joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4486e8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44888d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40f9d4]
call fcn.00402f28
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403b4c
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x448863
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004389e0
test al, al
je 0x448856
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44889c
lea eax, [ebp - 0x254]
call fcn.00409668
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x448856
xor eax, eax
push ebp
push 0x44884f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4488d4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x448838
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403d78
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x448838
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403d78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448856
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x448759
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.0041348c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448894
lea eax, [ebp - 0x260]
call fcn.00403b4c
ret
Function at 0x449198
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4491af
add esp, 0xfffffff0
call fcn.00403298
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004179dc
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40f4a8]
call fcn.00402f28
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x40f4a8]
call fcn.00402f28
mov dword [ebx + 0x90], eax
xor eax, eax
mov dword [ebx + 0x48], eax
xor eax, eax
mov dword [ebx + 0x6c], eax
mov dword [ebx + 0x44], 0x80000018
mov dword [ebx + 0x60], 0x1f4
mov byte [ebx + 0x64], 1
xor eax, eax
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x5c], 0x9c4
mov byte [ebx + 0x70], 0
mov byte [ebx + 0x85], 1
mov dl, 1
mov eax, dword [0x419808]
call fcn.004210e0
mov esi, eax
mov dword [ebx + 0x80], esi
push 0x449320
mov eax, dword [0x496730]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00421484
mov eax, dword [ebx + 0x80]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x44ac5c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x496730]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c954
test eax, eax
je 0x44929f
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408f80
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c97c
test eax, eax
je 0x4492b3
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x74]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403d78
mov eax, dword [0x4965a0]
cmp byte [eax], 0
jne 0x4492e4
mov eax, ebx
call fcn.0044940c
mov byte [ebx + 0x41], 1
mov byte [ebx + 0x42], 1
mov byte [ebx + 0x43], 1
mov byte [ebx + 0x86], 1
xor eax, eax
mov dword [ebx + 0x88], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x449316
call fcn.004032f0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x449668
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4977a8]
cmp dword [eax + 0x24], 0
je 0x4496f8
cmp dword [ebx + 0x7c], 0
jne 0x4496f5
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4495fc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x78]
cmp dword [eax + 8], 0
je 0x4496f5
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4496c4
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x78]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4496f5
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x78]
call fcn.00410edc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4496d0
inc dword [ebx + 0x7c]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x44a048
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x8c], 0
je 0x44a07d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403c30
jmp 0x44a087
mov eax, esi
mov edx, dword [ebx + 0x74]
call fcn.00403be4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44af8c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x44afc4
mov eax, esi
call fcn.00434764
test al, al
je 0x44afc4
mov eax, dword [ebx + 0x6c]
call fcn.0043433c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44afc4
push 0
mov eax, dword [ebx + 0x6c]
call fcn.0043433c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x4513b0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4513de
mov eax, ebx
call fcn.00451e54
cmp dword [ebx + 0x3c], 0
je 0x4513d7
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x45144f
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x451441
cmp dword [ebx + 8], 0
je 0x451400
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x451412
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x451441
cmp dword [ebx + 8], 0
je 0x4513f3
cmp eax, 3
je 0x451425
dec eax
jne 0x4513f3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4513f3
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x4513f3
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x45146d
cmp dword [ebx + 0x10], 0xcc
je 0x45146d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00451478
pop ebx
ret

Function at 0x478eef
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x496256
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x478f47
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x496277
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x478f3d
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x478f4b
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x49373c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f7c
mov eax, dword [ebp - 8]
call fcn.00403f7c
mov eax, dword [ebp - 0xc]
call fcn.00403f7c
xor eax, eax
push ebp
push 0x49380b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x493824
call fcn.00403dd0
lea eax, [ebp - 8]
mov edx, 0x493824
call fcn.00403dd0
lea eax, [ebp - 0xc]
mov edx, 0x493824
call fcn.00403dd0
mov bl, 1
push 1
lea eax, [ebp - 0xc]
call fcn.00403f98
push eax
lea eax, [ebp - 8]
call fcn.00403f98
push eax
lea eax, [ebp - 4]
call fcn.00403f98
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jae 0x4937f0
xor ebx, ebx
push 0
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, 0x493830
call fcn.00403e14
mov eax, dword [ebp - 0x10]
mov cx, word [0x493844]
mov dl, 1
call fcn.0044e270
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493812
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403b70
ret
Function at 0x4056a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x4056d2
jl 0x4056c5
test ecx, ecx
jne 0x4056d2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x405792
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00407b90
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x40573e
jg 0x4056fd
test esi, esi
je 0x40573e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x405715
mov eax, dword [esp + 0x10]
jl 0x40570f
cmp eax, esi
jae 0x405715
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.0043c080
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x40575f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x40577b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x4056e4
jl 0x40577b
test ecx, ecx
jne 0x4056e4
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov esi, dword [ebp + 0x10]
sbb esi, edx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x4057d0
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x4057d0
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.0043c080
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x405839
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x4057f6
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x405824
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.00443189
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x405839
cmp edi, eax
ja 0x405802
test edi, edi
je 0x405839
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.00443189
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406170
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46126c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4780c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0
mov dword [ebx], 0x4735f4
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x84], 0
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], 0
mov dword [ebx + 0x90], 0
mov dword [ebx + 0x94], 0
mov dword [ebx + 0x98], 0
mov dword [ebx + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebx + 0xa0], 0
mov dword [ebx + 0xa4], 0
mov byte [ebx + 0xa8], 0
push 0
push 0
lea esi, [ebx + 4]
mov dword [ebp - 4], 0
push esi
mov dword [ebp - 0x18], 1
call fcn.00407bb0
mov dword [ebp - 4], 1
lea edi, [esi + 0x28]
mov eax, dword [ebx]
mov dword [ebp - 0x14], esi
push 8
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + ebx - 4], eax
lea eax, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [edi], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0043a801
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov byte [ebp - 4], 2
call fcn.00438297
mov ecx, ebx
mov dword [esi + 4], eax
add esp, 8
mov dword [ecx + 0x38], esi
lea ecx, [ecx + 4]
call fcn.00408800
mov eax, ebx
lea esi, [eax + 8]
mov dword [eax + 4], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [eax + 0x10], esi
lea edx, [eax + 0xc]
mov esi, ebx
mov byte [eax + 0x4c], 0
lea ecx, [eax + 0x18]
mov byte [eax + 0x41], 0
mov dword [eax + 0x14], edx
mov dword [eax + 0x20], ecx
lea eax, [esi + 0x1c]
mov dword [esi + 0x24], eax
lea ebx, [esi + 0x28]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], edi
mov esi, dword [ebp - 0x14]
mov dword [edx], 0
mov dword [eax], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [ecx], 0
mov dword [ebx], 0
mov ebx, dword [ebp - 0x10]
mov eax, ebx
mov dword [ebx + 0x50], 0
mov ecx, dword [0x47a220]
mov edx, dword [0x47a224]
mov dword [ebx + 0x44], ecx
mov dword [ebx + 0x48], edx
mov dword [ebx + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x408860
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460f80
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4780c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.0043a801
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00438297
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00408800
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b800
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4619b2
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x4780c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x228], edi
xorps xmm0, xmm0
mov dword [ebp - 0x224], 0
xor eax, eax
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21c]
push 0x104
push eax
mov dword [ebp - 0x224], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40ba25
mov edx, dword [edi + 0x14]
cmp eax, edx
ja 0x40b8d4
mov dword [ebp - 0x220], edi
mov ecx, edi
cmp edx, 7
jbe 0x40b8af
mov ecx, dword [edi]
mov dword [ebp - 0x220], ecx
lea esi, [eax + eax]
mov dword [edi + 0x10], eax
push esi
lea eax, [ebp - 0x21c]
push eax
push ecx
call fcn.0043c080
mov eax, dword [ebp - 0x220]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax], cx
jmp 0x40b8e9
lea ecx, [ebp - 0x21c]
push ecx
push dword [ebp - 0x228]
mov ecx, edi
push eax
call fcn.0040c070
push 0x473604
lea ecx, [ebp - 0x258]
call fcn.00406650
push 4
sub esp, 0xc
mov dword [ebp - 4], 1
mov ecx, eax
call fcn.0040bed0
push eax
mov edx, edi
lea ecx, [ebp - 0x240]
call fcn.0040c350
mov esi, eax
add esp, 4
cmp edi, esi
je 0x40b98c
mov ecx, dword [edi + 0x14]
cmp ecx, 7
jbe 0x40b95c
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x40b952
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba42
mov eax, edx
push ecx
push eax
call fcn.0043a836
add esp, 8
mov dword [edi + 0x10], 0
xor eax, eax
mov dword [edi + 0x14], 7
mov word [edi], ax
movups xmm0, xmmword [esi]
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov ecx, dword [ebp - 0x22c]
cmp ecx, 7
jbe 0x40b9cc
mov edx, dword [ebp - 0x240]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40b9c2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba42
push ecx
push edx
call fcn.0043a836
add esp, 8
mov ecx, dword [ebp - 0x244]
xor eax, eax
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 7
mov word [ebp - 0x240], ax
cmp ecx, 7
jbe 0x40ba25
mov edx, dword [ebp - 0x258]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40ba1b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba42
push ecx
push edx
call fcn.0043a836
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a7f3
mov esp, ebp
pop ebp
ret
call fcn.0043fb2f
int3
Function at 0x41c630
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x104
mov eax, dword [0x4780c0]
xor eax, esp
mov dword [esp + 0x100], eax
mov ecx, dword [esp + 0x10c]
push ebx
push ebp
mov ebp, dword [esp + 0x110]
push esi
mov esi, dword [esp + 0x124]
push edi
mov eax, dword [ebp + 0xc]
mov edi, dword [esp + 0x120]
push ecx
push eax
mov ebx, dword [eax + ecx*4 + 0x148]
push ebp
call fcn.0041caa0
add esp, 0xc
test eax, eax
je 0x41c688
mov dword [esi], 0x1b
or eax, 0xffffffff
jmp 0x41c6ed
push 0
push dword [esp + 0x128]
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
mov dword [esi], 0
cmp edi, 0xffffffff
jne 0x41c6eb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x2733
jne 0x41c6c0
xor edi, edi
mov dword [esi], 0x51
jmp 0x41c6eb
push 0x100
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00432380
push eax
push str.Send_failure:__s
push ebp
call fcn.0041c2f0
mov dword [ebp + 0x954], ebx
add esp, 0x18
mov dword [esi], 0x37
mov eax, edi
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043a7f3
add esp, 0x104
ret

Function at 0x41caa0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push ebx
push esi
lea esi, [edx + 0x17]
mov eax, dword [ecx + 0x298]
mov ebx, dword [ecx + edx*4 + 0x148]
shl esi, 4
add esi, ecx
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x44], 3
je 0x41cb55
cmp dword [ecx + edx*4 + 0x160], 0x41c550
jne 0x41cb55
cmp dword [esi], 0
je 0x41cae6
test edi, edi
je 0x41cb55
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.00428860
add esp, 0x14
cmp eax, 0xffffffff
je 0x41cb55
test al, 1
je 0x41cb55
cmp dword [esi], 0
jne 0x41cb3e
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x4e8]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [section..data]
add esp, 4
mov dword [esi], eax
test eax, eax
jne 0x41cb2d
pop edi
pop esi
mov eax, 0x1b
pop ebx
ret
mov edi, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x41cb55
add dword [esi + 8], eax
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x41cf00
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
mov eax, dword [0x4780c0]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
mov ebx, dword [esp + 0x190]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [esp + 0x1a4]
push 0x80
push 0
push eax
mov dword [esp + 0x18], 0x80
call fcn.0043bf20
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1a4]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x41cf87
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.00432380
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x41cfc8
push edi
push esi
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
call fcn.0041cb60
add esp, 0x10
test al, al
jne 0x41cfd1
call fcn.0044387c
mov esi, eax
call fcn.0044387c
mov edi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push dword [esi]
call fcn.00432380
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.0041c2f0
add esp, 0x1c
mov ecx, dword [esp + 0x190]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043a7f3
add esp, 0x188
ret

Function at 0x41d700
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
mov eax, dword [0x479314]
mov dword [esp + 4], 0x4020
mov dword [esp], 0
mov dword [esp + 8], 4
test eax, eax
jne 0x41d751
push 3
push 2
push eax
push eax
push 6
call fcn.00433180
add esp, 0x14
test al, al
je 0x41d745
mov dword [0x479314], 2
add esp, 0xc
ret
mov dword [0x479314], 1
jmp 0x41d756
cmp eax, 2
je 0x41d79c
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x41d781
mov eax, dword [esp]
cmp eax, dword [esp + 4]
jg 0x41d79c
push 4
lea eax, [esp + 8]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 0xc
ret