joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418747
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 4], 0
mov byte [ebp - 0x20], 0x49
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x61
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x53
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x63
mov byte [ebp - 0x13], 0x75
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xe], 0x44
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x69
mov byte [ebp - 8], 0x70
mov byte [ebp - 7], 0x74
mov byte [ebp - 6], 0x6f
mov byte [ebp - 5], 0x72
call fcn.004187fc
lea eax, [ebp - 0x20]
push eax
push dword [0x4322cc]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4187dc
leave
ret
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1d
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.00415bae
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x418851
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 7], 0
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x53
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x63
mov byte [ebp - 0x1a], 0x75
mov byte [ebp - 0x19], 0x72
mov byte [ebp - 0x18], 0x69
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x79
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0x11], 0x72
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x63
mov byte [ebp - 8], 0x6c
call fcn.004187fc
lea eax, [ebp - 0x20]
push eax
push dword [0x4322cc]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4188da
leave
ret
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1d
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.00415bae
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x418900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 1
pop edi
xor ebx, ebx
cmp dword [0x4322e4], edi
mov byte [ebp - 0x14], 0x5c
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x5c
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xf], 0x44
mov byte [ebp - 0xe], 0x53
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x56
mov byte [ebp - 0xa], 0x58
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
jne 0x41897c
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00417bed
add esp, 0x1c
cmp eax, 0xffffffff
mov dword [0x4322e4], eax
jne 0x41897c
mov eax, 0x7532
jmp 0x418a33
cmp dword [0x4322d4], ebx
jne 0x4189d9
xor esi, esi
push dword [ebp + 0x10]
push 0x4322e4
push dword [ebp + 8]
call fcn.00418a95
add esp, 0xc
cmp eax, ebx
je 0x4189b5
cmp eax, 0x6688
jne 0x4189c1
push 0x1f4
call fcn.00418a38
inc esi
pop ecx
cmp esi, 3
jl 0x418986
cmp esi, 3
jne 0x4189d9
mov esi, 0x4f1a
jmp 0x4189c3
mov esi, eax
push dword [0x4322e4]
call fcn.00417d16
pop ecx
mov dword [0x4322e4], edi
mov eax, esi
jmp 0x418a33
push dword [ebp + 8]
push dword [ebp + 0x10]
call fcn.00415c42
lea eax, [ebp - 4]
push ebx
push eax
push 0x80
push dword [ebp + 0xc]
push 0x90
push dword [ebp + 8]
push 5
push dword [0x4322e4]
call fcn.00417c78
add esp, 0x28
test eax, eax
je 0x418a1c
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.00417f05
pop ecx
pop ecx
jmp 0x418a33
push dword [0x4322e4]
call fcn.00417d16
pop ecx
mov dword [0x4322e4], edi
call fcn.00417d8f
pop edi
pop esi
pop ebx
leave
ret

Function at 0x418e09
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4322e4]
push ebx
xor ebx, ebx
cmp eax, 1
mov byte [ebp - 0x14], 0x5c
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x5c
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xf], 0x44
mov byte [ebp - 0xe], 0x53
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x56
mov byte [ebp - 0xa], 0x58
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
jne 0x418e7f
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00417bed
add esp, 0x1c
cmp eax, 0xffffffff
mov dword [0x4322e4], eax
jne 0x418e7f
mov eax, 0x7532
jmp 0x418ecd
lea ecx, [ebp - 4]
push ebx
push ecx
push 0x80
push dword [ebp + 0xc]
push 0x90
push dword [ebp + 8]
push 5
push eax
call fcn.00417c78
add esp, 0x20
test eax, eax
je 0x418eb2
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.00417f05
pop ecx
pop ecx
jmp 0x418ecd
push dword [0x4322e4]
call fcn.00417d16
pop ecx
mov dword [0x4322e4], 1
call fcn.00417d8f
pop ebx
leave
ret
Function at 0x41993b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00415bae
and byte [ebp - 0xa], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x65
call fcn.00415bdd
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x419993
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00415bae
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x4199b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00415bae
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x41
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x6f
call fcn.00415bdd
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x419a0c
leave
ret
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00415bae
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x419a2c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 4], 0
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x12], 0x44
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0x1d], 0x75
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0x1b], 0x44
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 0x19], 0x44
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 9], 0x6f
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 8], 0x4c
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 7], 0x69
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 6], 0x73
mov byte [ebp - 0x13], 0x79
mov byte [ebp - 5], 0x74
call fcn.00419adf
test eax, eax
je 0x419abe
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x419ac2
xor eax, eax
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1d
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.00415bae
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x419adf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00415bae
and byte [ebp - 8], 0
add esp, 0xc
cmp dword [0x4322c4], 1
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x11], 0x75
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 9], 0x6c
jne 0x419b41
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4322c4], eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00415bae
mov eax, dword [0x4322c4]
add esp, 0xc
leave
ret

Function at 0x419b58
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and byte [ebp - 1], 0
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 4], 0x63
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x13], 0x75
mov byte [ebp - 0xb], 0x49
mov byte [ebp - 3], 0x65
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 2], 0x73
mov byte [ebp - 0x19], 0x75
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x17], 0x44
mov byte [ebp - 0xf], 0x76
mov byte [ebp - 7], 0x72
mov byte [ebp - 0x16], 0x69
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x15], 0x45
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 5], 0x61
call fcn.00419adf
test eax, eax
je 0x419be6
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x419bea
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1c
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.00415bae
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x419c13
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and byte [ebp - 4], 0
mov byte [ebp - 0x18], 0x53
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 6], 0x73
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x11], 0x47
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 5], 0x41
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 0x15], 0x75
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 9], 0x44
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 7], 0x76
call fcn.00419adf
test eax, eax
je 0x419c8a
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, fcn.00419c13
test ecx, ecx
jne 0x419c8e
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x15
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.00415bae
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x419d4b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and byte [ebp - 4], 0
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x18], 0x76
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x21], 0x75
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x20], 0x70
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 8], 0x61
mov byte [ebp - 0x1f], 0x44
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 7], 0x69
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 6], 0x6c
mov byte [ebp - 0x1d], 0x47
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 5], 0x41
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0xd], 0x63
call fcn.00419adf
test eax, eax
je 0x419ded
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x419df1
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x21
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.00415bae
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x41a140
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x104
mov al, byte [0x432e30]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x14], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x15]
push 0x100
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x18]
push ecx
stosb byte es:[edi], al
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x41a1d5
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
mov dword [esp + 0x10], esi
je 0x41a1d5
mov edi, dword [esp + 0x11c]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
xor ebx, ebx
mov eax, dword [esi + 0xc]
mov eax, dword [eax + ebx]
test eax, eax
je 0x41a1d5
mov ecx, dword [eax]
push ecx
call ebp
xor ecx, ecx
test edi, edi
jle 0x41a1cd
mov esi, dword [esp + 0x118]
mov edx, dword [esi]
test edx, edx
jbe 0x41a1c1
cmp edx, eax
je 0x41a1e2
inc ecx
add esi, 4
cmp ecx, edi
jl 0x41a1b7
mov esi, dword [esp + 0x10]
add ebx, 4
cmp ebx, 0x40
jl 0x41a19b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x104
ret
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x104
ret

Function at 0x41ddf1
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x14]
mov ecx, edi
call fcn.00422700
test al, al
jne 0x41de7d
mov al, byte [esi + 0xa58]
test al, al
jne 0x41de51
call sub.KERNEL32.dll_GetTickCount
cmp dword [esi + 0xa50], eax
jbe 0x41de24
mov dword [esi + 0xa50], 0
mov edx, dword [esi + 0xa50]
mov ecx, eax
sub ecx, edx
cmp ecx, 0x7d0
jbe 0x41de51
lea edx, [esp + 0xb]
push 1
push edx
push 0x73
mov ecx, edi
mov byte [esp + 0x17], 0
mov dword [esi + 0xa50], eax
call fcn.00420190
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
push eax
push ecx
push edx
lea ecx, [esi + 0x220]
call fcn.00421410
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x24]
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0x298], eax
pop edi
xor eax, eax
pop esi
pop ecx
ret 0x1c
Function at 0x41e380
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov al, byte [esi + 0x29c]
xor ebx, ebx
test al, al
mov byte [esp + 0x28], 0
mov dword [esp + 0x14], edi
mov byte [esp + 0x24], 0
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
jne 0x41e4f5
mov al, byte [esi + 0x1e8]
test al, al
je 0x41e4f5
mov eax, dword [esi + 0x23c]
cmp eax, edi
mov dword [esp + 0x10], eax
jbe 0x41e4dd
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x24]
push ecx
lea eax, [esp + 0x2c]
push edx
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x24]
push ecx
lea eax, [esp + 0x3c]
push edx
push eax
lea ecx, [esi + 0x220]
mov dword [esp + 0x2c], edi
call fcn.00421630
test al, al
je 0x41e4c7
call sub.KERNEL32.dll_GetTickCount
lea edi, [esi + 0x27c]
mov ebp, eax
mov ecx, edi
call fcn.0040aa30
mov ecx, dword [esi + 0x278]
test ecx, ecx
je 0x41e452
mov eax, dword [esp + 0x18]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
add eax, 0xc
push eax
call dword [edx]
mov ecx, edi
call fcn.0040aa40
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004034e0
add esp, 4
call sub.KERNEL32.dll_GetTickCount
mov edx, dword [esi + 0x224]
mov edi, dword [esp + 0x18]
sub eax, ebp
test ebx, ebx
jne 0x41e47d
mov ebx, edi
mov ecx, edi
sub ecx, eax
sub ecx, ebx
cmp edx, 0x64
mov ebx, edi
jl 0x41e497
mov eax, dword [esp + 0x1c]
lea edi, [edx + edx]
cmp eax, edi
jb 0x41e4a9
jmp 0x41e4a5
mov eax, dword [esp + 0x1c]
cmp eax, 0x64
jb 0x41e4a9
mov edx, 0x64
sub edx, eax
add ecx, edx
cmp ecx, 0x12c
jle 0x41e4b8
mov ecx, 0x12c
jmp 0x41e4bc
test ecx, ecx
jle 0x41e4c5
push ecx
call fcn.0040a030
add esp, 4
xor edi, edi
mov eax, dword [esi + 0x228]
cmp eax, edi
jle 0x41e4e7
push eax
push 0x11
mov ecx, esi
call fcn.0041e1b0
jmp 0x41e4e7
push 1
call fcn.0040a030
add esp, 4
mov al, byte [esi + 0x29c]
test al, al
je 0x41e3b5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4233b0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call fcn.00423360
test eax, eax
jne 0x4233d2
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret
lea esi, [ebp + 0x60]
mov ecx, 0x41
lea edi, [esp + 0x1c]
xor bl, bl
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push 0
push 0
inc eax
push edx
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x423419
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret
mov al, byte [ebp + 0x14]
test al, al
je 0x42342d
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret
lea edi, [ebp + 0x28]
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0040aa30
mov eax, dword [ebp + 0x1c]
mov esi, dword [eax]
cmp esi, eax
je 0x4234c9
mov ecx, dword [0x4333c8]
mov edi, dword [esi + 0x10]
test edi, edi
je 0x42348e
mov ecx, edi
call fcn.00423d30
test al, al
jne 0x423488
mov ecx, edi
call fcn.00423da0
cmp eax, 0xffffffff
je 0x423488
lea ecx, [esp + 0x1c]
push ecx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x423488
mov ecx, edi
call fcn.00423db0
test al, al
je 0x423488
mov bl, 1
mov ecx, dword [0x4333c8]
mov eax, dword [esi + 8]
cmp eax, ecx
je 0x4234a7
mov esi, eax
mov eax, dword [esi]
cmp eax, ecx
je 0x4234c0
mov esi, eax
mov eax, dword [esi]
cmp eax, ecx
jne 0x42349d
jmp 0x4234c0
mov eax, dword [esi + 4]
cmp esi, dword [eax + 8]
jne 0x4234b9
mov esi, eax
mov eax, dword [eax + 4]
cmp esi, dword [eax + 8]
je 0x4234af
cmp dword [esi + 8], eax
je 0x4234c0
mov esi, eax
cmp esi, dword [ebp + 0x1c]
jne 0x42344e
mov edi, dword [esp + 0x10]
mov ecx, edi
call fcn.0040aa40
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0x110
ret
Function at 0x423b30
Capabilities:
Get socket status

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call fcn.00423360
test eax, eax
jne 0x423b52
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret
lea esi, [ebp + 0x44]
mov ecx, 0x41
lea edi, [esp + 0x1c]
lea edx, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x14]
xor bl, bl
push ecx
push 0
push edx
inc eax
push 0
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x423b99
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret
mov al, byte [ebp + 0x14]
test al, al
je 0x423bad
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret
lea edi, [ebp + 0x28]
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0040aa30
mov eax, dword [ebp + 0x1c]
mov esi, dword [eax]
cmp esi, eax
je 0x423c49
mov ecx, dword [0x4333c8]
mov edi, dword [esi + 0x10]
test edi, edi
je 0x423c0e
mov ecx, edi
call fcn.00423d30
test al, al
jne 0x423c08
mov ecx, edi
call fcn.00423da0
cmp eax, 0xffffffff
je 0x423c08
lea ecx, [esp + 0x1c]
push ecx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x423c08
mov ecx, edi
call fcn.00423ce0
test al, al
je 0x423c08
mov bl, 1
mov ecx, dword [0x4333c8]
mov eax, dword [esi + 8]
cmp eax, ecx
je 0x423c27
mov esi, eax
mov eax, dword [esi]
cmp eax, ecx
je 0x423c40
mov esi, eax
mov eax, dword [esi]
cmp eax, ecx
jne 0x423c1d
jmp 0x423c40
mov eax, dword [esi + 4]
cmp esi, dword [eax + 8]
jne 0x423c39
mov esi, eax
mov eax, dword [eax + 4]
cmp esi, dword [eax + 8]
je 0x423c2f
cmp dword [esi + 8], eax
je 0x423c40
mov esi, eax
cmp esi, dword [ebp + 0x1c]
jne 0x423bce
mov edi, dword [esp + 0x10]
mov ecx, edi
call fcn.0040aa40
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0x110
ret

Function at 0x429290
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x4292b7
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x429350
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 8], eax
je 0x4292c1
mov ecx, dword [esi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 8]
xor eax, eax
test ecx, ecx
mov byte [esi + 0x10], 0
pop esi
setne al
ret
Function at 0x429380
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
sub esp, 0x1c
push esi
push edi
mov esi, ecx
push 0
mov word [esp + 0x18], 2
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x11
push 2
push 2
mov word [esp + 0x22], ax
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4293c9
mov dword [esi], eax
pop edi
xor al, al
pop esi
add esp, 0x1c
ret 4
lea ecx, [esp + 0x14]
push 0x10
push ecx
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x4293e6
pop edi
xor al, al
pop esi
add esp, 0x1c
ret 4
mov eax, dword [esi]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea edx, [esp + 0x28]
push 4
push edx
push 0x1006
push 0xffff
push eax
mov dword [esp + 0x3c], 0
call edi
test eax, eax
je 0x429418
pop edi
xor al, al
pop esi
add esp, 0x1c
ret 4
mov edx, dword [esi]
lea ecx, [esp + 8]
push 4
push ecx
push 0x1002
push 0xffff
push edx
mov dword [esp + 0x1c], 0x10000
call edi
test eax, eax
je 0x429444
pop edi
xor al, al
pop esi
add esp, 0x1c
ret 4
mov ecx, dword [esi]
lea eax, [esp + 0xc]
push 4
push eax
push 3
push 0
push ecx
mov dword [esp + 0x20], 0xb0
call edi
mov ecx, dword [esi]
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push ecx
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov edx, dword [esp + 0x16]
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esi + 4], ax
pop edi
mov al, 1
pop esi
add esp, 0x1c
ret 4

Function at 0x4294c0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, ecx
cmp dword [edi], 0xffffffff
je 0x429533
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword [esp + 8], eax
push ecx
mov dword [esp + 0x10], eax
mov word [esp + 0xc], 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_htonl]
mov edx, dword [esp + 0x28]
mov dword [esp + 0xc], eax
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [edi]
mov word [esp + 0xa], ax
lea eax, [esp + 8]
push 0x10
push eax
push 0
push esi
push ecx
push edx
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, esi
je 0x429533
push esi
push eax
push 0x432e1c
call fcn.004241b0
add esp, 0xc
pop edi
pop esi
add esp, 0x10
ret 0x10

Function at 0x429540
Capabilities:
Get hostname
Resolve dns

Disassembly:
mov eax, dword [ecx]
sub esp, 0x100
cmp eax, 0xffffffff
jne 0x429556
xor eax, eax
add esp, 0x100
ret
lea eax, [esp]
push 0x100
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x429573
xor eax, eax
add esp, 0x100
ret
lea ecx, [esp]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x429589
add esp, 0x100
ret
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
add esp, 0x100
ret