joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f730
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x4c
push ebx
push ebp
mov ebp, dword [esp + 0x60]
push esi
mov esi, eax
push edi
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x40f75a
mov eax, 0x200
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
mov eax, dword [esp + 0x28]
mov edx, eax
xor edi, edi
and edx, 1
je 0x40f773
mov dword [esp + 0x14], 1
mov edi, dword [esp + 0x14]
test al, 2
je 0x40f77a
or edi, 2
test al, 4
je 0x40f781
or edi, 4
mov ecx, eax
and ecx, 0x10
je 0x40f78b
or edi, 0x10
test al, 0x20
je 0x40f792
or edi, 0x20
test ecx, ecx
je 0x40f79e
or edi, 0x40000000
jmp 0x40f7a4
or edi, 0x80000000
or edi, 0x1000000
mov dword [esp + 0x14], edi
test edx, edx
jne 0x40f7bc
or edi, 0x800000
mov dword [esp + 0x14], edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x1c], eax
cmp eax, 0x28
jbe 0x40f870
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 2
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea ecx, [esp + 0x2c]
push ecx
push esi
call ebx
mov edx, 0x54ad
cmp word [esp + 0x10], dx
jne 0x40f86c
mov eax, dword [esp + 0x20]
lea ecx, [eax + 0x34]
cmp dword [esp + 0x1c], ecx
jbe 0x40f86c
push 0
push 0
push eax
push esi
call edi
push 0
lea edx, [esp + 0x1c]
push edx
push 4
lea eax, [esp + 0x30]
push eax
push esi
call ebx
mov eax, dword [esp + 0x24]
cmp eax, 0x5a4d
je 0x40f864
cmp eax, 0x454e
je 0x40f864
cmp eax, 0x454c
je 0x40f864
cmp eax, 0x4550
jne 0x40f86c
or dword [esp + 0x14], 0x400000
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x60]
test eax, eax
je 0x40f87a
mov dword [eax], edi
mov eax, dword [esp + 0x64]
test eax, eax
je 0x40f888
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
test ebp, ebp
je 0x40f906
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
push 0
sub edx, 0xd53e8000
push 0x989680
sbb eax, 0x19db1de
push eax
push edx
call fcn.00449630
mov dword [ebp + 4], edx
push 0
mov ecx, edi
sub ecx, 0xd53e8000
mov edx, esi
push 0x989680
sbb edx, 0x19db1de
push edx
push ecx
mov dword [ebp], eax
call fcn.00449630
mov ecx, dword [esp + 0x30]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x2c]
push 0
sub eax, 0xd53e8000
push 0x989680
sbb ecx, 0x19db1de
push ecx
push eax
mov dword [ebp + 0xc], edx
call fcn.00449630
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], edx
mov ebx, dword [esp + 0x6c]
test ebx, ebx
je 0x40f933
push esi
push edi
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.0040f6c0
movzx ecx, word [esp + 0x20]
movzx edx, word [esp + 0x24]
shl ecx, 0x10
add esp, 0x10
or ecx, edx
mov dword [ebx], ecx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret
Function at 0x40f9e0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
je 0x40fabb
mov eax, dword [esi + 0x3c]
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x40fa14
cmp dword [esi + 0x40], edi
jae 0x40fa14
push eax
call fcn.00445523
add esp, 4
mov dword [esi + 0x3c], ebp
cmp dword [esi + 0x3c], ebp
jne 0x40fa2b
lea eax, [edi + edi]
push eax
call fcn.00445674
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call fcn.00448250
add esp, 0xc
cmp edi, ebp
jbe 0x40fab7
lea ecx, [ecx]
mov edx, dword [esi + 0x3c]
mov bl, byte [edx + ebp]
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x38]
movsx ecx, bl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x462c30]
shr edi, 8
xor ecx, edi
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x462c30]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, bl
mov byte [ecx + ebp], al
inc ebp
cmp ebp, dword [esp + 0x18]
jb 0x40fa40
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x3c]
pop ebp
mov edx, dword [esi + 0x20]
test edx, edx
je 0x40faf4
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x40fadc
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
ret 8
push edi
push eax
add ecx, edx
push ecx
call fcn.00448250
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x40fb15
push 0
lea edx, [esp + 0x18]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
ret 8

Function at 0x40fdc0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esi + 0x84]
push edi
test ecx, ecx
je 0x40fe0e
mov eax, dword [esi + 0x8c]
mov edi, dword [esi + 0x88]
cmp eax, edi
jae 0x40fe4b
sub edi, eax
cmp edi, edx
jbe 0x40fde4
mov edi, edx
push edi
add eax, ecx
push eax
push ebx
call fcn.00448250
mov eax, dword [esi + 0x78]
add dword [esi + 0x8c], edi
add dword [esi + 0x74], edi
add esp, 0xc
mov edx, edi
mov ecx, ebx
call fcn.0040f490
mov dword [esi + 0x78], eax
mov eax, edi
pop edi
pop ecx
ret
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x40fe44
push 0
lea ecx, [esp + 8]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40fe4b
mov edi, dword [esp + 4]
mov eax, dword [esi + 0x78]
add dword [esi + 0x74], edi
mov edx, edi
mov ecx, ebx
call fcn.0040f490
mov dword [esi + 0x78], eax
mov eax, edi
pop edi
pop ecx
ret
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop ecx
ret
Function at 0x411c60
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 3
jne 0x411c82
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x411c76
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x411cb2
cmp dword [esi + 8], 0
jne 0x411ca5
mov ecx, dword [eax + 8]
push 0x461928
push ecx
call fcn.00445c21
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x411ca5
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.0045bf59
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x411cd4
mov eax, dword [esi + 8]
test eax, eax
je 0x411cce
push eax
call fcn.00445caf
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret

Function at 0x411df0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x19c
mov eax, dword [0x46e074]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x411e42
mov eax, dword [esp]
cmp al, 2
jne 0x411e3c
shr eax, 8
cmp al, 2
jne 0x411e3c
xor eax, eax
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.004453f2
add esp, 0x19c
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x194]
xor ecx, esp
mov eax, 2
call fcn.004453f2
add esp, 0x19c
ret
Function at 0x411f30
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x14], ebx
xor esi, esi
cmp ebx, esi
jne 0x4120b8
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov edi, edx
mov edx, dword [esp + 0x24]
shr edi, 6
mov eax, edi
imul eax, eax, 0x3e8
sub ecx, eax
imul ecx, ecx, 0x3e8
mov ebp, ecx
lea ecx, [esp + 0x18]
push ecx
push edx
call fcn.004152c0
mov ebx, eax
add esp, 8
cmp ebx, esi
jne 0x411f3d
cmp dword [esp + 0x18], esi
jne 0x412030
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov esi, edx
shr esi, 6
mov eax, esi
imul eax, eax, 0x3e8
sub ecx, eax
imul ecx, ecx, 0x3e8
mov eax, ecx
push 0
sub eax, ebp
cdq
push 0x3e8
push edx
push eax
call fcn.00449630
mov ebx, eax
mov eax, esi
sub eax, edi
imul eax, eax, 0x3e8
mov ecx, edx
cdq
add ebx, eax
adc ecx, edx
test ecx, ecx
jg 0x412026
jl 0x411fe8
cmp ebx, 0xa
ja 0x412026
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 2
mov dword [esp + 0x14], eax
jle 0x412034
cmp eax, 0xa
jge 0x412018
lea ecx, [eax - 1]
mov eax, 1
shl eax, cl
test eax, eax
je 0x412034
jge 0x41201d
push 0x2726
call dword [sym.imp.WS2_32.dll_WSASetLastError]
jmp 0x412034
mov eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x412034
mov dword [esp + 0x14], 0
jmp 0x412034
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x1c]
push ecx
call fcn.00416800
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x411f3d
cmp dword [esp + 0x1c], eax
jne 0x411f3d
mov dword [esp + 0x18], eax
cmp dword [esp + 0x24], eax
je 0x411f3d
mov edx, dword [esp + 0x24]
cmp dword [edx], 0xbab1e
jne 0x411f3d
mov eax, edx
mov ecx, dword [eax + 0x14]
cmp dword [ecx + 0xc], ebx
je 0x411f3d
mov edi, dword [edx + 0x14]
mov esi, dword [edi]
mov ebp, dword [esi]
push ebx
call fcn.00425f30
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x14]
mov edx, dword [ecx + 0xc]
and edx, 0x7fffffff
add esp, 4
mov dword [esp + 0x18], edx
test ebp, ebp
je 0x411f3d
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x4120c7
sub ebx, 3
neg ebx
sbb ebx, ebx
and ebx, 0x10
add ebx, 0x1b
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x413eb0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x32c
push ebx
mov ebx, dword [eax + ecx*4 + 0x1a0]
mov edx, ecx
shl edx, 4
push esi
lea esi, [edx + eax + 0x1c8]
mov edx, dword [esi + 4]
sub edx, dword [esi + 8]
push edi
mov edi, dword [eax + 0x310]
test byte [edi + 0x3c], 3
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edx
je 0x41403d
cmp dword [eax + ecx*4 + 0x1b8], 0x414440
jne 0x41403d
xor edi, edi
cmp dword [esi], edi
je 0x413f0f
cmp edx, edi
je 0x41403d
cmp ebx, 0xffffffff
jne 0x413f1b
xor eax, eax
jmp 0x413fef
mov eax, 1
xor ecx, ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x230], ecx
inc ebx
jmp 0x413f4f
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x230]
xor edi, edi
lea edx, [esp + 0x18]
push edx
neg ecx
sbb ecx, ecx
lea edx, [esp + 0x12c]
push edx
lea edx, [esp + 0x238]
and ecx, edx
push ecx
neg eax
sbb eax, eax
lea ecx, [esp + 0x2c]
and eax, ecx
push eax
push ebx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call dword [sym.imp.WS2_32.dll_select]
mov edi, eax
cmp edi, 0xffffffff
jne 0x413fa5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x413f42
cmp dword [0x470818], 0
jne 0x413fa5
cmp eax, 0x2714
je 0x413f42
test edi, edi
jl 0x41403d
mov ebx, dword [esp + 0x14]
jne 0x413fb7
xor eax, eax
jmp 0x413fe9
lea edx, [esp + 0x20]
push edx
push ebx
xor edi, edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x413fcd
mov edi, 1
lea eax, [esp + 0x128]
push eax
push ebx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x413fe2
or edi, 4
mov eax, edi
cmp edi, 0xffffffff
je 0x41403d
mov edx, dword [esp + 0x10]
xor edi, edi
test al, 1
je 0x41403d
cmp dword [esi], edi
jne 0x41401d
push 0x8000
mov dword [esi + 4], 0x8000
call dword [0x46f550]
mov ecx, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
cmp eax, edi
je 0x41403a
mov edx, ecx
push edi
push edx
mov edx, dword [esi]
add edx, dword [esi + 8]
push edx
push ebx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, edi
jle 0x41403d
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 4], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414370
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esi + ecx*4 + 0x1a0]
mov eax, esi
call fcn.00413eb0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push 0
push eax
push ecx
push edi
call dword [sym.imp.WS2_32.dll_send]
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [ebp], 0
cmp ebx, 0xffffffff
jne 0x4143f7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x4143cd
xor eax, eax
mov dword [ebp], 0x51
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call fcn.00412840
add esp, 4
push eax
mov eax, dword [esi]
push str.Send_failure:__s
call fcn.00414140
mov edx, dword [esi]
mov dword [edx + 0x8700], edi
add esp, 8
mov dword [ebp], 0x37
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x414890
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xa8
mov eax, dword [0x46e074]
xor eax, esp
mov dword [esp + 0xa4], eax
cmp dword [esi + 0x370], 0
mov eax, dword [esp + 0xb4]
push ebp
mov ebp, dword [esp + 0xb0]
push edi
je case.default.0x4148e0
test eax, eax
je case.default.0x4148e0
mov eax, dword [eax + 0x9c]
test eax, eax
je case.default.0x4148e0
lea edx, [ebx - 1]
mov ecx, str.Data
cmp edx, 3
ja case.default.0x4148e0
jmp dword [edx*4 + 0x414a0c]
mov ecx, str.Header
mov edx, str.from
jmp 0x4148fd
mov ecx, str.Header
mov edx, 0x46450c
push eax
push edx
push ecx
push str.__s__s__s_
lea eax, [esp + 0x18]
push 0xa0
push eax
call fcn.00413a70
lea eax, [esp + 0x20]
add esp, 0x18
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414920
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x41498a
mov ecx, dword [esi + 0x134]
push ecx
push edi
lea edx, [esp + 0x10]
push edx
push 0
push esi
call eax
add esp, 0x14
test eax, eax
jne 0x4149f5
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x4149b8
mov ecx, dword [esi + 0x134]
mov edx, dword [esp + 0xb8]
push ecx
push edx
push ebp
push ebx
push esi
call eax
add esp, 0x14
pop edi
pop ebp
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.004453f2
add esp, 0xa8
ret
mov eax, dword [esi + 0x130]
push eax
push 1
push 2
push 0x4629e4
call fcn.00445f8c
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [esp + 0x20]
push edi
push edx
call fcn.00445f8c
add esp, 0x20
jmp case.default.0x4148e0
test ebx, ebx
jl 0x4149f3
cmp ebx, 2
jg 0x4149f3
mov eax, dword [esi + 0x130]
push eax
push 1
lea ecx, [ebx + ebx*2 + 0x4629e4]
push 2
push ecx
call fcn.00445f8c
mov edx, dword [esi + 0x130]
mov eax, dword [esp + 0xc8]
push edx
push 1
push eax
push ebp
call fcn.00445f8c
add esp, 0x20
xor eax, eax
mov ecx, dword [esp + 0xac]
pop edi
pop ebp
xor ecx, esp
call fcn.004453f2
add esp, 0xa8
ret
Function at 0x41a4a0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x328
push ebp
push esi
xor ebp, ebp
push edi
mov eax, 1
cmp ebx, 0xffffffff
je 0x41a575
xor ecx, ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x124], ebx
mov dword [esp + 0x120], eax
mov dword [esp + 0x228], ecx
lea edi, [ebx + 1]
jmp 0x41a4eb
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x228]
lea edx, [esp + 0x10]
push edx
neg ecx
sbb ecx, ecx
lea edx, [esp + 0x124]
push edx
lea edx, [esp + 0x230]
and ecx, edx
push ecx
neg eax
sbb eax, eax
lea ecx, [esp + 0x24]
and eax, ecx
push eax
push edi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41a540
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, ebp
je 0x41a4e0
cmp dword [0x470818], ebp
jne 0x41a540
cmp eax, 0x2714
je 0x41a4e0
cmp esi, ebp
jl 0x41a581
je 0x41a575
lea edx, [esp + 0x18]
push edx
push ebx
xor esi, esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x41a55c
mov esi, 1
lea eax, [esp + 0x120]
push eax
push ebx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x41a571
or esi, 4
cmp esi, ebp
jne 0x41a581
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x328
ret
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x328
ret
Function at 0x41e680
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, eax
push edi
mov edi, dword [esi]
call ebx
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov eax, edx
imul eax, eax, 0x3e8
sub ecx, eax
mov eax, dword [edi + 0x614]
imul ecx, ecx, 0x3e8
push eax
mov eax, dword [edi + 0x610]
push eax
push ecx
push edx
call fcn.00421ad0
add esp, 0x10
fstp qword [edi + 0x5d8]
mov ecx, dword [esi + 0x310]
test byte [ecx + 0x40], 0x10
je 0x41e6e8
mov dword [ebp], 1
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [ebp], 0
mov dword [esi + 0x2d0], 0
cmp dword [edi + 0x4a4], 0
je 0x41e744
mov edx, dword [esi + 0x328]
push edx
call dword [0x46f554]
mov dword [esi + 0x328], 0
mov eax, dword [edi + 0x4a4]
add esp, 4
push eax
push str.User_Agent:__s_r_n
call fcn.00413b70
add esp, 8
mov dword [esi + 0x328], eax
test eax, eax
jne 0x41e744
mov eax, 0x1b
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [edi + 0x80], 0
call ebx
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov eax, edx
imul eax, eax, 0x3e8
sub ecx, eax
imul ecx, ecx, 0x3e8
cmp dword [esi + 0x1a0], 0xffffffff
mov dword [esi + 0x190], edx
mov dword [esi + 0x194], ecx
jne 0x41e7a4
mov ecx, dword [esi + 0x48]
push ecx
mov dword [esi + 0x29c], 0
call fcn.0041fd30
add esp, 4
test eax, eax
je 0x41e840
pop edi
pop esi
pop ebp
pop ebx
ret
call ebx
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov eax, edx
imul eax, eax, 0x3e8
sub ecx, eax
mov eax, dword [edi + 0x614]
imul ecx, ecx, 0x3e8
push eax
mov eax, dword [edi + 0x610]
push eax
push ecx
push edx
call fcn.00421ad0
add esp, 0x10
fstp qword [edi + 0x5e0]
call ebx
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov eax, edx
imul eax, eax, 0x3e8
sub ecx, eax
mov eax, dword [edi + 0x614]
imul ecx, ecx, 0x3e8
push eax
mov eax, dword [edi + 0x610]
push eax
push ecx
push edx
call fcn.00421ad0
push esi
fstp qword [edi + 0x5e8]
mov dword [esi + 0x29c], 1
mov dword [ebp], 1
mov ecx, dword [esi + 0x1a0]
call fcn.0041f310
add esp, 0x14
mov eax, esi
call fcn.0041b510
call ebx
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov eax, edx
imul eax, eax, 0x3e8
sub ecx, eax
imul ecx, ecx, 0x3e8
pop edi
mov dword [esi + 0x190], edx
mov dword [esi + 0x194], ecx
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x41eb80
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
xor eax, eax
cmp dword [esi + 0x528], eax
push 4
lea ecx, [esp + 4]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x41ebbf
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
mov ecx, esi
call fcn.004140b0
add esp, 8
add esp, 0x14
ret
mov eax, dword [esi + 0x530]
mov edx, dword [esi + 0x52c]
and eax, 0x7fffffff
imul eax, eax, 0x3e8
push 0
push 0
mov dword [esp + 8], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0xc]
push eax
push 0
and edx, 0x7fffffff
push 0
imul edx, edx, 0x3e8
push 0xc
lea ecx, [esp + 0x20]
push ecx
push 0x98000004
push edi
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], edx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x41ec31
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
mov ecx, esi
call fcn.004140b0
add esp, 0xc
add esp, 0x14
ret
Function at 0x41f310
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x110
mov eax, dword [0x46e074]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
cmp dword [ebp + 0x8c], 2
push esi
mov esi, dword [ebp]
push edi
mov edi, ecx
mov dword [esp + 0x14], esi
je 0x41f48f
cmp dword [ebp + 0x270], 0
jne 0x41f488
cmp dword [ebp + 0x2e0], 0
jne 0x41f488
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x9c]
push ecx
mov ebx, 0x80
push edi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x41f3a7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push ebp
call fcn.00412840
add esp, 4
push eax
push edi
push str.getpeername___failed_with_errno__d:__s
mov eax, esi
call fcn.00414140
add esp, 0xc
jmp 0x41f48f
push ebx
lea edx, [esp + 0x1c]
push 0
push edx
mov dword [esp + 0x1c], ebx
call fcn.004481d0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x41f3f7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push ebp
call fcn.00412840
add esp, 4
push eax
push edi
push str.getsockname___failed_with_errno__d:__s
mov eax, esi
call fcn.00414140
add esp, 0xc
jmp 0x41f48f
lea eax, [ebp + 0x112]
lea ebx, [ebp + 0x140]
lea edi, [esp + 0x98]
call fcn.0041f2c0
test eax, eax
jne 0x41f437
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push ebp
call fcn.00412840
add esp, 4
push eax
push edi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
mov eax, esi
call fcn.00414140
add esp, 0xc
jmp 0x41f48f
lea edi, [ebp + 0x58]
mov ecx, 0xb
lea esi, [ebp + 0x112]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ebx, [ebp + 0x174]
lea eax, [ebp + 0x144]
lea edi, [esp + 0x18]
call fcn.0041f2c0
test eax, eax
jne 0x41f488
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push ebp
call fcn.00412840
add esp, 4
push eax
mov eax, dword [esp + 0x18]
push edi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
call fcn.00414140
add esp, 0xc
jmp 0x41f48f
mov eax, ebp
call fcn.0041f250
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004453f2
add esp, 0x110
ret
Function at 0x41f940
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
push edi
push 4
mov edi, eax
mov esi, dword [edi]
lea eax, [esp + 0xc]
push eax
push 1
push 6
push ecx
mov dword [esp + 0x1c], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x41f98a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push edi
mov edi, eax
call fcn.00412840
add esp, 4
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
mov ecx, esi
call fcn.004140b0
add esp, 8
pop edi
pop esi
pop ecx
ret
push str.TCP_NODELAY_set_n
mov ecx, esi
call fcn.004140b0
add esp, 4
pop edi
pop esi
pop ecx
ret

Function at 0x41f9a0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
mov eax, dword [0x470814]
mov dword [esp + 4], 0x4020
mov dword [esp], 0
mov dword [esp + 8], 4
test eax, eax
jne 0x41f9eb
push 3
call fcn.0043e830
add esp, 4
test eax, eax
je 0x41f9df
mov dword [0x470814], 2
add esp, 0xc
ret
mov dword [0x470814], 1
jmp 0x41f9f0
cmp eax, 2
je 0x41fa30
lea eax, [esp + 8]
push eax
lea ecx, [esp + 4]
push ecx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x41fa18
mov edx, dword [esp]
cmp edx, dword [esp + 4]
jg 0x41fa30
push 4
lea eax, [esp + 8]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 0xc
ret