 0x18]
lea ecx, [esp + 0x2c]
call fcn.004556e0
test eax, eax
jne 0x4280b4
mov eax, dword [esp + 0x24]
or dword [esp + 0x10], 0x10
cmp eax, edi
je 0x42809d
add eax, 4
jmp 0x42809f
xor eax, eax
mov edx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push 4
push edi
push eax
push edx
jmp 0x42804e
lea edi, [esp + 0x28]
call fcn.004554e0
lea edi, [esp + 0x18]
call fcn.004554e0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x30
ret

Function at 0x42c240
Capabilities:
Create thread

Disassembly:
sub esp, 8
push ebx
push esi
xor ebx, ebx
lea esi, [edi + 0x28]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebx
call fcn.004023f0
lea esi, [edi + 0x40]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebx
call fcn.004023f0
lea esi, [edi + 0x58]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebx
call fcn.004023f0
cmp byte [esp + 0x14], bl
je 0x42c2c4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x5670b0]
je 0x42c29e
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov ecx, edi
call edx
xor eax, eax
pop esi
pop ebx
add esp, 8
ret 4
lea esi, [edi + 0x10]
push esi
mov dword [edi + 4], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
push ebx
push 0x43cff0
call fcn.0049dc4e
add esp, 0xc
push esi
mov dword [edi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 4
Function at 0x42e660
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x1a4
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x19c], eax
cmp dword [esi], 0
jne 0x42e6e5
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x42e6e5
cmp dword [esi], eax
jne 0x42e6a6
push 0x11
push 2
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [esi], eax
test eax, eax
jge 0x42e6be
mov dword [esi], 0
or eax, 0xffffffff
mov ecx, dword [esp + 0x19c]
xor ecx, esp
call fcn.0049ceb0
add esp, 0x1a4
ret
push 4
lea ecx, [esp + 8]
push ecx
push 0x20
push 0xffff
push eax
mov dword [esp + 0x18], 1
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
je 0x42e6a6
mov dword [esi], 0
mov ecx, dword [esp + 0x19c]
xor ecx, esp
xor eax, eax
call fcn.0049ceb0
add esp, 0x1a4
ret
Function at 0x42e990
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [sym.imp.WSOCK32.dll_inet_addr]
pxor xmm0, xmm0
push str.239.255.255.250
movq qword [esp + 8], xmm0
mov dword [esp + 0x10], 0
call esi
push str.0.0.0.0
mov dword [esp + 8], eax
call esi
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x28]
push 0xc
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push eax
push 0xf
push 0
push edx
call dword [sym.imp.WSOCK32.dll_setsockopt]
pop esi
add esp, 0xc
ret 4

Function at 0x42e9f0
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header
Set socket configuration

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x14], eax
cmp dword [esi + 0x28], 0
jne 0x42ea16
or eax, 0xffffffff
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0049ceb0
add esp, 0x1c
ret
pxor xmm0, xmm0
push str.239.255.255.250
movq qword [esp + 8], xmm0
movq qword [esp + 0x10], xmm0
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [esp + 8], eax
mov eax, 2
push 0x7be
mov word [esp + 8], ax
call dword [sym.imp.WSOCK32.dll_htons]
mov word [esp + 6], ax
mov eax, str.M_SEARCH__HTTP_1.1_r_nHOST:_239.255.255.250:1982_r_nMAN:__ssdp:discover__r_nST:_wifi_bulb_r_n
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42ea57
push 0x10
lea ecx, [esp + 8]
push ecx
push 0
sub eax, edx
mov edx, dword [esi + 0x28]
push eax
push str.M_SEARCH__HTTP_1.1_r_nHOST:_239.255.255.250:1982_r_nMAN:__ssdp:discover__r_nST:_wifi_bulb_r_n
push edx
call dword [sym.imp.WSOCK32.dll_sendto]
mov ecx, dword [esp + 0x14]
xor ecx, esp
xor eax, eax
call fcn.0049ceb0
add esp, 0x1c
ret

Function at 0x42ebf0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x14], eax
cmp dword [esi + 0x20], 0
jne 0x42ec16
or eax, 0xffffffff
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0049ceb0
add esp, 0x1c
ret
mov eax, dword [esi + 0x34]
test eax, eax
je 0x42ec04
add eax, 4
je 0x42ec04
cmp byte [eax], 0
je 0x42ec04
pxor xmm0, xmm0
mov eax, 2
movq qword [esp + 4], xmm0
mov word [esp + 4], ax
mov eax, dword [esi + 0x34]
movq qword [esp + 0xc], xmm0
test eax, eax
je 0x42ec4d
add eax, 4
jmp 0x42ec4f
xor eax, eax
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
movzx ecx, word [esi + 0x20]
push ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.WSOCK32.dll_htons]
push 0
push 1
push 2
mov word [esp + 0x12], ax
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [esi + 0x1c], eax
test eax, eax
jl 0x42ec04
push 0x10
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
xor ecx, ecx
test eax, eax
setge cl
dec ecx
mov eax, ecx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0049ceb0
add esp, 0x1c
ret
Function at 0x42f840
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x1b4
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x1ac], eax
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x42f911
lea eax, [esp + 0x18]
push eax
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x42f887
xor eax, eax
mov ecx, dword [esp + 0x1ac]
xor ecx, esp
call fcn.0049ceb0
add esp, 0x1b4
ret
push 0x11
push 2
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [esi + 0x28], eax
test eax, eax
jge 0x42f8b9
mov dword [esi + 0x28], 0
or eax, 0xffffffff
mov ecx, dword [esp + 0x1ac]
xor ecx, esp
call fcn.0049ceb0
add esp, 0x1b4
ret
push 4
lea ecx, [esp + 8]
push ecx
push 4
push 0xffff
push eax
mov dword [esp + 0x18], 1
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x42f8a1
mov ecx, dword [esi + 0x28]
push 0x10
lea eax, [esp + 0xc]
pxor xmm0, xmm0
push eax
mov edx, 2
movq qword [esp + 0x10], xmm0
push ecx
movq qword [esp + 0x1c], xmm0
mov word [esp + 0x14], dx
call dword [sym.imp.WSOCK32.dll_bind]
cmp eax, 0xffffffff
je 0x42f8a1
push esi
call fcn.0042e990
mov ecx, dword [esp + 0x1ac]
xor ecx, esp
call fcn.0049ceb0
add esp, 0x1b4
ret

Function at 0x42f930
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x1a4
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x19c], eax
mov eax, dword [0x56703c]
test eax, eax
jne 0x42f9c2
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x42f985
cmp dword [0x56703c], eax
jne 0x42f9bd
push 0x11
push 2
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [0x56703c], eax
test eax, eax
jge 0x42f99c
mov dword [0x56703c], 0
xor eax, eax
mov ecx, dword [esp + 0x19c]
xor ecx, esp
call fcn.0049ceb0
add esp, 0x1a4
ret
push 4
lea ecx, [esp + 8]
push ecx
push 0x20
push 0xffff
push eax
mov dword [esp + 0x18], 1
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
jne 0x42f97b
mov eax, dword [0x56703c]
mov ecx, dword [esp + 0x19c]
xor ecx, esp
call fcn.0049ceb0
add esp, 0x1a4
ret
Function at 0x42f9e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x34], eax
cmp dword [0x56703c], 0
push esi
push edi
je 0x42fbf9
pxor xmm0, xmm0
movdqa xmmword [esp + 0x20], xmm0
mov eax, 2
push 0x1796
mov word [esp + 0x24], ax
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.WSOCK32.dll_htons]
cmp dword [0x56703c], 0
mov word [esp + 0x22], ax
je 0x42fbf9
xorps xmm1, xmm1
movsd xmm2, qword [0x4bab50]
mov ecx, 0x19c8
sub ecx, dword [ebp + 8]
cvtsi2sd xmm0, ecx
divsd xmm0, qword [0x4d3af8]
comisd xmm1, xmm0
movsd qword [esp + 8], xmm0
jbe 0x42fa6f
movsd qword [esp + 8], xmm1
jmp 0x42fa7b
comisd xmm0, xmm2
jbe 0x42fa7b
movsd qword [esp + 8], xmm2
mov edi, 0x18
call fcn.0045f460
mov esi, eax
test esi, esi
jne 0x42fa8f
xor edi, edi
jmp 0x42faa1
pxor xmm0, xmm0
movq qword [esi], xmm0
movq qword [esi + 8], xmm0
movq qword [esi + 0x10], xmm0
movsd xmm1, qword [0x4c88e8]
movsd xmm0, qword [esp + 8]
comisd xmm1, xmm0
mov dword [esi], 0x4adc0104
mov edx, 2
mov word [esi + 4], dx
mov eax, 0x101
mov word [esi + 6], ax
mov dword [esi + 0x10], 0xffffffff
jbe 0x42fae6
mulsd xmm0, qword [0x4d3af0]
mulsd xmm0, qword [0x4c3fb8]
jmp 0x42fafa
subsd xmm0, xmm1
mulsd xmm0, qword [0x4d3ae8]
addsd xmm0, qword [0x4d3af0]
fld qword [ebp + 0xc]
movsd qword [esp + 8], xmm0
fld qword [0x4d3ae0]
call fcn.004b23e0
fst qword [esp + 0x10]
fld qword [0x4bab50]
movsd xmm0, qword [esp + 0x10]
fsub qword [esp + 8]
mulsd xmm0, qword [esp + 8]
divsd xmm0, qword [0x4d3ad8]
movsd xmm1, qword [0x4bab50]
comisd xmm0, xmm1
fmulp st(1)
movsd qword [esp + 8], xmm0
fstp qword [esp + 0x18]
jbe 0x42fb50
movsd qword [esp + 8], xmm1
movsd xmm0, qword [esp + 0x18]
comisd xmm0, xmm1
jbe 0x42fb62
movsd qword [esp + 0x18], xmm1
fld qword [esp + 8]
fld qword [0x4d3ad0]
call fcn.004b23e0
fmul qword [0x4d35b0]
fstp dword [esp + 8]
fld dword [esp + 8]
fistp dword [esp + 0x10]
mov cl, byte [esp + 0x10]
fld qword [esp + 0x18]
fld qword [0x4d3ad0]
mov byte [esi + 0x15], cl
call fcn.004b23e0
fmul qword [0x4d35b0]
fstp dword [esp + 8]
fld dword [esp + 8]
fistp dword [esp + 0x10]
mov ecx, dword [0x56703c]
mov dl, byte [esp + 0x10]
push 0x10
lea eax, [esp + 0x24]
push eax
push 0
push edi
push esi
push ecx
mov byte [esi + 0x16], dl
mov byte [esi + 0x17], 0
call dword [sym.imp.WSOCK32.dll_sendto]
cmp eax, 0xffffffff
jne 0x42fbf0
test edi, edi
je 0x42fbdc
call fcn.0045f5a0
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0049ceb0
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x42fbf9
call fcn.0045f5a0
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0049ceb0
mov esp, ebp
pop ebp
ret