joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415560
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x619812
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push str.RemoveStaleClient
lea ecx, [ebp - 0x20]
call fcn.005f79ea
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
push ecx
lea ecx, [ebp - 0x18]
call fcn.004164a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.005f797c
mov edx, 1
test edx, edx
je 0x4155c6
mov dword [ebp - 0x24], 0
jmp 0x4155d6
push str.CIOCPServer::RemoveStaleClient_n
call fcn.0040c170
add esp, 4
mov dword [ebp - 0x24], eax
cmp dword [ebp + 0xc], 0
jne 0x415604
mov word [ebp - 0x1c], 1
mov word [ebp - 0x1a], 0
push 4
lea eax, [ebp - 0x1c]
push eax
push 0x80
push 0xffff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.00415fe0
test eax, eax
je 0x415661
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0xffffffff
je 0x415642
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_CancelIo]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp + 8]
mov dword [eax], 0xffffffff
push 2
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
call dword [ecx + 4]
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00415740
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00416510
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x415a70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6198ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push 0x18
call fcn.005f2f36
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0
je 0x415aba
push 2
mov ecx, dword [ebp - 0x24]
call fcn.00416610
mov dword [ebp - 0x2c], eax
jmp 0x415ac1
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0x8000
push 3
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0x10]
call dword [edx + 4]
push 0
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.00403930
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1907c], eax
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.00403700
mov edx, dword [ebp + 8]
mov dword [edx + 0x19078], eax
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x19078
push edx
push 1
mov eax, dword [ebp + 8]
add eax, 0x19078
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_WSASend]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x415b75
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x415b75
cmp dword [ebp - 0x14], 0
je 0x415b71
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.005f2f5f
add esp, 4
xor eax, eax
jmp 0x415b7a
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4182d0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x4182e3
xor eax, eax
jmp 0x41833d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4182fb
mov eax, dword [ebp - 4]
jmp 0x41833d
mov dword [ebp - 0x14], 0
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
push 0x10
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0047ff00
add esp, 0xc
push 4
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
lea eax, [ebp - 4]
push eax
call fcn.0047ff00
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418950
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e8
push ebx
push esi
push edi
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov word [ebp - 0x1a0], 2
push 0x2aef
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x19e], ax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004182d0
add esp, 4
mov dword [ebp - 0x19c], eax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x1a4], eax
push 0x10
lea edx, [ebp - 0x1a0]
push edx
mov eax, dword [ebp - 0x1a4]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4189d9
mov ecx, dword [ebp - 0x1a4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x4189fe
lea edx, [ebp - 0x1a8]
push edx
push 0
mov eax, dword [ebp - 0x1a4]
push eax
push 0x4183c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x1a4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427100
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x42711a
jmp 0x42717c
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 0xc]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x427176
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0047ff00
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 8]
push eax
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x427190
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4271ad
jmp 0x427266
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4271c9
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x427266
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
push edx
call fcn.005f2f36
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov byte [ecx], 0x1b
mov edx, dword [ebp - 0xc]
sub edx, 1
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 1
push ecx
call fcn.0047ff00
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1e0]
push eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x1e4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1e4]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.005f2f5f
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42aff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
add ecx, 0xc
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
add edx, 0x1a
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov dword [eax], 0x61746164
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], 0x20746d66
mov edx, dword [ebp - 0x3c]
mov dword [edx + 4], 0x12
push 0x12
mov eax, dword [ebp - 4]
add eax, 8
push eax
mov ecx, dword [ebp - 0x3c]
add ecx, 8
push ecx
call fcn.0047ff00
add esp, 0xc
mov edx, dword [ebp - 0x38]
mov dword [edx], 0x46464952
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
add ecx, 0x26
mov edx, dword [ebp - 0x38]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x38]
mov dword [eax + 8], 0x45564157
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x44], 0
push 0
lea eax, [ebp - 0x44]
push eax
push 0x2e
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x42b0bb
cmp dword [ebp - 0x44], 0x2e
je 0x42b0c0
or eax, 0xffffffff
jmp 0x42b0c2
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b520
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61ac39
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
push 0xa9
mov ecx, dword [ebp - 0x10]
call fcn.005f3454
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x5c
call fcn.0043c3b0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x6c
call fcn.00496b30
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x190
call fcn.0049b570
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x220
call fcn.00402bf0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x224
call fcn.00402bf0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x228
call fcn.00402bf0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x230
call fcn.00402bf0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x238
call fcn.00499fb0
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c8
call fcn.004975d0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0x394
call fcn.00402bf0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
mov dword [ecx], method.CDialog.virtual_0
push 0x64dbb8
mov ecx, dword [ebp - 0x10]
add ecx, 0x220
call fcn.005f7b05
push 0x64dbb8
mov ecx, dword [ebp - 0x10]
add ecx, 0x224
call fcn.005f7b05
push 0x64dbb8
mov ecx, dword [ebp - 0x10]
add ecx, 0x228
call fcn.005f7b05
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x22c], 0
push 0x64dbb8
mov ecx, dword [ebp - 0x10]
add ecx, 0x230
call fcn.005f7b05
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x234], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x390], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x38c], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x3c0], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x3a8], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x3a4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x3a0], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x39c], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x398], 0xd3d
push 0x110
push 0x160
lea edx, [ebp - 0x170]
push edx
push 0x80
push 0x64e338
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push 0x4001
push 0x160
lea eax, [ebp - 0x170]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov dword [ebp - 0x174], eax
mov ecx, dword [ebp - 0x174]
push ecx
call fcn.005f1493
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x68], eax
push 0x7f04
call fcn.00416ef0
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x388], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42dcd0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x42dce7
jmp 0x42dd57
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [ebp + 8]
call fcn.00402c20
add eax, 1
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42dd51
mov ecx, dword [ebp + 8]
call fcn.00402c20
push eax
push 0
mov ecx, dword [ebp + 8]
call fcn.005f7dac
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call fcn.0047ff00
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 4]
push edx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43c450
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push 0x8004667e
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp dword [ebp - 4], 0
jle 0x43c4bc
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x43c4a8
jmp 0x43c4bc
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
jmp 0x43c480
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c770
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x43c795
xor eax, eax
jmp 0x43c81a
mov word [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
mov word [ebp - 0x14], 2
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov dx, word [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x43c7dc
jmp 0x43c818
push 3
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WS2_32.dll_listen]
mov eax, dword [0x89126c]
add eax, 1
mov dword [0x89126c], eax
mov ecx, dword [0x89126c]
mov edx, dword [ebp - 4]
mov dword [ecx*4 + 0x89026c], edx
mov eax, dword [ebp - 4]
jmp 0x43c81a
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x43c81a
jmp 0x43c80a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43c830
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
mov word [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
mov dword [ebp - 0x14], 0x10
push 0
push 0
call fcn.0043c770
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
ja 0x43c86c
jmp 0x43c8ab
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x43c885
jmp 0x43c8a9
mov cx, word [ebp - 0xe]
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov edx, dword [ebp + 8]
mov word [edx], ax
mov eax, dword [ebp - 0x18]
jmp 0x43c8ad
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x43c8ad
jmp 0x43c89b
jmp 0x43c89b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43cc40
Capabilities:
Contain obfuscated stackstrings
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov byte [0x892274], 0
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x1c], 0x4b
mov byte [ebp - 0x1b], 0x45
mov byte [ebp - 0x1a], 0x52
mov byte [ebp - 0x19], 0x4e
mov byte [ebp - 0x18], 0x45
mov byte [ebp - 0x17], 0x4c
mov byte [ebp - 0x16], 0x33
mov byte [ebp - 0x15], 0x32
mov byte [ebp - 0x14], 0x2e
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x6c
mov byte [ebp - 0x11], 0x6c
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
push 0x64
call dword [ebp - 0x20]
cmp dword [0x89126c], 0
je 0x43cd19
mov edx, dword [0x89126c]
push edx
push 0x653e3c
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [0x89126c]
cmp dword [ecx*4 + 0x89026c], 0xffffffff
je 0x43cd08
mov edx, dword [0x89126c]
mov eax, dword [edx*4 + 0x89026c]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [0x89126c]
sub ecx, 1
mov dword [0x89126c], ecx
jmp 0x43ccbf
cmp dword [0x892278], 0
je 0x43cd63
mov edx, dword [0x892278]
cmp dword [edx*4 + 0x891274], 0xffffffff
je 0x43cd52
push 0
mov eax, dword [0x892278]
mov ecx, dword [eax*4 + 0x891274]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0x891274
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x892278]
sub edx, 1
mov dword [0x892278], edx
jmp 0x43cd19
mov dword [0x892278], 0
mov dword [0x89126c], 0
mov byte [0x892274], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43f910
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push esi
mov esi, dword [esp + 0x2c]
cmp byte [esi + 2], 1
je 0x43f928
mov eax, 0xfffffffc
pop esi
add esp, 0x24
ret
mov dword [esi + 4], 0x10302
mov dword [esi + 8], str.xvid_1.3.2
call fcn.0043f830
mov dword [esi + 0xc], eax
lea eax, [esp + 4]
push eax
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [esi + 0x10], ecx
pop esi
add esp, 0x24
ret
Function at 0x476630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
lea edx, [eax + 0x50]
lea ecx, [eax + 8]
push edi
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0x3ff00000
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0x3ff00000
xor eax, eax
fld qword [ecx]
fadd qword [edx]
add eax, 8
add ecx, 8
sub edx, 8
cmp eax, 0x20
fsub qword [esp + eax + 0x48]
fstp qword [esp + eax + 0x50]
fld qword [ecx - 8]
fsub qword [edx + 8]
fadd qword [esp + eax + 0x78]
fstp qword [esp + eax + 0x80]
jle 0x476672
mov eax, dword [0x86a018]
mov ecx, dword [0x86a01c]
mov dword [esp + 0x10], eax
lea edx, [esp + 0x50]
mov dword [esp + 0x14], ecx
push 5
mov eax, ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x44], ebx
lea edi, [esp + 0x60]
call fcn.00476860
mov edx, dword [ebp + 0xc]
add esp, 0x10
mov dword [esp + 0x44], edx
mov esi, 0x86a018
cmp esi, 0x86a1a8
jge 0x47682d
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 8]
add esi, 8
fstp qword [esp + 0x28]
mov dword [esp + 0x38], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x3c], ecx
push 5
mov ecx, eax
push edi
push ecx
push edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
call fcn.00476860
fst qword [esp + 0x58]
fld qword [esp + 0x38]
fmul st(1)
add esp, 0x10
fcomp qword [0x65c4a8]
fnstsw ax
test ah, 0x41
je 0x47681b
fstp st(0)
sub esi, 8
mov ebx, 2
fld qword [esp + 0x38]
fadd qword [esp + 0x10]
push 5
push edi
fmul qword [0x65c4a0]
fstp qword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
push ecx
call fcn.00476860
fld st(0)
fmul qword [esp + 0x58]
add esp, 0x10
fcomp qword [0x65c4a8]
fnstsw ax
test ah, 0x41
je 0x476794
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
fstp qword [esp + 0x28]
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], eax
jmp 0x4767a8
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
fstp qword [esp + 0x48]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
dec ebx
jne 0x476744
fld qword [esp + 0x38]
fsub qword [esp + 0x10]
mov eax, dword [esp + 0x44]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x34]
add eax, 8
fmul qword [esp + 0x48]
fld qword [esp + 0x28]
fsub qword [esp + 0x48]
mov dword [esp + 0x44], eax
inc edi
mov dword [esp + 0x1c], edi
lea edi, [esp + 0x80]
fdivp st(1)
fsubr qword [esp + 0x10]
fst qword [esp + 0x28]
fld st(0)
fstp qword [eax - 8]
mov eax, 1
sub eax, ecx
mov dword [esp + 0x34], eax
jne 0x4767fe
lea edi, [esp + 0x50]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
fstp qword [esp + 0x10]
push 5
push edi
push ecx
push edx
call fcn.00476860
mov ebx, dword [esp + 0x2c]
add esp, 0x10
cmp ebx, 0xa
jl 0x4766df
fstp st(0)
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0xa
fstp st(0)
jge 0x476853
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
sub ecx, eax
mov edx, 0xa
mov esi, dword [ecx + eax]
mov dword [eax], esi
mov esi, dword [ecx + eax + 4]
mov dword [eax + 4], esi
add eax, 8
dec edx
jne 0x476841
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret