joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50c103
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0050bf82
Function at 0x40bb70
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4d3438
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x51501c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x5c]
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x30]
lea esi, [edi + edi + 2]
cmp esi, ebx
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], edi
jge 0x40bc12
lea ecx, [esi + esi*4]
lea eax, [ebp + ecx*8]
lea edx, [eax - 0x28]
push edx
push eax
call dword [esp + 0x1c]
add esp, 8
test al, al
je 0x40bbd7
sub esi, 1
lea eax, [esi + esi*4]
lea ecx, [edi + edi*4]
lea ebx, [ebp + eax*8]
lea edi, [ebp + ecx*8]
push ebx
mov ecx, edi
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov edx, dword [ebx + 0x1c]
mov dword [edi + 0x1c], edx
mov eax, dword [ebx + 0x20]
mov dword [edi + 0x20], eax
mov ecx, dword [ebx + 0x24]
mov dword [edi + 0x24], ecx
mov edi, esi
lea esi, [esi + esi + 2]
cmp esi, dword [esp + 0x30]
jl 0x40bbbd
mov ebx, dword [esp + 0x30]
cmp esi, ebx
jne 0x40bc40
lea edx, [ebx + ebx*4]
lea eax, [edi + edi*4]
lea esi, [ebp + edx*8 - 0x28]
lea edi, [ebp + eax*8]
push esi
mov ecx, edi
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov ecx, dword [esi + 0x1c]
mov dword [edi + 0x1c], ecx
mov edx, dword [esi + 0x20]
mov dword [edi + 0x20], edx
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
lea edi, [ebx - 1]
mov ecx, dword [esp + 0x14]
push ecx
sub esp, 0x28
mov esi, esp
lea edx, [esp + 0x60]
mov dword [esp + 0x40], esp
push edx
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov eax, dword [esp + 0x7c]
mov dword [esi + 0x1c], eax
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x44]
mov dword [esi + 0x20], ecx
mov edx, dword [esp + 0x84]
push eax
push ebp
mov ecx, edi
mov dword [esi + 0x24], edx
call fcn.0040bcb0
add esp, 0x34
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4124e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d570e
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x51501c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x38], ebx
mov ecx, esi
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov dword [esp + 0x38], ebx
cmp dword [0x53c2c4], ebx
mov dword [esp + 8], 1
jne 0x412552
push 0x38
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov dword [esp + 0x38], 1
je 0x41254e
push eax
call fcn.004191c0
mov byte [esp + 0x38], bl
mov ecx, dword [0x53c2c4]
lea eax, [esp + 0x14]
push eax
call fcn.00419240
push eax
mov ecx, esi
mov dword [esp + 0x3c], 2
call dword [0x4d7254]
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], bl
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x34
ret
Function at 0x413460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x18], 8
jb 0x41347b
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret

Function at 0x413500
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x51501c]
xor eax, esp
mov dword [esp + 0x20c], eax
lea ecx, [esp]
push ecx
xor eax, eax
push 0x901c
mov dword [esp + 8], eax
push eax
mov dword [esp + 0xc], eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x41355f
mov eax, dword [esp]
push ebx
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov ecx, dword [esp + 4]
cmp eax, 1
push ecx
sete bl
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test bl, bl
pop ebx
je 0x41355f
lea edx, [esp + 4]
push edx
jmp 0x413564
push 0x4e6424
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov ecx, dword [esp + 0x20c]
xor ecx, esp
mov eax, esi
call fcn.00459ea4
add esp, 0x210
ret
Function at 0x4137f0
Capabilities:
Create directory
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4d303c
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x51501c]
xor eax, esp
mov dword [esp + 0x40], eax
push esi
mov eax, dword [0x51501c]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
lea esi, [esp + 0x2c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.00413500
mov dword [esp + 0x54], 1
cmp dword [esp + 0x40], 0
je 0x4138ae
push 0x53bcd0
lea eax, [esp + 0x14]
push 0x4e6624
push eax
call dword [sym.imp.MSVCP80.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::operator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___wchar_t_const___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
add esp, 0xc
push eax
mov ecx, esi
mov byte [esp + 0x58], 2
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [esp + 0x10]
mov byte [esp + 0x54], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [esp + 0x30]
mov esi, 8
cmp dword [esp + 0x44], esi
jae 0x41388b
lea eax, [esp + 0x30]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [esp + 0x44], esi
mov eax, dword [esp + 0x30]
jae 0x4138a2
lea eax, [esp + 0x30]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x4e6624
lea ecx, [esp + 0x30]
push ecx
push edi
call dword [sym.imp.MSVCP80.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::operator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___wchar_t_const__]
add esp, 0xc
lea ecx, [esp + 0x2c]
mov dword [esp + 8], 1
mov byte [esp + 0x54], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, edi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00459ea4
add esp, 0x50
ret
Function at 0x413900
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x51501c]
xor eax, esp
mov dword [esp + 0x804], eax
cmp dword [edi + 0x18], 0x10
push esi
mov esi, ecx
jb 0x413922
mov eax, dword [edi + 4]
jmp 0x413925
lea eax, [edi + 4]
push eax
push 0x4da460
lea eax, [esp + 0x10]
push 0x800
push eax
call dword [sym.imp.MSVCR80.dll_sprintf_s]
mov eax, 8
add esp, 0x10
cmp dword [esi + 0x18], eax
jb 0x41394d
mov esi, dword [esi + 4]
jmp 0x413950
add esi, 4
cmp dword [ebx + 0x18], eax
jb 0x41395a
mov eax, dword [ebx + 4]
jmp 0x41395d
lea eax, [ebx + 4]
push esi
push eax
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.MSVCR80.dll__wfopen_s]
mov eax, dword [esp + 0x10]
add esp, 0xc
test eax, eax
pop esi
je 0x413996
mov edx, dword [edi + 0x14]
push eax
push edx
lea eax, [esp + 0xc]
push 1
push eax
call dword [sym.imp.MSVCR80.dll_fwrite]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 0x14
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.00459ea4
add esp, 0x808
ret

Function at 0x4152c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d3de4
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x51501c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], edi
mov dword [esp + 0x14], edi
lea ecx, [esi + 0x14]
mov dword [esi], 0x4e6ba8
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
mov dword [esi + 0x10], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x4c], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x41c650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d1d39
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x51501c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::_Lockit::constructor_int_]
mov dword [esp + 0x28], 0
mov eax, dword [0x53c2cc]
mov ecx, dword [sym.imp.MSVCP80.dll_class_std::locale::id_std::ctype_char_::id]
mov dword [esp + 0xc], eax
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::locale::id::operator_unsigned_int_void_]
mov ecx, dword [esp + 0x30]
push eax
call dword [sym.imp.MSVCP80.dll_public:_class_std::locale::facet_const____thiscall_std::locale::_Getfacet_unsigned_int_const]
mov esi, eax
test esi, esi
jne 0x41c704
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x41c704
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.MSVCP80.dll_public:_static_unsigned_int___cdecl_std::ctype_char_::_Getcat_class_std::locale::facet_const___]
add esp, 4
cmp eax, 0xffffffff
jne 0x41c6e8
push str.FM_rT
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCR80.dll_public:_void___thiscall_std::bad_cast::constructor_char_const__]
push 0x500b5c
lea edx, [esp + 0x18]
push edx
call fcn.004c7af0
mov ecx, dword [esp + 0xc]
mov esi, ecx
mov dword [0x53c2cc], ecx
mov edi, ecx
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::locale::facet::_Incref_void_]
mov ecx, edi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::locale::facet::_Register_void_]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x4216c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d2c98
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x51501c]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [0x51501c]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov esi, ecx
push esi
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x28]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esi + 0x2c]
mov dword [esp + 0x30], edx
mov edx, dword [esi + 0x30]
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0x34]
mov dword [esp + 0x38], ecx
mov ecx, dword [esi + 0x38]
mov dword [esp + 0x3c], edx
mov edx, dword [esi + 0x3c]
mov dword [esp + 0x40], eax
mov eax, dword [esi + 0x40]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], eax
mov edi, ebx
mov dword [esp + 0x5c], 0
call fcn.00420fd0
lea edi, [esp + 0xc]
mov esi, ebx
call fcn.00420fd0
mov ecx, edi
mov dword [esp + 0x5c], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00459ea4
add esp, 0x54
ret
Function at 0x424d00
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x51501c]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x424d53
mov ax, word [esp]
cmp al, 2
jne 0x424d4d
cmp ah, al
jne 0x424d4d
xor eax, eax
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.00459ea4
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x194]
xor ecx, esp
mov eax, 2
call fcn.00459ea4
mov esp, ebp
pop ebp
ret

Function at 0x427760
Capabilities:
Get socket status

Disassembly:
sub esp, 0x328
push ebx
push ebp
xor ebx, ebx
cmp edi, 0xffffffff
push esi
mov eax, 1
je 0x42781f
mov ebp, dword [sym.imp.WS2_32.dll_select]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x124], edi
mov dword [esp + 0x120], eax
mov dword [esp + 0x228], ebx
lea esi, [edi + 1]
nop
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x124]
push ecx
lea edx, [esp + 0x230]
push edx
lea eax, [esp + 0x24]
push eax
push esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call ebp
cmp eax, 0xffffffff
jne 0x4277ea
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, ebx
je 0x4277a0
cmp eax, 0x2714
je 0x4277a0
mov eax, 1
pop esi
pop ebp
pop ebx
add esp, 0x328
ret
cmp eax, ebx
jl 0x4277db
je 0x42781f
lea ecx, [esp + 0x18]
push ecx
push edi
xor esi, esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x427806
mov esi, 1
lea edx, [esp + 0x120]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x42781b
or esi, 4
cmp esi, ebx
jne 0x4277db
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x328
ret
Function at 0x42e0d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + eax*4 + 0x128]
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ebp, dword [esp + 0x24]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp], 0
jne 0x42e155
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
mov dword [esp + 0x14], eax
jne 0x42e127
xor eax, eax
mov dword [ebp], 0x51
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call fcn.004482a0
mov esi, dword [edi]
add esp, 4
push eax
push 0x4f0464
call fcn.0042dec0
mov eax, dword [edi]
mov ecx, dword [esp + 0x1c]
mov dword [eax + 0x855c], ecx
add esp, 8
mov dword [ebp], 0x37
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x42e4f0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x164]
test ecx, ecx
push ebp
mov ebp, dword [esp + 8]
je 0x42e511
mov edx, dword [esi + 0xf4]
push edx
push ebx
push ebp
push eax
push esi
call ecx
add esp, 0x14
pop ebp
ret
test eax, eax
jl 0x42e547
cmp eax, 2
jg 0x42e547
mov ecx, dword [esi + 0xf0]
push edi
mov edi, dword [sym.imp.MSVCR80.dll_fwrite]
push ecx
push 1
lea edx, [eax + eax*2 + 0x4de070]
push 2
push edx
call edi
mov eax, dword [esi + 0xf0]
push eax
push 1
push ebx
push ebp
call edi
add esp, 0x20
pop edi
xor eax, eax
pop ebp
ret

Function at 0x42e550
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xac
mov eax, dword [0x51501c]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xbc]
push ebx
push ebp
mov ebp, dword [esp + 0xbc]
push esi
mov esi, ecx
cmp dword [esi + 0x290], 0
push edi
je case.default.0x42e5ac
test eax, eax
je case.default.0x42e5ac
mov eax, dword [eax + 0x7c]
test eax, eax
je case.default.0x42e5ac
mov edx, dword [esp + 0xc0]
add edx, 0xffffffff
cmp edx, 3
mov ecx, 0x4f04c8
ja case.default.0x42e5ac
jmp dword [edx*4 + 0x42e680]
mov ecx, 0x4f04d0
mov edx, 0x4f04d8
jmp 0x42e5c9
mov ecx, 0x4f04d0
mov edx, 0x4f04e0
push eax
push edx
push ecx
push 0x4f04e4
lea eax, [esp + 0x20]
push 0xa0
push eax
call fcn.00435df0
lea eax, [esp + 0x28]
add esp, 0x18
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42e5f0
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x164]
test eax, eax
je 0x42e650
mov ecx, dword [esi + 0xf4]
push ecx
push edi
lea edx, [esp + 0x18]
push edx
push 0
push esi
call eax
add esp, 0x14
test eax, eax
jne 0x42e637
mov ebx, dword [esp + 0xc8]
mov eax, dword [esp + 0xc0]
push ebp
call fcn.0042e4f0
add esp, 4
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00459ea4
add esp, 0xac
ret
mov eax, dword [esi + 0xf0]
mov ebx, dword [sym.imp.MSVCR80.dll_fwrite]
push eax
push 1
push 2
push 0x4de070
call ebx
mov ecx, dword [esi + 0xf0]
push ecx
push 1
lea edx, [esp + 0x28]
push edi
push edx
call ebx
add esp, 0x20
jmp case.default.0x42e5ac
Function at 0x42f780
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x110
mov eax, dword [0x51501c]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
cmp dword [ebp + 0x194], 0
push esi
mov esi, dword [ebp]
push edi
mov edi, ecx
jne 0x42f8ae
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ebx, 0x80
push edi
mov dword [esp + 0x20], ebx
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x42f7f4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push ebp
mov edi, eax
call fcn.004482a0
add esp, 4
push eax
push edi
push 0x4f05c0
call fcn.0042dec0
add esp, 0xc
jmp 0x42f8b5
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x9c]
push eax
push edi
mov dword [esp + 0x20], ebx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x42f835
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push ebp
mov edi, eax
call fcn.004482a0
add esp, 4
push eax
push edi
push 0x4f0538
call fcn.0042dec0
add esp, 0xc
jmp 0x42f8b5
lea ebx, [ebp + 0xc4]
lea eax, [ebp + 0x96]
lea edi, [esp + 0x18]
call fcn.0042f730
test eax, eax
jne 0x42f870
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov edi, eax
call fcn.004482a0
add esp, 4
push eax
push edi
push 0x4f05e8
call fcn.0042dec0
add esp, 0xc
jmp 0x42f8b5
lea ebx, [ebp + 0xf8]
lea eax, [ebp + 0xc8]
lea edi, [esp + 0x98]
call fcn.0042f730
test eax, eax
jne 0x42f8ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov edi, eax
call fcn.004482a0
add esp, 4
push eax
push edi
push 0x4f0614
call fcn.0042dec0
add esp, 0xc
jmp 0x42f8b5
mov eax, ebp
call fcn.0042f6e0
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00459ea4
add esp, 0x110
ret

Function at 0x42f8d0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push esi
mov esi, dword [edi]
mov eax, dword [esi + 0x308]
push 4
lea ecx, [esp + 0xc]
push ecx
push 1
push 6
push edx
mov dword [esp + 0x1c], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x42f918
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push edi
call fcn.004482a0
add esp, 4
push eax
push 0x4f0654
call fcn.0042de00
add esp, 8
pop esi
add esp, 8
ret
push 0x4f0674
call fcn.0042de00
add esp, 4
pop esi
add esp, 8
ret

Function at 0x42f930
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
lea eax, [esp + 8]
push eax
lea ecx, [esp + 4]
push ecx
push 0x1001
push 0xffff
push esi
mov dword [esp + 0x18], 0x4020
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x42f973
mov edx, dword [esp]
cmp edx, dword [esp + 4]
jg 0x42f98b
push 4
lea eax, [esp + 8]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 0xc
ret
Function at 0x42ff50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
mov eax, dword [ecx + 0x520]
cmp eax, 0xffffffff
je 0x42ffa4
mov ecx, dword [ecx + 0x514]
mov ecx, dword [ecx]
cmp dword [ecx + eax*4], 0
lea eax, [ecx + eax*4]
je 0x42ffa4
test edx, edx
mov eax, dword [eax]
je 0x42ff75
mov dword [edx], eax
cmp dword [eax + 0x140], 0
push esi
mov esi, dword [eax + 0x128]
jne 0x42ff99
push 2
push 1
lea edx, [esp + 0xf]
push edx
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x42ff9f
or eax, 0xffffffff
pop esi
pop ecx
ret
mov eax, esi
pop esi
pop ecx
ret
or eax, 0xffffffff
pop ecx
ret

Function at 0x430dc0
Capabilities:
Get socket status

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x320
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx + 0x128]
xor ebx, ebx
cmp edi, 0xffffffff
mov eax, 1
je 0x430ebd
mov ebp, dword [sym.imp.WS2_32.dll_select]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x124], edi
mov dword [esp + 0x120], eax
mov dword [esp + 0x228], ebx
lea esi, [edi + 1]
lea ebx, [ebx]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x124]
push eax
lea ecx, [esp + 0x230]
push ecx
lea edx, [esp + 0x24]
push edx
push esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call ebp
cmp eax, 0xffffffff
jne 0x430e4d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, ebx
je 0x430e10
cmp eax, 0x2714
je 0x430e10
jmp 0x430e51
cmp eax, ebx
jge 0x430e8a
or eax, 0xffffffff
test al, 4
jne 0x430e7a
test al, 1
je 0x430e7a
mov eax, dword [esp + 0x334]
cmp dword [eax], ebx
je 0x430e7a
mov ecx, dword [eax]
lea edx, [esp + 0x334]
call fcn.0042ff50
cmp eax, 0xffffffff
jne 0x430ebd
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
je 0x430ebd
lea eax, [esp + 0x18]
push eax
push edi
xor esi, esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x430ea2
mov esi, 1
lea ecx, [esp + 0x120]
push ecx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x430eb7
or esi, 4
cmp esi, ebx
mov eax, esi
jne 0x430e54
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x320
ret