joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7f1000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x7f1131
push esi
call fcn.007f4145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.007e3080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x7f1131
push 0
push ebp
call fcn.007e33a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.007e3260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x7f108b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.007e32f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x7f1121
push 0x809918
push edi
call fcn.007f23f0
push eax
push ebx
push esi
call fcn.007f0f60
push 0x8098f8
push edi
call fcn.007f23f0
push eax
push ebx
push esi
call fcn.007f0f60
push 0x8098d8
push edi
call fcn.007f23f0
push eax
push ebx
push esi
call fcn.007f0f60
push 0x8098c0
push edi
call fcn.007f23f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.007f0f60
push 0x8098a0
push edi
call fcn.007f23f0
push eax
push ebx
push esi
call fcn.007f0f60
push 0x809888
push edi
call fcn.007f23f0
push eax
push ebx
push esi
call fcn.007f0f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x7f21b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.007f2140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.007f2140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.007f2140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.007f2140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x7f2bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7f2c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x80487c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7f2c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x7f2c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x405ee9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x405f0d
xor eax, eax
test eax, eax
je 0x405f1f
cmp byte [ebp + eax - 0x121], 0x5c
je 0x405f1f
xor ecx, ecx
jmp 0x405f22
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409010]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x405fc6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c634], 0
push esi
jne 0x405ffd
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405fd7
mov dword [ecx*4 + 0x42c630], eax
inc ecx
cmp ecx, 0x100
jl 0x405fd2
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40602e
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c630]
xor eax, esi
inc ecx
dec edx
jne 0x406010
pop edi
not eax
pop esi
ret 0xc

Function at 0x438c8a
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x438a14
push 0x9dfefb1a
pop ebx
mov ecx, 0xa3d9f336
call fcn.00438cc3
mov ecx, ecx
dec ebx
and ecx, ebx
xor dword [eax], edx
mov ebx, 0xeb7517b7
sub ecx, 1
add eax, 1
add ebx, ecx
sub ecx, ecx
cmp eax, esi
jne fcn.00438c8a
dec ebx
ret
Function at 0x41f1e5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004182df
and dword [ebp - 4], 0
cmp dword [0x433a9c], 0
mov ebx, eax
jne 0x41f296
push 0x427ddc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41f347
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x427dd0
push edi
call esi
test eax, eax
je 0x41f347
push eax
call fcn.0041826d
mov dword [esp], 0x427dc0
push edi
mov dword [0x433a9c], eax
call esi
push eax
call fcn.0041826d
mov dword [esp], 0x427dac
push edi
mov dword [0x433aa0], eax
call esi
push eax
call fcn.0041826d
mov dword [esp], 0x427d90
push edi
mov dword [0x433aa4], eax
call esi
push eax
call fcn.0041826d
pop ecx
mov dword [0x433aac], eax
test eax, eax
je 0x41f296
push 0x427d78
push edi
call esi
push eax
call fcn.0041826d
pop ecx
mov dword [0x433aa8], eax
mov eax, dword [0x433aa8]
cmp eax, ebx
je 0x41f2ee
cmp dword [0x433aac], ebx
je 0x41f2ee
push eax
call fcn.004182e8
push dword [0x433aac]
mov esi, eax
call fcn.004182e8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41f2ee
test edi, edi
je 0x41f2ee
call esi
test eax, eax
je 0x41f2e5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41f2e5
test byte [ebp - 0xc], 1
jne 0x41f2ee
or dword [ebp + 0x10], 0x200000
jmp 0x41f327
mov eax, dword [0x433aa0]
cmp eax, ebx
je 0x41f327
push eax
call fcn.004182e8
pop ecx
test eax, eax
je 0x41f327
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41f327
mov eax, dword [0x433aa4]
cmp eax, ebx
je 0x41f327
push eax
call fcn.004182e8
pop ecx
test eax, eax
je 0x41f327
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x433a9c]
call fcn.004182e8
pop ecx
test eax, eax
je 0x41f347
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41f349
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x5d8ac5
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x5d87dc
and edx, edx
sub edx, esi
call fcn.005d8b10
mov esi, esi
sub edx, 0x75476c56
add esi, 0x72d09fc8
xor dword [edi], ecx
inc esi
mov esi, edx
add edi, 2
sub esi, 0xf4b1804a
add edx, 0xc9384d90
cmp edi, eax
jl fcn.005d8ac5
or esi, edx
sub edx, 0x802ff984
or esi, esi
ret
Function at 0x4063e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x42bf8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4046b4
call fcn.00407041
push 4
mov dword [esp + 0x18], 0
call fcn.00407ee6
mov edi, eax
add esp, 4
test edi, edi
je 0x406454
push ebx
call fcn.00406f19
mov dword [edi], eax
call fcn.00406cd8
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00407002
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406448
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040702a
pop ebx
jmp 0x406456
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x408951
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f520]
jne 0x40895b
repz ret
jmp fcn.0040d0ac
Function at 0x411cf2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42f520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b051
and dword [ebp - 0x14], 0
cmp dword [0x434a94], 0
mov dword [ebp - 0x18], eax
jne 0x411da5
push 0x403924
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x411e4d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403918
push ebx
call edi
test eax, eax
je 0x411e4d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403908
push ebx
mov dword [0x434a94], eax
call edi
push eax
call esi
push 0x4038f4
push ebx
mov dword [0x434a98], eax
call edi
push eax
call esi
push 0x4038d8
push ebx
mov dword [0x434a9c], eax
call edi
push eax
call esi
mov dword [0x434aa4], eax
test eax, eax
je 0x411da5
push 0x4038c0
push ebx
call edi
push eax
call esi
mov dword [0x434aa0], eax
mov eax, dword [0x434aa0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x411dfe
cmp dword [0x434aa4], ecx
je 0x411dfe
push eax
call esi
push dword [0x434aa4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x411dfe
test ebx, ebx
je 0x411dfe
call edi
test eax, eax
je 0x411df5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x411df5
test byte [ebp - 8], 1
jne 0x411dfe
or dword [ebp + 0x10], 0x200000
jmp 0x411e31
mov eax, dword [0x434a98]
cmp eax, dword [ebp - 0x18]
je 0x411e31
push eax
call esi
test eax, eax
je 0x411e31
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411e31
mov eax, dword [0x434a9c]
cmp eax, dword [ebp - 0x18]
je 0x411e31
push eax
call esi
test eax, eax
je 0x411e31
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x434a94]
call esi
test eax, eax
je 0x411e4d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411e4f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408951
leave
ret
Function at 0x42aa90
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
sub esp, 0xc0c
cmp dword [0x7b9820], 0x37
jne 0x42ab30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
push 0
lea eax, [esp + 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0x404164
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0
push 0
push 0
push 0x4041a0
push 0x404238
push 0x4042b8
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov ecx, dword [0x7b9824]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x439884]
mov byte [ecx + esi], al
add esp, 0xc0c
ret
Function at 0x42ada0
Capabilities:
Accept command line arguments
Enumerate files on windows
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7b9820]
sub esp, 0x434
push ebx
push ebp
push esi
shr eax, 3
xor ebx, ebx
push edi
mov edi, dword [0x439884]
cmp eax, ebx
jbe 0x42af88
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], eax
jmp 0x42add6
mov edi, dword [esp + 0x1c]
xor ebx, ebx
cmp dword [0x7b9820], 0x1c
jne 0x42aded
lea eax, [esp + 0x38]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov ecx, dword [edi + 4]
mov edx, dword [0x430700]
mov eax, dword [0x430704]
mov esi, dword [edi]
mov ebp, dword [0x430708]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x43070c]
mov edi, 0xc6ef3720
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], 0x20
jmp 0x42ae2a
xor ebx, ebx
mov eax, esi
mov edx, esi
shl eax, 4
shr edx, 5
add edx, dword [esp + 0x28]
add eax, ebp
lea ecx, [edi + esi]
xor eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
mov dword [0x7b87a4], ebx
mov eax, dword [esp + 0x18]
add dword [0x7b87a4], eax
mov edx, dword [0x7b87a4]
mov dword [esp + 0x34], edx
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x34]
add dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
sub dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
shl ecx, 4
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x30]
add dword [esp + 0x10], eax
cmp dword [0x7b9820], 0x1be
mov eax, dword [esp + 0x14]
lea ebx, [edi + eax]
jne 0x42aec4
lea edx, [esp + 0x3c]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov eax, dword [esp + 0x14]
shr eax, 5
add eax, dword [esp + 0x2c]
cmp dword [0x7b9820], 0x979
mov dword [0x7b87a8], 0xff6b3619
mov dword [0x7b87ac], 0xffffffff
mov dword [esp + 0x18], eax
jne 0x42af08
push 0
lea eax, [esp + 0x44]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
xor dword [esp + 0x10], ebx
mov eax, dword [esp + 0x18]
xor dword [esp + 0x10], eax
mov eax, dword [0x7b9820]
sub esi, dword [esp + 0x10]
cmp eax, 0x93
je 0x42af2a
add edi, 0x61c88647
dec dword [esp + 0x20]
jne 0x42ae28
cmp eax, 0x8d4
jne 0x42af41
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [edi], esi
mov dword [edi + 4], ecx
cmp dword [0x7b9820], 0x17
jne 0x42af77
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
lea edx, [esp + 0x40]
push edx
push 0x4040f0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
add edi, 8
dec dword [esp + 0x24]
mov dword [esp + 0x1c], edi
jne 0x42add0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x434
ret
Function at 0x4013c9
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x46319c], 1
mov dword [0x4631a0], 1
mov dword [0x4631a4], 1
mov dword [0x463190], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x401414
mov eax, 0
jmp 0x4014ae
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x401437
mov eax, 0
jmp 0x4014ae
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401459
cmp eax, 0x20b
je 0x40147e
jmp 0x4014a9
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x40146b
mov eax, 0
jmp 0x4014ae
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014ae
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x401496
mov eax, 0
jmp 0x4014ae
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014ae
mov eax, 0
leave
ret

Function at 0x4023c2
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x28]
push ebx
mov edi, esi
sub esp, 0x4c
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x2c], 1
sub esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x2c]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 0xffff
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
xor eax, eax
mov ecx, 4
rep stosd dword es:[edi], eax
movzx eax, word [ebp + 8]
sub esp, 0x14
mov word [ebp - 0x28], 2
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_htons]
cmp dword [ebp + 0xc], 1
push edx
mov word [ebp - 0x26], ax
sbb eax, eax
and eax, 0x7f000001
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_htonl]
push ecx
mov dword [ebp - 0x24], eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_bind]
sub esp, 0xc
inc eax
jne 0x4024ba
call dword [sym.imp.msvcrt.dll__errno]
or ebx, 0xffffffff
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0xc], str.Bind_error_on_local_port__u___s__n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0x38
mov dword [esp + 0x10], eax
mov dword [esp + 4], str._n2n_lucktu_cnn2n_src_n2n.c
mov dword [esp], 0
call sym._traceEvent
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402cbc
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ecx, 0xc
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x48]
push ebx
sub esp, 0x9c
mov esi, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x48]
mov dword [esp + 4], 0x428480
mov dword [esp], esi
mov dword [ebp - 0x7c], ecx
call sym._strtok
test eax, eax
je 0x402e22
mov dword [esp + 4], 0x428480
mov ebx, eax
lea edi, [ebp - 0x68]
mov dword [esp], 0
call sym._strtok
mov ecx, 8
mov dword [ebp - 0x6c], 0
mov edx, eax
mov eax, dword [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x64], 2
test edx, edx
je 0x402d3b
mov dword [esp], edx
call sym._atoi
mov edi, dword [ebp + 8]
mov word [edi + 2], ax
jmp 0x402d6f
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.Bad_supernode_parameter___l__host:port____s__s:_s
mov dword [esp + 8], 0x15d
mov dword [esp + 4], str._n2n_lucktu_cnn2n_src_edge_utils.c
mov dword [esp], 1
call sym._traceEvent
lea eax, [ebp - 0x6c]
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x68]
mov dword [esp + 8], eax
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
sub esp, 0x10
test eax, eax
jne 0x402df3
mov edx, dword [ebp - 0x6c]
test edx, edx
je 0x402db3
cmp dword [edx + 4], 2
jne 0x402db3
mov edx, dword [edx + 0x18]
mov ecx, dword [ebp + 8]
mov edx, dword [edx + 4]
mov byte [ecx], 2
mov dword [ecx + 4], edx
jmp 0x402dde
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.Failed_to_resolve_supernode_IPv4_address_for__s
mov dword [esp + 8], 0x172
mov dword [esp + 4], str._n2n_lucktu_cnn2n_src_edge_utils.c
mov dword [esp], 1
call sym._traceEvent
or eax, 0xffffffff
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x7c], eax
mov dword [esp], edx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
push eax
mov eax, dword [ebp - 0x7c]
jmp 0x402e4b
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.Failed_to_resolve_supernode_host__s
mov dword [esp + 8], 0x179
mov dword [esp + 4], str._n2n_lucktu_cnn2n_src_edge_utils.c
mov dword [esp], 1
call sym._traceEvent
mov eax, 0xfffffffe
jmp 0x402e4b
mov dword [esp + 0xc], str.Wrong_supernode_parameter___l__host:port__
mov dword [esp + 8], 0x17e
mov dword [esp + 4], str._n2n_lucktu_cnn2n_src_edge_utils.c
mov dword [esp], 1
call sym._traceEvent
mov eax, 0xfffffffd
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402e53
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 0x154]
test eax, eax
js 0x402e7c
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
push edx
mov eax, dword [ebx + 0x158]
test eax, eax
js 0x402e90
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
push eax
test esi, esi
jle 0x402ebc
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.Binding_to_local_port__d
mov dword [esp + 8], 0x8c6
mov dword [esp + 4], str._n2n_lucktu_cnn2n_src_edge_utils.c
mov dword [esp], 2
call sym._traceEvent
mov dword [esp + 4], 1
mov dword [esp], esi
call sym._open_socket
mov dword [ebx + 0x154], eax
test eax, eax
jns 0x402f06
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.Failed_to_bind_main_UDP_port__u
mov dword [esp + 8], 0x8ca
mov dword [esp + 4], str._n2n_lucktu_cnn2n_src_edge_utils.c
mov dword [esp], 0
call sym._traceEvent
or edx, 0xffffffff
jmp 0x40300b
cmp byte [ebp - 0x2c], 0
je 0x402fc2
movzx esi, byte [ebp - 0x2c]
lea edx, [ebp - 0x1c]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], edx
mov dword [ebp - 0x1c], esi
mov dword [esp + 8], 3
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
test eax, eax
jne 0x402f70
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.TOS_set_to_0x_x
mov dword [esp + 8], 0x8d3
mov dword [esp + 4], str._n2n_lucktu_cnn2n_src_edge_utils.c
mov dword [esp], 2
call sym._traceEvent
jmp 0x402fc2
mov ecx, dword [sym.imp.msvcrt.dll__errno]
mov dword [ebp - 0x30], ecx
call ecx
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
call ecx
mov edx, dword [ebp - 0x2c]
mov dword [esp + 0x18], edx
mov eax, dword [eax]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.Could_not_set_TOS_0x_x__d_:__s
mov dword [esp + 8], 0x8d5
mov dword [esp + 4], str._n2n_lucktu_cnn2n_src_edge_utils.c
mov dword [esp], 0
call sym._traceEvent
mov dword [esp + 4], 0
mov dword [esp], edi
call sym._open_socket
xor edx, edx
mov dword [ebx + 0x158], eax
test eax, eax
jns 0x40300b
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.Failed_to_bind_management_UDP_port__u
mov dword [esp + 8], 0x8e4
mov dword [esp + 4], str._n2n_lucktu_cnn2n_src_edge_utils.c
mov dword [esp], 0
call sym._traceEvent
mov edx, 0xfffffffe
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret