joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f670
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x120
push ebx
mov ebx, dword [esp + 0x128]
push ebp
xor eax, eax
push esi
mov esi, dword [esp + 0x13c]
lea ecx, [esp + 0xc]
push edi
mov edi, dword [esp + 0x13c]
xor ebp, ebp
mov dword [esp + 0x1c], eax
push ecx
mov dword [esp + 0x24], eax
push ebp
lea edx, [esp + 0x34]
push ebp
mov dword [esp + 0x30], eax
push edx
push ebp
mov dword [esp + 0x24], 0x1e
mov dword [esp + 0x28], ebp
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], 1
mov dword [esi], ebp
mov dword [esp + 0x3c], eax
mov dword [esp + 0x2c], 0x10
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x40f78b
test eax, eax
je 0x40f78b
mov edx, dword [esi]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, dword [esp + 0x140]
push 0
add edx, ecx
push edi
push edx
push ebx
call dword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
jle 0x40f78b
mov ecx, dword [esi]
sub edi, eax
add ecx, eax
mov eax, ecx
mov dword [esi], ecx
cmp eax, 0x28
jne 0x40f78b
mov eax, dword [esp + 0x138]
mov ecx, str.CMSC
mov edx, dword [eax]
cmp edx, dword [ecx]
jne 0x40f748
mov eax, dword [eax + 0x24]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
test eax, eax
jne 0x40f748
mov edi, dword [esp + 0x13c]
add ebp, 0x1e
mov dword [esi], eax
mov eax, dword [esp + 0x144]
mov dword [esp + 0x30], ebx
cmp ebp, eax
mov dword [esp + 0x2c], 1
jg 0x40f78b
test edi, edi
jle 0x40f7a4
mov eax, dword [0x4476b4]
test eax, eax
je 0x40f78b
lea ecx, [esp + 0x10]
lea edx, [esp + 0x2c]
push ecx
push 0
push 0
push edx
push 0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x40f6e1
test edi, edi
jle 0x40f7a4
cmp edi, 0x128
je 0x40f7a4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x120
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x120
ret

Function at 0x411480
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x40f9e0
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
test eax, eax
jne 0x4114ac
push str.StartSDCSClientMonitor_failed
call fcn.00411930
add esp, 4
xor eax, eax
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
ret

Function at 0x4114d0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41150f
push eax
push str._TurnOffCertRevocation__RegOpenKeyEx_failed__err_d
call fcn.00411930
add esp, 8
xor eax, eax
add esp, 8
ret
mov edx, dword [esp]
lea ecx, [esp + 4]
push 4
push ecx
push 4
push 0
push str.CertificateRevocation
push edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x411555
push eax
push str._TurnOffCertRevocation__RegSetValueEx_failed__err_d
call fcn.00411930
mov eax, dword [esp + 8]
add esp, 8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 8
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 8
ret
Function at 0x411570
Capabilities:
Create thread

Disassembly:
sub esp, 0x40c
push ebx
push esi
push edi
push str.PostLoginSuccess__...
call fcn.00411930
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], bl
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
lea ecx, [esp + 0x14]
push eax
push ecx
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x20]
push eax
push ecx
push ebx
lea edx, [esp + 0x34]
push ebx
push edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x30], ebx
call fcn.00409940
add esp, 0x24
lea eax, [esp + 0xc]
mov ecx, 0x450120
push ebx
push ebx
push eax
push 0x4476b8
call fcn.0041e760
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x41161a
push eax
push str._PostLoginSuccess__login_name___s
call fcn.00411930
mov ecx, dword [esp + 0x14]
push 0x63
push ecx
push 0x450084
call dword [sym.imp.MSVCRT.dll_strncpy]
mov edx, dword [esp + 0x20]
add esp, 0x14
mov ecx, 0x450120
push edx
call fcn.0041e5a0
call fcn.004114d0
call fcn.0040a650
cmp eax, 2
je 0x411634
cmp eax, 3
mov dword [0x4500fc], ebx
jne 0x41163e
mov dword [0x4500fc], 1
mov ecx, dword [0x4501f0]
call fcn.004114c0
mov ecx, eax
call fcn.0041f990
mov ecx, dword [0x4501f0]
push ebx
call fcn.004114c0
mov ecx, eax
call sub.MFC42.DLL_CWnd::ShowWindow
mov ecx, dword [0x4501f0]
push ebx
call fcn.004114c0
mov ecx, eax
add ecx, 0x4e8
call sub.MFC42.DLL_CWnd::ShowWindow
mov eax, dword [0x4476b8]
push ebx
cmp eax, ebx
push 1
je 0x41169a
mov ecx, dword [0x4501f0]
push 0x7e8
call fcn.004111f0
jmp 0x4116aa
mov ecx, dword [0x4501f0]
push 0x806
call fcn.00411220
cmp dword [0x44fbd8], ebx
jne 0x4116fb
cmp dword [0x44f85c], ebx
je 0x4116fb
cmp dword [esp + 0x14], ebx
je 0x4116c9
call fcn.0040dfe0
test eax, eax
je 0x4116fb
mov eax, dword [0x4500fc]
push ebx
cmp eax, ebx
je 0x4116da
push str.usingDKey1autoOpen1
jmp 0x4116df
push str.autoOpen1
push 0x44fb88
push str.service.csp
push 0x44fb78
push 0x44fa74
call fcn.0040bbf0
add esp, 0x18
push str._DKEY__
mov dword [0x44fbd8], ebx
call fcn.00411930
mov ecx, dword [0x4501f0]
add esp, 4
call fcn.004114c0
cmp eax, ebx
jne 0x411721
xor eax, eax
jmp 0x411724
mov eax, dword [eax + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x809
push eax
call esi
mov ecx, dword [0x4501f0]
call fcn.004114c0
mov eax, dword [eax + 0x484]
cmp eax, ebx
jne 0x41174d
xor eax, eax
jmp 0x411750
mov eax, dword [eax + 0x20]
push 0x44fa74
push 0x450084
push 0x810
push eax
call esi
cmp dword [0x4501ec], ebx
jne 0x4117a1
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push ebx
push ebx
push esi
push 0x4127e0
push ebx
push ebx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [0x4501ec], eax
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 0x40c
ret
Function at 0x411930
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x414
push esi
push edi
mov ecx, 0x104
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, str._SangforCSClient_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0x420]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x1a]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x424]
mov byte [esp + 0x19], 0x20
push ecx
push edx
push 0x3ff
push eax
call dword [sym.imp.MSVCRT.dll__vsnprintf]
add esp, 0x10
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
add esp, 0x414
ret

Function at 0x411aa0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebx
push edi
xor edi, edi
cmp eax, edi
je 0x411bf4
mov ecx, dword [esp + 0x18]
cmp ecx, edi
je 0x411bf4
push edi
push edi
push 3
push edi
push 1
push accept
push eax
mov dword [ecx], edi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x411afd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._IsPE64Format__CreateFile_errorCode___d
call fcn.00411930
add esp, 8
xor eax, eax
pop edi
pop ebx
add esp, 8
ret 8
push ebp
lea eax, [esp + 0x18]
push esi
push eax
push ebx
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x411bde
cmp dword [esp + 0x1c], edi
jne 0x411bde
mov ecx, dword [sym.imp.MSVCP60.dll_struct_std::nothrow_t_const_std::nothrow]
push ecx
push esi
call fcn.00439630
mov ebp, eax
add esp, 8
cmp ebp, edi
je 0x411b92
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push esi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411bc1
cmp word [ebp], 0x5a4d
jne 0x411bd7
mov ecx, dword [ebp + 0x3c]
cmp word [ecx + ebp + 4], 0x8664
jne 0x411b88
mov edx, dword [esp + 0x20]
mov dword [edx], 1
mov dword [esp + 0x10], 1
jmp 0x411b9f
push str._IsPE64Format__new_buffer__NULL
call fcn.00411930
add esp, 4
test ebp, ebp
je 0x411bac
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop edi
pop ebx
add esp, 8
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._IsPE64Format__ReadFile_errorCode___d
call fcn.00411930
add esp, 8
jmp 0x411b9f
push str._IsPE64Format__not_a_PE_file
jmp 0x411b97
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._IsPE64Format__GetFileSize_errorCode___d
call fcn.00411930
add esp, 8
jmp 0x411bac
push str._IsPE64Format__FileName__NULL__bIsPE64__NULL
call fcn.00411930
add esp, 4
xor eax, eax
pop edi
pop ebx
add esp, 8
ret 8
Function at 0x412160
Capabilities:
Create tcp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
push esi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41217e
or eax, eax
pop esi
add esp, 0x14
ret
xor eax, eax
push str.127.0.0.1
mov dword [esp + 0xc], eax
mov word [esp + 0xc], 2
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_inet_addr]
lea ecx, [esp + 8]
push 0x10
push ecx
push esi
mov dword [esp + 0x18], eax
mov word [esp + 0x16], 0
mov dword [esp + 0x10], 0x10
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x4121d7
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x14
ret
lea edx, [esp + 4]
lea eax, [esp + 8]
push edx
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x4121fc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x14
ret
mov ecx, dword [esp + 0x1c]
mov dx, word [esp + 0xa]
mov eax, esi
pop esi
mov word [ecx], dx
add esp, 0x14
ret

Function at 0x412210
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push esi
push eax
mov dword [esp + 0xc], 0x13bc
call fcn.00412160
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
jne 0x412237
or eax, eax
pop esi
add esp, 0xc
ret
push 5
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x412254
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0xc
ret
lea ecx, [esp + 4]
mov dword [esp + 4], 0
push ecx
push 0xf003f
push 0
push str.SOFTWARESangforSSLSangforCSClient
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4122a1
cmp eax, 2
jne 0x41229a
lea edx, [esp + 4]
push edx
push str.SOFTWARESangforSSLSangforCSClient
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x4122a1
xor eax, eax
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 8]
and eax, 0xffff
mov dword [esp + 0xc], eax
call fcn.0040b0d0
test eax, eax
push 4
je 0x4122ce
mov edx, dword [esp + 8]
lea ecx, [esp + 0x10]
push ecx
push 4
push 0
push str.SangforSSOSDPort
push edx
jmp 0x4122e1
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push eax
push 4
push 0
push str.SangforSSOPort
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x412307
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esp + 4]
or esi, 0xffffffff
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 4]
mov dx, word [esp + 8]
push eax
mov word [0x4501fc], dx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x412330
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x118
mov eax, dword [0x4501f4]
xor ecx, ecx
push ebx
push ebp
mov dword [esp + 9], ecx
push esi
push edi
mov dword [esp + 0x15], ecx
lea esi, [eax + 4]
xor edi, edi
mov word [esp + 0x19], cx
cmp esi, edi
mov byte [esp + 0x10], 0
mov byte [esp + 0x1b], cl
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], edi
jle 0x4123ce
mov ebp, dword [esp + 0x12c]
mov ebx, dword [sym.imp.WS2_32.dll_recv]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x24]
push edx
push 0
push 0
push eax
push 0
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x4123f5
mov ecx, esi
push 0
sub ecx, edi
lea edx, [esp + edi + 0x14]
push ecx
push edx
push ebp
call ebx
test eax, eax
je 0x4123f5
cmp eax, 0xffffffff
jne 0x4123c6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4123f5
jmp 0x4123ca
add edi, eax
sub esi, eax
test esi, esi
jg 0x412379
mov ecx, dword [esp + 0x130]
mov eax, dword [esp + 0x10]
mov dword [ecx], eax
mov ecx, dword [0x4501f4]
lea edx, [ecx + 8]
cmp eax, edx
jae 0x412406
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x118
ret
test esi, esi
jle 0x4123ce
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x118
ret
push ecx
lea eax, [esp + 0x18]
push str.SSOREQ
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x118
ret

Function at 0x412430
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x20
mov ecx, dword [0x44a548]
mov eax, dword [str.helloworld]
mov dword [esp + 4], ecx
xor ecx, ecx
mov dx, word [0x44a54c]
mov dword [esp + 0xb], ecx
mov dword [esp + 0xf], ecx
mov dword [esp], eax
mov al, byte [0x44a54e]
mov dword [esp + 0x13], ecx
mov dword [esp + 0x17], ecx
mov word [esp + 8], dx
mov dword [esp + 0x1b], ecx
mov byte [esp + 0xa], al
mov eax, dword [esp + 0x24]
push ecx
lea edx, [esp + 4]
push 0xb
push edx
push eax
mov byte [esp + 0x2f], cl
call dword [sym.imp.WS2_32.dll_send]
xor ecx, ecx
test eax, eax
setg cl
mov eax, ecx
add esp, 0x20
ret
Function at 0x4124a0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x12c
push ebx
push ebp
push esi
push edi
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, dword [sym.imp.WS2_32.dll_recv]
xor ebp, ebp
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x3c]
mov dword [esp + 0x14], ebp
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x140]
mov esi, 0xb
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], ebp
lea eax, [esp + 0x10]
lea ecx, [esp + 0x38]
push eax
push 0
push 0
push ecx
push 0
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x412584
push 0
lea edx, [esp + ebp + 0x1c]
push esi
push edx
push edi
call ebx
test eax, eax
je 0x412584
cmp eax, 0xffffffff
jne 0x412539
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x412584
jmp 0x41253d
add ebp, eax
sub esi, eax
test esi, esi
jg 0x4124f0
mov esi, str.helloworld
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x412595
test cl, cl
je 0x41256e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x412595
add eax, 2
add esi, 2
test cl, cl
jne 0x41254a
xor eax, eax
xor ecx, ecx
test eax, eax
pop edi
pop esi
sete cl
pop ebp
mov eax, ecx
pop ebx
add esp, 0x12c
ret
test esi, esi
jle 0x412541
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x12c
ret
sbb eax, eax
pop edi
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x12c
ret
Function at 0x4125b0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
lea eax, [esp + 0xc]
push edi
xor esi, esi
push eax
push ebp
mov dword [esp + 0x18], esi
call fcn.00412330
add esp, 8
test eax, eax
jne 0x4125e4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov ebx, dword [0x4501f4]
mov eax, dword [esp + 0x10]
mov ecx, 0xfffffffc
sub ecx, ebx
add eax, ecx
push eax
mov dword [esp + 0x14], eax
call sub.MFC42.DLL_operatornew
mov edi, dword [esp + 0x12c]
add esp, 4
cmp edi, esi
mov dword [edi], eax
jne 0x41261e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret
mov eax, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
mov ebx, eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], ecx
jle 0x41268f
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push 0
push 0
push eax
push 0
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x4126a8
mov edx, dword [edi]
mov ecx, ebx
sub ecx, esi
push 0
add edx, esi
push ecx
push edx
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x4126a8
cmp eax, 0xffffffff
jne 0x412687
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4126a8
jmp 0x41268b
add esi, eax
sub ebx, eax
test ebx, ebx
jg 0x412636
mov ecx, dword [esp + 0x12c]
pop edi
mov eax, 1
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
test ebx, ebx
jle 0x41268f
mov eax, dword [edi]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [edi], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret

Function at 0x4126d0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x114]
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_send]
push esi
xor esi, esi
push edi
mov edi, 4
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], esi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push 0
push ecx
push 0
push 0
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x412752
mov edx, edi
push 0
sub edx, esi
lea eax, [esp + esi + 0x128]
push edx
push eax
push ebx
call ebp
test eax, eax
je 0x412752
cmp eax, 0xffffffff
jne 0x41274a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x412752
jmp 0x41274e
add esi, eax
sub edi, eax
test edi, edi
jg 0x4126fa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x412a10
Capabilities:
Connect socket
Get socket status
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x120
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x412b70
cmp dword [esp + 0x12c], ebx
jle 0x412b70
push ebp
push esi
push edi
mov dword [esp + 0x10], ebx
mov ebp, 1
mov edi, dword [0x4501fc]
push str._HandShakeWithCS__begin_create_socket...
and edi, 0xffff
call fcn.00411930
add esp, 4
push ebx
push ebp
push 2
call dword [sym.imp.WS2_32.dll_socket]
push str._HandShakeWithCS__end_create_socket...
mov esi, eax
call fcn.00411930
add esp, 4
cmp esi, 0xffffffff
je 0x412b63
xor eax, eax
push str.127.0.0.1
mov dword [esp + 0x1a], eax
mov word [esp + 0x18], bx
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov word [esp + 0x26], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push str._HandShakeWithCS__begin_connect...
mov dword [esp + 0x1c], eax
mov word [esp + 0x18], 2
mov word [esp + 0x1a], di
call fcn.00411930
add esp, 4
lea ecx, [esp + 0x14]
push 0x10
push ecx
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x412b21
mov edx, dword [esp + 0x138]
mov eax, dword [esp + 0x134]
push ebx
push edx
push eax
push esi
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x412b21
lea ecx, [esp + 0x24]
lea edx, [esp + 0x2c]
push ecx
push ebx
push ebx
push edx
push ebx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebp
call dword [sym.imp.WS2_32.dll_select]
cmp eax, ebx
je 0x412b21
cmp eax, 0xffffffff
je 0x412b21
push esi
call fcn.004124a0
add esp, 4
cmp eax, ebp
je 0x412b56
push str._HandShakeWithCS__end_connect...
call fcn.00411930
add esp, 4
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esp + 0x10]
or esi, 0xffffffff
inc eax
cmp eax, ebp
mov dword [esp + 0x10], eax
jl 0x412a3e
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret
push str._HandShakeWithCS__end_connect...
call fcn.00411930
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret
xor eax, eax
pop ebx
add esp, 0x120
ret
Function at 0x412b80
Capabilities:
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x124
mov eax, dword [esp + 0x128]
push ebp
push esi
xor esi, esi
cmp eax, esi
mov dword [esp + 0x10], 3
je 0x412d1b
mov ebp, dword [esp + 0x134]
cmp ebp, esi
jle 0x412d1b
mov eax, dword [str.helloworld]
mov ecx, dword [0x44a548]
mov dx, word [0x44a54c]
push ebx
mov dword [esp + 0x18], eax
mov al, byte [0x44a54e]
push edi
push str._SendSSOConfigToCSClient__begin_HandShakeWithCS...
mov dword [esp + 0x24], ecx
mov word [esp + 0x28], dx
mov byte [esp + 0x2a], al
call fcn.00411930
lea ecx, [esp + 0x20]
push 0xb
push ecx
call fcn.00412a10
push str._SendSSOConfigToCSClient__end_HandShakeWithCS...
mov edi, eax
call fcn.00411930
push str._SendSSOConfigToCSClient__begin_send...
mov dword [esp + 0x24], esi
call fcn.00411930
add esp, 0x14
cmp ebp, esi
jle 0x412c50
mov ebx, dword [sym.imp.WS2_32.dll_send]
mov eax, dword [esp + 0x138]
mov edx, ebp
sub edx, esi
push 0
lea ecx, [esi + eax]
push edx
push ecx
push edi
call ebx
cmp eax, 0xffffffff
jne 0x412c40
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x412c48
jmp 0x412c42
add esi, eax
cmp esi, ebp
jl 0x412c17
jmp 0x412c50
mov dword [esp + 0x10], 2
push str._SendSSOConfigToCSClient__end_send...
call fcn.00411930
mov eax, dword [esp + 0x14]
add esp, 4
cmp eax, 2
je 0x412d00
mov eax, 1
lea edx, [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], eax
push edx
push ebx
lea eax, [esp + 0x38]
push ebx
push eax
push ebx
mov dword [esp + 0x48], edi
mov dword [esp + 0x40], ebx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, ebx
je 0x412d00
cmp eax, 0xffffffff
je 0x412d00
cmp eax, ebx
jle 0x412d00
mov ebp, dword [sym.imp.WS2_32.dll_recv]
push ebx
lea ecx, [esp + 0x14]
push 4
push ecx
push edi
mov byte [esp + 0x20], bl
mov dword [esp + 0x21], ebx
xor esi, esi
call ebp
cmp eax, 0xffffffff
je 0x412ce2
cmp eax, ebx
je 0x412d00
add esi, eax
cmp esi, 4
jge 0x412cf8
mov edx, 4
push ebx
sub edx, esi
lea eax, [esp + esi + 0x14]
push edx
push eax
push edi
call ebp
cmp eax, 0xffffffff
jne 0x412cc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SSO__SendSSOConfigToCSClient_recv_error_d
call fcn.00411930
add esp, 8
jmp 0x412d00
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
cmp edi, 0xffffffff
je 0x412d0c
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esp + 0x18]
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x124
ret
pop esi
mov eax, 5
pop ebp
add esp, 0x124
ret