joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427069
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0x427079
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0x4270b9
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], ebx
pop esi
pop ebx
ret

Function at 0x42a7d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebx + 0x84], edi
test edi, 0xffff0000
jne 0x42a7ff
cmp dword [ebx + 0x80], 0
jne 0x42a7ff
movzx eax, di
mov dword [ebx + 0x80], eax
call fcn.004370d8
push 5
push edi
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
mov ecx, ebx
push edi
call fcn.0042aa92
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42a839
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.004370d8
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42a870
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0042a891
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42e461
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x42e4a6
call fcn.004370d8
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42e4a6
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x42e4c2
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0043787d
mov ebx, eax
test edi, edi
je 0x42e4c0
test esi, esi
je 0x42e4c0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42eed2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x42ef90
cmp dword [esi + 0x20], 0
je 0x42ef90
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42ef90
cmp dword [ebp + 8], 0
je 0x42ef90
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.004370d8
push 0x5b4b70
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x42ef61
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42ef90
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.00440e38
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x42ef81
test edi, edi
je 0x42ef81
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x42ef8c
mov ecx, esi
call fcn.0042ec75
mov eax, ebx
jmp 0x42ef92
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x433498
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5aba0e
call fcn.0055d8d0
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x4334be
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x43351d
call fcn.00433b76
push eax
lea ecx, [ebp - 0x10]
call fcn.00407c38
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call fcn.0055d893
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0056e180
push eax
call fcn.004068c7
add esp, 0x14
test esi, esi
je 0x433510
push esi
call fcn.0056e1ec
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004069b9
mov eax, ebx
call fcn.0055d899
ret 8
Function at 0x442931
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x44294b
mov edi, dword [esi + 0xc]
jmp 0x44298b
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x442964
call fcn.0043574d
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x442979
call fcn.0043574d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x44298b
call fcn.0043574d
call fcn.004370d8
cmp dword [eax + 0x3c], 0
je 0x4429a0
push edi
mov ecx, ebx
call fcn.00441fc5
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00442b7d
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x4429c9
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x4429d5
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45aa19
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.004333e2
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x45aa55
call fcn.0045ac3b
mov dword [esi + 0xc], 1
jmp 0x45aa5a
call fcn.0045ac3b
cmp dword [esi], 0
je 0x45aaa3
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x45aa7d
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0042e537
jmp 0x45aa8e
push 0xff
mov ecx, esi
call fcn.00407c00
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.004297d3
jmp 0x45aac7
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x45aac7
push dword [esi]
push dword [ebp - 4]
call fcn.00439bc4
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x45ab90
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0045ac3b
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x45abd8
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0042e537
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004297d3
jmp 0x45abe3
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00439bc4
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x49817b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x498194
call fcn.004370d8
mov esi, dword [eax + 0xc]
push 0x5f0740
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x4981ea
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4981e9
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4981ca
xor esi, esi
jmp 0x4981e0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.004981f2
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x560837
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x5b0009
call fcn.0055d904
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x560954
cmp byte [ebx + 0x3e], 0
je 0x560954
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.0055d893
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x560883
xor al, al
jmp 0x560956
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.0040398e
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x5608b3
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.0055d893
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x5608e8
sub eax, 1
je 0x5608ec
dec eax
sub eax, 1
je 0x560942
xor bl, bl
jmp 0x560944
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x5608fc
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x560924
cmp eax, 0x10
jae 0x56090b
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0056b1d1
add esp, 0x10
cmp esi, eax
jne 0x5608e4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x560942
test esi, esi
jne 0x5608a7
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00403e1e
jmp 0x5608a1
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040390d
mov al, bl
jmp 0x560956
mov al, 1
call fcn.0055d8ae
ret

Function at 0x57cbf3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057c8b6

Function at 0x57cbfe
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057ca37

Function at 0x5822c2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00581f82
Function at 0x58aa25
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x405860
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x76c
push edi
push ecx
lea edi, [ebp - 0x76c]
mov ecx, 0x1db
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x4c3500]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
jne 0x405898
xor eax, eax
jmp 0x405a79
cmp dword [ebp + 0xc], 0
jne 0x4058a5
xor eax, eax
jmp 0x405a79
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
push ecx
push 1
push 1
lea edx, [ebp - 0x25]
push edx
call fcn.00448310
add esp, 0x10
mov eax, dword [ebp - 8]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
push 0x200
push 0
lea ecx, [ebp - 0x23c]
push ecx
call fcn.00446ee0
add esp, 0xc
mov edx, dword [ebp - 8]
add edx, 0x10
push edx
call fcn.00446f70
add esp, 4
push eax
mov eax, dword [ebp - 8]
add eax, 0x10
push eax
lea ecx, [ebp - 0x23c]
push ecx
call fcn.00446890
add esp, 0xc
push pe_nt_image_headers32
lea edx, [ebp - 0x23c]
push edx
lea eax, [ebp - 0x764]
push eax
call fcn.00407cd0
add esp, 0xc
mov cl, byte [ebp + 0x14]
mov byte [ebp - 0x1d], cl
mov dword [ebp - 0x18], 0
jmp 0x40593e
mov edx, dword [ebp - 0x18]
add edx, 0x10
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x14]
jge 0x405a18
mov ecx, dword [ebp + 8]
push ecx
push 0x10
push 1
lea edx, [ebp - 0x644]
push edx
call fcn.00448310
add esp, 0x10
cmp eax, 0x10
je 0x405999
push 0x400
push 0
lea eax, [ebp - 0x644]
push eax
call fcn.00446ee0
add esp, 0xc
push 0x118
push 0
lea ecx, [ebp - 0x764]
push ecx
call fcn.00446ee0
add esp, 0xc
xor eax, eax
jmp 0x405a79
lea edx, [ebp - 0x644]
push edx
lea eax, [ebp - 0x644]
push eax
push 0
lea ecx, [ebp - 0x764]
push ecx
call fcn.00408060
add esp, 0x10
mov dword [ebp - 0x76c], 0
jmp 0x4059d3
mov edx, dword [ebp - 0x76c]
add edx, 1
mov dword [ebp - 0x76c], edx
cmp dword [ebp - 0x76c], 0x10
jge 0x405a13
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x76c]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x76c]
mov dl, byte [ebp + edx - 0x644]
mov byte [ecx + eax], dl
movsx eax, byte [ebp - 0x1d]
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x76c]
mov edx, dword [ebp + 0xc]
movsx ecx, byte [edx + ecx]
add eax, ecx
mov byte [ebp - 0x1d], al
jmp 0x4059c4
jmp 0x405935
mov edx, dword [ebp + 8]
push edx
push 1
push 1
lea eax, [ebp - 0x31]
push eax
call fcn.00448310
add esp, 0x10
movsx ecx, byte [ebp - 0x25]
movsx edx, byte [ebp - 0x31]
cmp ecx, edx
jne 0x405a44
movsx eax, byte [ebp - 0x25]
movsx ecx, byte [ebp - 0x1d]
cmp eax, ecx
je 0x405a74
push 0x400
push 0
lea edx, [ebp - 0x644]
push edx
call fcn.00446ee0
add esp, 0xc
push 0x118
push 0
lea eax, [ebp - 0x764]
push eax
call fcn.00446ee0
add esp, 0xc
xor eax, eax
jmp 0x405a79
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x405aa8]
call fcn.004490e0
pop eax
pop edx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449170
add esp, 0x76c
cmp ebp, esp
call fcn.00449140
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40f320
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push esi
push edi
push ecx
lea edi, [ebp - 0x128]
mov ecx, 0x4a
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x4c3500]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
push 0x4a7458
push 0x4a745c
call fcn.0044ac00
add esp, 8
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x40f393
mov esi, esp
push 0
push 0
push str.serverset.txt
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00449140
push 0
call fcn.0044ccb0
jmp 0x40f48f
lea eax, [ebp - 0x11c]
push eax
push 0x4a7494
mov ecx, dword [ebp - 0x114]
push ecx
call fcn.0044cd30
add esp, 0xc
mov edx, dword [ebp - 0x114]
push edx
call fcn.0044a890
add esp, 4
mov eax, dword [ebp - 0x11c]
push eax
push str.serverset__d_serverlist.list
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0044aea0
add esp, 0xc
lea edx, [ebp - 0x10c]
push edx
mov ecx, 0x4cdf90
call fcn.00416850
mov eax, dword [ebp - 0x11c]
push eax
push str.serverset__d_serverlist_Public.list
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0044aea0
add esp, 0xc
lea edx, [ebp - 0x10c]
push edx
mov ecx, 0x4cdf90
call fcn.00416990
mov ecx, dword [ebp - 8]
call fcn.0040f9d0
test eax, eax
jne 0x40f42b
mov dword [0x4dd8c8], 1
mov eax, dword [0x4dd8c8]
cmp eax, dword [ebp - 0x11c]
jne 0x40f444
mov dword [ebp - 0x128], 1
jmp 0x40f44e
mov dword [ebp - 0x128], 0
cmp dword [ebp - 0x128], 0
jne 0x40f468
push 0
push 0x4d
push 0x4a74dc
call fcn.00409790
add esp, 0xc
movzx ecx, word [ebp + 0xc]
push ecx
movzx edx, word [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
call fcn.0040ed90
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.0043b700
push edx
mov ecx, ebp
push eax
lea edx, [0x40f4c0]
call fcn.004490e0
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449170
add esp, 0x128
cmp ebp, esp
call fcn.00449140
mov esp, ebp
pop ebp
ret 0xc
Function at 0x415080
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov esi, esp
lea ecx, [ebp - 0x14]
push ecx
push 0x8004667e
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp esi, esp
call fcn.00449140
cmp dword [ebp - 4], 0
jle 0x415113
mov esi, esp
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp esi, esp
call fcn.00449140
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x4150ff
jmp 0x415113
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
jmp 0x4150ce
mov eax, dword [ebp - 8]
push edx
mov ecx, ebp
push eax
lea edx, [0x415138]
call fcn.004490e0
pop eax
pop edx
pop esi
add esp, 0x18
cmp ebp, esp
call fcn.00449140
mov esp, ebp
pop ebp
ret
Function at 0x4154c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x4c3500]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp esi, esp
call fcn.00449140
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x415510
xor eax, eax
jmp 0x415573
mov eax, 2
mov word [ebp - 0x1c], ax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
mov esi, esp
movzx edx, word [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_htons]
cmp esi, esp
call fcn.00449140
mov word [ebp - 0x1a], ax
mov esi, esp
push 0x10
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp esi, esp
call fcn.00449140
cmp eax, 0xffffffff
jne 0x415559
jmp 0x41555e
mov eax, dword [ebp - 8]
jmp 0x415573
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
cmp esi, esp
call fcn.00449140
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x4155a0]
call fcn.004490e0
pop eax
pop edx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449170
add esp, 0x20
cmp ebp, esp
call fcn.00449140
mov esp, ebp
pop ebp
ret
Function at 0x4155f0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x4c3500]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp esi, esp
call fcn.00449140
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x415643
xor eax, eax
jmp 0x4156d0
xor eax, eax
mov word [ebp - 0x1c], ax
xor ecx, ecx
mov dword [ebp - 0x1a], ecx
mov dword [ebp - 0x16], ecx
mov dword [ebp - 0x12], ecx
mov word [ebp - 0xe], cx
mov edx, 2
mov word [ebp - 0x1c], dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov esi, esp
movzx ecx, word [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
cmp esi, esp
call fcn.00449140
mov word [ebp - 0x1a], ax
mov esi, esp
push 0x10
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp esi, esp
call fcn.00449140
cmp eax, 0xffffffff
jne 0x4156a1
jmp 0x4156bb
mov esi, esp
push 3
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WS2_32.dll_listen]
cmp esi, esp
call fcn.00449140
mov eax, dword [ebp - 8]
jmp 0x4156d0
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
cmp esi, esp
call fcn.00449140
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x4156fc]
call fcn.004490e0
pop eax
pop edx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449170
add esp, 0x20
cmp ebp, esp
call fcn.00449140
mov esp, ebp
pop ebp
ret

Function at 0x415720
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
lea edi, [ebp - 0x2c]
mov ecx, 0xb
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x4c3500]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x18], ax
xor ecx, ecx
mov dword [ebp - 0x16], ecx
mov dword [ebp - 0x12], ecx
mov dword [ebp - 0xe], ecx
mov word [ebp - 0xa], cx
mov dword [ebp - 0x24], 0x10
push 0
push 0
call fcn.004155f0
add esp, 8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
ja 0x415776
jmp 0x4157b9
mov esi, esp
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.WS2_32.dll_getsockname]
cmp esi, esp
call fcn.00449140
cmp eax, 0xffffffff
jne 0x41579a
jmp 0x4157b9
mov esi, esp
movzx edx, word [ebp - 0x16]
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
cmp esi, esp
call fcn.00449140
mov ecx, dword [ebp + 8]
mov word [ecx], ax
mov eax, dword [ebp - 0x2c]
jmp 0x4157ce
mov esi, esp
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
cmp esi, esp
call fcn.00449140
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x4157fc]
call fcn.004490e0
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449170
add esp, 0x2c
cmp ebp, esp
call fcn.00449140
mov esp, ebp
pop ebp
ret