joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f12d
Capabilities:
Delete file

Disassembly:
push 0x7c
mov eax, 0x46676c
call fcn.0044bf32
mov ebx, ecx
lea edi, [ebx + 0x1ac]
push str.Bootstrapper::forceMFCStudioCleanup___deleteCurVersionKeys
mov esi, edi
call fcn.00409015
pop ecx
lea eax, [ebp - 0x84]
push eax
call fcn.0042aaa9
pop ecx
and dword [ebp - 4], 0
cmp dword [eax + 0x18], 8
jb 0x41f16a
mov eax, dword [eax + 4]
jmp 0x41f16d
add eax, 4
mov cl, byte [ebx + 0x59]
mov byte [ebp - 0x68], cl
push eax
push dword [ebp - 0x68]
mov ecx, edi
call fcn.0042a61e
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x84]
call fcn.00409726
call fcn.0041f296
mov al, byte [ebx + 0x59]
mov byte [ebp - 0x68], al
push dword [ebp - 0x68]
lea eax, [ebp - 0x64]
push eax
call fcn.00419f14
xor ebx, ebx
inc ebx
push str.RobloxStudioLauncher.exe
lea eax, [ebp - 0x48]
mov dword [ebp - 4], ebx
call fcn.00408201
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 2
call fcn.0040b38b
add esp, 0xc
mov byte [ebp - 4], 3
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x41f1e5
lea eax, [ebp - 0x28]
push eax
push str.Bootstrapper::forceMFCStudioCleanup___deleting_studio_stub:__S
mov esi, edi
call fcn.00409015
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
pop ecx
pop ecx
jae 0x41f200
lea eax, [ebp - 0x28]
push eax
call fcn.0042d09c
pop ecx
test al, al
je 0x41f21e
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x41f217
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
push edi
push ebx
lea esi, [ebp - 0x2c]
call fcn.00409726
push edi
push ebx
lea esi, [ebp - 0x48]
call fcn.00409726
push edi
push ebx
lea esi, [ebp - 0x64]
call fcn.00409726
call fcn.0044bfb5
ret

Function at 0x4279fa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x427a11
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x427a46
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x427a42
cmp edi, eax
jae 0x427a46
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x427a34
cmp edi, eax
jb 0x427a4a
xor eax, eax
jmp 0x427a53
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x427bb4
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x498b1c], 0
jne 0x427be4
push 0x476908
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x427bdd
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x498b20], eax
mov byte [0x498b1c], 1
mov eax, dword [0x498b20]
test eax, eax
je 0x427bfc
push 0
push dword [esi + 4]
push dword [esp + 0xc]
push dword [esi]
call eax
jmp 0x427c08
push dword [esp + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
ret 4
Function at 0x427c0b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x48e190]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
push ecx
push dword [edi]
mov dword [ebp - 0x21c], ecx
xor esi, esi
or eax, 0x2001f
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
call fcn.0040ca2d
mov ebx, eax
cmp ebx, esi
je 0x427c74
lea esi, [ebp - 0x214]
call fcn.0040ca6b
mov eax, ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447a6d
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x427c92
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.00427c0b
cmp eax, esi
jne 0x427cd9
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call ebx
test eax, eax
je 0x427c7c
lea esi, [ebp - 0x214]
call fcn.0040ca6b
push dword [ebp - 0x21c]
mov esi, edi
call fcn.00427bb4
lea esi, [ebp - 0x214]
mov edi, eax
call fcn.0040ca6b
mov eax, edi
jmp 0x427c63

Function at 0x427f0d
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
mov edi, eax
call fcn.00427e68
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
cmp dword [edi + 0x18], 8
lea ebx, [edi + 4]
jb 0x427f34
mov eax, dword [ebx]
jmp 0x427f36
mov eax, ebx
lea ecx, [ebp - 8]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 4], eax
test eax, eax
je 0x427fcb
push eax
call fcn.0044704c
mov dword [esi + 4], eax
cmp dword [edi + 0x18], 8
pop ecx
jb 0x427f5d
mov ebx, dword [ebx]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x427fcb
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x10]
push eax
push 0x46eae8
push dword [esi + 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x427fcb
lea eax, [ebp - 4]
push eax
lea edi, [esi + 8]
push edi
push str.VarFileInfoTranslation
push dword [esi + 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x427fc2
mov eax, dword [ebp - 4]
cmp eax, 4
jb 0x427fc2
shr eax, 2
mov dword [esi + 0xc], eax
mov eax, dword [edi]
mov cx, word [eax]
mov word [esi], cx
mov ax, word [eax + 2]
mov word [esi + 2], ax
mov dword [ebp - 0xc], 1
jmp 0x427fdd
mov eax, dword [esi + 4]
test eax, eax
je 0x427fdd
push eax
call fcn.00447e29
and dword [esi + 4], 0
pop ecx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x429efc
Capabilities:
Delete registry key

Disassembly:
push 0x4c
mov eax, 0x4666ea
call fcn.0044bec9
test edi, edi
jne 0x429f37
push str.Attempt_to_delete_a_null_key
lea ecx, [ebp - 0x30]
call fcn.00408177
and dword [ebp - 4], edi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00401273
push 0x4813b8
lea eax, [ebp - 0x58]
push eax
call fcn.0044bfd3
push edi
lea eax, [ebp - 0x30]
call fcn.00408201
cmp dword [eax + 0x14], 0
push 0
push 1
lea esi, [ebp - 0x30]
sete byte [ebp - 0xd]
call fcn.00409726
cmp byte [ebp - 0xd], 0
je 0x429f70
push str.Attempt_to_delete_an_empty_key
lea ecx, [ebp - 0x30]
call fcn.00408177
mov dword [ebp - 4], 1
jmp 0x429f1c
push edi
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jge 0x429faa
lea eax, [ebp - 0x14]
push eax
call fcn.00429cfb
pop ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 2
push dword [eax]
push edi
push str.Failed_to_delete_key__S__S
call fcn.00409015
add esp, 0xc
lea eax, [ebp - 0x14]
call fcn.0040ebb7
call fcn.0044bfa1
ret

Function at 0x42a61e
Capabilities:
Delete registry value

Disassembly:
push 0x24
mov eax, 0x4666b7
call fcn.0044bec9
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
push str.deleteCurVersionKeys
mov dword [ebp - 4], ebx
call fcn.00409015
xor eax, eax
cmp byte [ebp + 8], bl
mov dword [esp], str.SoftwareROBLOX_CorporationRoblox
sete al
lea ecx, [ebp - 0x14]
add eax, 0x80000001
push eax
mov eax, 0x20006
call fcn.0040ca2d
test eax, eax
jl 0x42a6d2
push str.deleteCurVersionKeys___key_Opened
call fcn.00409015
pop ecx
push dword [ebp + 0xc]
lea eax, [ebp - 0x30]
push eax
call fcn.0042a526
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x42a68b
mov eax, dword [eax + 4]
jmp 0x42a68e
add eax, 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
push dword [ebp - 0x14]
call edi
push ebx
push 1
lea esi, [ebp - 0x30]
call fcn.00409726
push dword [ebp + 0xc]
lea eax, [ebp - 0x30]
push eax
call fcn.0042a5a2
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x42a6be
mov eax, dword [eax + 4]
jmp 0x42a6c1
add eax, 4
push eax
push dword [ebp - 0x14]
call edi
push ebx
push 1
lea esi, [ebp - 0x30]
call fcn.00409726
lea esi, [ebp - 0x14]
call fcn.0040ca6b
call fcn.0044bfa1
ret
Function at 0x42b782
Capabilities:
Delete file

Disassembly:
push 0x2c
mov eax, 0x4664dc
call fcn.0044bf32
mov esi, ecx
push edi
mov ebx, str.deleteDesktopShortcut____S
push ebx
mov dword [ebp - 0x34], esi
call fcn.00409015
xor esi, esi
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push 6
push eax
call fcn.0042cbd0
add esp, 0x1c
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], esi
je 0x42b845
mov eax, dword [0x497b04]
mov ecx, 0x497b04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x42b7e1
lea eax, [ebp - 0x28]
push edi
push eax
push str._s_s.lnk
lea eax, [ebp - 0x30]
call fcn.00423675
add esp, 0xc
push dword [ebp - 0x30]
call fcn.0042d09c
pop ecx
test al, al
je 0x42b83d
push dword [ebp - 0x30]
mov esi, dword [ebp - 0x34]
push ebx
call fcn.00409015
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
lea eax, [ebp - 0x30]
inc bl
call fcn.0040ebb7
xor esi, esi
push esi
push 1
lea esi, [ebp - 0x2c]
call fcn.00409726
mov al, bl
call fcn.0044bfb5
ret
lea eax, [ebp - 0x30]
call fcn.0040ebb7
xor bl, bl
jmp 0x42b82a

Function at 0x42b849
Capabilities:
Delete file

Disassembly:
push 0x2c
mov eax, 0x4664dc
call fcn.0044bf32
mov eax, dword [ebp + 0xc]
push eax
mov edi, str.deleteProgramsShortcut____S
mov esi, ecx
push edi
mov dword [ebp - 0x34], eax
call fcn.00409015
xor eax, eax
xor ebx, ebx
cmp byte [ebp + 8], bl
push 1
sete al
push ebx
push ebx
add eax, 3
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0042cbd0
add esp, 0x1c
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x42b8ef
mov eax, dword [0x497b04]
mov ecx, 0x497b04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x42b8b2
lea eax, [ebp - 0x28]
push dword [ebp - 0x34]
push eax
push str._s_s.lnk
lea eax, [ebp - 0x30]
call fcn.00423675
add esp, 0xc
push dword [ebp - 0x30]
call fcn.0042d09c
pop ecx
test al, al
je 0x42b8e7
push dword [ebp - 0x30]
push edi
call fcn.00409015
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x30]
call fcn.0040ebb7
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.00409726
call fcn.0044bfb5
ret
Function at 0x42c0db
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2898
call fcn.0045b300
mov eax, dword [0x48e190]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2898], 0
push esi
lea eax, [ebp - 0x2898]
push eax
lea eax, [ebp - 0x2894]
push eax
mov esi, ecx
mov dword [ebp - 0x2898], 0x2880
call sub.IPHLPAPI.DLL_GetAdaptersInfo
lea eax, [ebp - 0x2894]
mov ecx, dword [eax + 0x1a0]
cmp ecx, 6
je 0x42c15b
cmp ecx, 0x47
je 0x42c15b
mov eax, dword [eax]
test eax, eax
jne 0x42c11f
and dword [ebp - 0x14], eax
push edi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
push dword [ebp - 0x14]
push str._08X
call fcn.0042c7fe
pop ecx
pop ecx
pop edi
jmp 0x42c1a8
movzx ecx, byte [eax + 0x19b]
push ecx
movzx ecx, byte [eax + 0x19a]
push ecx
movzx ecx, byte [eax + 0x199]
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
push str._02x_02x_02x_02x_02x_02x_02x_02x
call fcn.0042c7fe
add esp, 0x24
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00447a6d
leave
ret
Function at 0x42dfef
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x48e190]
xor eax, esp
mov dword [esp + 0x194], eax
push 0x498b40
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x42e031
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push eax
push 0x498b44
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.00447a6d
mov esp, ebp
pop ebp
ret

Function at 0x42e1e5
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
push 0xffffffffffffffff
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x498b28
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0
push dword [esi + 4]
test eax, eax
je 0x42e22d
call dword [sym.imp.KERNEL32.dll_TerminateThread]
leave
ret
push method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_52
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
leave
ret
Function at 0x42e245
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
xor edi, edi
push edi
push edi
push 1
push edi
call ebx
mov dword [esp + 8], eax
mov dword [esi + 4], eax
cmp eax, edi
jne 0x42e29d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
call fcn.00412e23
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
mov ecx, str.thread.entry_event
call fcn.0042de79
pop ecx
push edi
push edi
push 1
push edi
call ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 8], eax
mov dword [esi + 8], eax
cmp dword [ebx + 8], edi
jne 0x42e2e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
call fcn.00412e23
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
mov ecx, str.thread.exit_event
call fcn.0042de79
pop ecx
lea eax, [esp + 0x14]
push eax
push edi
push esi
push 0x42e37b
push edi
push edi
mov dword [esp + 0x2c], edi
call fcn.0044aa32
add esp, 0x18
mov dword [ebx + 4], eax
cmp eax, edi
jne 0x42e357
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
cmp dword [esp + 8], edi
je 0x42e328
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebx + 8]
cmp ebx, edi
je 0x42e336
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
call fcn.00412e23
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
mov ecx, str.thread
call fcn.0042de79
pop ecx
cmp dword [esp + 8], edi
je 0x42e373
push 0xffffffffffffffff
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42ebb9
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
push edi
mov esi, eax
je 0x42ec7e
cmp byte [ebp + 0x10], 0
je 0x42ec02
mov edi, dword [ebp + 0xc]
test byte [edi], 8
je 0x42ec02
xor eax, eax
mov word [ebp - 8], ax
mov word [ebp - 6], ax
call fcn.00412e23
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov eax, edi
call fcn.0042f031
pop ecx
pop ecx
mov edi, dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
call edi
push dword [ebp + 8]
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
call ebx
push eax
call fcn.0043569d
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x42ec7e
call fcn.00412e23
cmp dword [esi + 4], eax
jne 0x42ec37
cmp dword [esi], 0x2733
je 0x42ec49
call fcn.00412e23
cmp dword [esi + 4], eax
jne 0x42ec78
cmp dword [esi], 0x4d5
jne 0x42ec78
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x8004667e
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp + 0xc]
and byte [eax], 0xfc
push 0
call edi
push dword [ebp + 8]
call ebx
push eax
call fcn.0043569d
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42ec8a
xor edi, edi
call fcn.00412e23
mov dword [esi], edi
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42ec92
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, eax
cmp ebx, 0xffffffff
jne 0x42eca8
mov edi, 0x2719
jmp 0x42ecc9
xor edi, edi
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.WS2_32.dll_connect]
push eax
call fcn.0043569d
pop ecx
test eax, eax
jne 0x42ecd3
call fcn.00412e23
mov dword [esi + 4], eax
mov dword [esi], edi
mov edi, 0x2734
call fcn.00412e23
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov ecx, esi
mov dword [ebp - 0xc], edi
call fcn.0042de5a
test al, al
je 0x42ed0b
dec edi
call fcn.00412e23
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov ecx, esi
mov dword [ebp - 0xc], edi
call fcn.0042de5a
test al, al
jne 0x42ed46
mov eax, esi
mov ecx, ebx
call fcn.0042f1f9
test eax, eax
jl 0x42ed46
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push ebx
mov eax, esi
lea ecx, [ebp - 8]
mov dword [ebp - 8], 4
call fcn.0042f094
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x42ed46
call fcn.00412e23
mov ecx, dword [ebp - 4]
mov dword [esi], ecx
mov dword [esi + 4], eax
pop edi
pop esi
leave
ret
Function at 0x42f105
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
mov edi, ecx
mov esi, eax
cmp edi, 0xffffffff
jne 0x42f12e
mov edi, 0x2719
call fcn.00412e23
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
jmp 0x42f17a
xor ebx, ebx
push ebx
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0x110], 1
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x110]
push eax
inc edi
push edi
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.0043569d
mov edi, eax
pop ecx
cmp edi, ebx
je 0x42f16e
jle 0x42f178
call fcn.00412e23
mov dword [esi + 4], eax
mov dword [esi], ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42f17f
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
mov edi, ecx
mov esi, eax
cmp edi, 0xffffffff
jne 0x42f1a8
mov edi, 0x2719
call fcn.00412e23
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
jmp 0x42f1f4
xor ebx, ebx
push ebx
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0x110], 1
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
push ebx
lea eax, [ebp - 0x110]
push eax
push ebx
inc edi
push edi
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.0043569d
mov edi, eax
pop ecx
cmp edi, ebx
je 0x42f1e8
jle 0x42f1f2
call fcn.00412e23
mov dword [esi + 4], eax
mov dword [esi], ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42f1f9
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
push edi
mov edi, ecx
mov esi, eax
cmp edi, 0xffffffff
jne 0x42f221
mov edi, 0x2719
call fcn.00412e23
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
jmp 0x42f27b
xor eax, eax
inc eax
push 0
mov dword [ebp - 0x208], edi
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x104], edi
mov dword [ebp - 0x108], eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
inc edi
push edi
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.0043569d
pop ecx
mov dword [ebp - 4], eax
test eax, eax
jl 0x42f278
xor edi, edi
call fcn.00412e23
mov dword [esi], edi
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x4341b4
Capabilities:
Resolve dns

Disassembly:
push 0x64
mov eax, 0x467305
call fcn.0044bec9
mov edi, ecx
lea eax, [ebp - 0x70]
xor ebx, ebx
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
call fcn.00434c4e
mov esi, eax
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 1
call fcn.00434c33
cmp dword [esi + 0x18], 0x10
jb 0x4341f6
mov ecx, dword [esi + 4]
jmp 0x4341f9
lea ecx, [esi + 4]
cmp dword [eax + 0x18], 0x10
jb 0x434204
mov esi, dword [eax + 4]
jmp 0x434207
lea esi, [eax + 4]
mov dword [ebp - 0x1c], ecx
cmp esi, ebx
je 0x434213
cmp byte [esi], 0
jne 0x434215
xor esi, esi
cmp ecx, ebx
je 0x43421e
cmp byte [ecx], 0
jne 0x434221
mov dword [ebp - 0x1c], ebx
push ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov ecx, eax
lea esi, [ebp - 0x20]
call fcn.0042f27f
mov ecx, dword [eax]
mov dword [edi], ecx
mov eax, dword [eax + 4]
push ebx
push 1
lea ecx, [ebp - 0x54]
mov dword [edi + 4], eax
call fcn.0040948e
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.0040948e
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], esi
push 2
pop ebx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
neg eax
sbb eax, eax
test eax, fcn.0040c8b2
je 0x434297
xor edi, edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], 1
jmp 0x4342e4
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00434c4e
mov edi, eax
lea eax, [ebp - 0x70]
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 4
mov dword [ebp - 0x14], ebx
call fcn.00434c33
mov dword [ebp - 4], 5
push dword [ebp - 0x18]
lea ecx, [ebp - 0x38]
push ecx
mov edx, edi
mov ecx, eax
mov dword [ebp - 0x14], 6
call fcn.00434c69
pop ecx
pop ecx
mov dword [ebp - 0x14], 0xe
xor edi, edi
mov edx, eax
mov eax, dword [ebp + 8]
call fcn.00432fc5
or dword [ebp - 0x14], 0x10
test byte [ebp - 0x14], 8
je 0x434304
and dword [ebp - 0x14], 0xfffffff7
lea eax, [ebp - 0x34]
call fcn.004018fc
test byte [ebp - 0x14], 4
je 0x434319
and dword [ebp - 0x14], 0xfffffffb
push edi
push 1
lea ecx, [ebp - 0x70]
call fcn.0040948e
test byte [ebp - 0x14], bl
je 0x43432d
and dword [ebp - 0x14], 0xfffffffd
push edi
push 1
lea ecx, [ebp - 0x54]
call fcn.0040948e
mov dword [ebp - 4], ebx
test byte [ebp - 0x14], 1
je 0x434342
and dword [ebp - 0x14], 0xfffffffe
lea eax, [ebp - 0x28]
call fcn.004018fc
cmp esi, edi
je 0x43434d
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, dword [ebp + 8]
call fcn.0044bfa1
ret 8