joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422d30
Capabilities:
Change the wallpaper

Disassembly:
push 0xffffffffffffffff
push 0x468fe0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
mov eax, dword [0x487cdc]
push ebx
push ebp
push esi
mov dword [esp + 0x1a0], eax
mov eax, dword [esp + 0x1b8]
push edi
mov ebp, ecx
mov ecx, dword [esp + 0x1b8]
push eax
push ecx
mov ecx, ebp
mov dword [esp + 0x18], ebp
call fcn.0045d99d
xor esi, esi
push esi
lea ecx, [ebp + 0x80]
mov dword [esp + 0x1b4], esi
mov dword [ebp], method.CDialog.virtual_0
mov dword [ebp + 0x70], esi
mov dword [ebp + 0x74], esi
mov dword [ebp + 0x78], esi
mov dword [ebp + 0x7c], 1
call fcn.00422fd0
lea edi, [ebp + 0x184]
mov dword [edi + 4], esi
mov dword [edi], vtable.CBrush.0
lea ebx, [ebp + 0x18c]
mov dword [ebx + 4], esi
mov dword [ebx], vtable.CPen.0
mov eax, 1
mov byte [esp + 0x1b0], 3
mov dword [ebp + 0x194], 5
mov dword [ebp + 0x198], esi
mov dword [ebp + 0x19c], eax
mov dword [ebp + 0x1a0], eax
mov dword [ebp + 0x1a4], esi
call fcn.0045ced0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp + 0x1a8], eax
mov dword [ebp + 0x1b0], esi
mov dword [ebp + 0x1ac], 0x4762a0
push 0x595959
mov byte [esp + 0x1b4], 5
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00460631
mov eax, dword [ebp + 0x194]
push 0x808080
push eax
push esi
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
mov ecx, ebx
call fcn.00460631
push esi
lea eax, [esp + 0x54]
push eax
push 0x154
push 0x29
mov dword [esp + 0x60], 0x154
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov ecx, 0xf
lea esi, [esp + 0x68]
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x28], 0x2bc
mov dword [esp + 0x18], 0x14
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
lea ecx, [ebp + 0x1ac]
call fcn.00460631
mov ecx, dword [esp + 0x1a8]
pop edi
pop esi
mov eax, ebp
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x198]
pop ebx
call fcn.00446654
add esp, 0x1a4
ret 8
Function at 0x428b60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x469546
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
lea ecx, [esi + 0x10]
mov dword [esi], 0x472498
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
push ebx
mov edi, 0xf
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x46fa3c
mov byte [ecx + 4], bl
call fcn.00403bf0
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov byte [esi + 0x32], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x6c], edi
mov dword [esi + 0x68], ebx
mov byte [esi + 0x58], bl
mov dword [esi + 0x88], edi
mov dword [esi + 0x84], ebx
mov byte [esi + 0x74], bl
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa0], ebx
mov byte [esi + 0x90], bl
mov dword [esi + 0xc0], edi
mov dword [esi + 0xbc], ebx
mov byte [esi + 0xac], bl
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x42dff0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4698ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 0xc], ebx
lea ecx, [esi + 0x14]
mov dword [esi], 0x47227c
mov eax, 0xf
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], ebx
mov dword [esp + 0x18], ebx
mov byte [ecx + 4], bl
lea edi, [esi + 0x30]
mov dword [edi + 0x18], eax
mov dword [edi + 0x14], ebx
mov byte [edi + 4], bl
mov eax, dword [esp + 0x20]
push 0xffffffffffffffff
push ebx
push eax
mov byte [esp + 0x24], 2
call fcn.00403ac0
mov ecx, dword [esp + 0x24]
push 0xffffffffffffffff
push ebx
push ecx
mov ecx, edi
call fcn.00403ac0
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x42e090
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4698ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
or eax, 0xffffffff
xor ebx, ebx
mov dword [esi + 8], eax
mov dword [esi + 4], eax
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 0xc], ebx
lea ecx, [esi + 0x14]
mov dword [esi], 0x47227c
mov eax, 0xf
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov byte [ecx + 4], bl
lea edi, [esi + 0x30]
mov dword [edi + 0x18], eax
mov dword [edi + 0x14], ebx
mov byte [edi + 4], bl
mov ebp, dword [esp + 0x24]
mov eax, ebp
lea edx, [eax + 1]
mov byte [esp + 0x1c], 2
mov dword [esp + 0x24], edx
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x42e0f7
sub eax, dword [esp + 0x24]
push eax
push ebp
call fcn.00403bf0
mov edx, dword [esp + 0x28]
mov eax, edx
lea ebp, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x42e112
sub eax, ebp
push eax
push edx
mov ecx, edi
call fcn.00403bf0
mov ecx, dword [esp + 0x14]
pop edi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x42e370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x469878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x487cdc]
mov edx, dword [esp + 0x30]
push esi
mov dword [esp + 0x20], eax
mov eax, edx
push edi
mov esi, ecx
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42e3b3
sub eax, edi
push eax
push edx
lea ecx, [esp + 0x10]
call fcn.00403bf0
lea eax, [esp + 8]
push eax
lea ecx, [esi + 0x44]
mov dword [esp + 0x34], 0
call fcn.0042d260
test eax, eax
je 0x42e40b
mov edx, dword [eax + 0x48]
mov ecx, 0x10
cmp edx, ecx
jb 0x42e3f1
mov esi, dword [eax + 0x34]
jmp 0x42e3f4
lea esi, [eax + 0x34]
cmp dword [esp + 0x20], ecx
jb 0x42e407
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0045ce75
add esp, 4
mov eax, esi
jmp 0x42e421
cmp dword [esp + 0x20], 0x10
jb 0x42e41f
mov edx, dword [esp + 0xc]
push edx
call fcn.0045ce75
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x28]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x20]
pop esi
call fcn.00446654
add esp, 0x2c
ret 4
Function at 0x42e440
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x469878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x487cdc]
mov edx, dword [esp + 0x30]
push esi
mov dword [esp + 0x20], eax
mov eax, edx
push edi
mov esi, ecx
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42e483
sub eax, edi
push eax
push edx
lea ecx, [esp + 0x10]
call fcn.00403bf0
lea eax, [esp + 8]
push eax
lea ecx, [esi + 0x44]
mov dword [esp + 0x34], 0
call fcn.0042d260
test eax, eax
jne 0x42e4cb
cmp dword [esp + 0x20], 0x10
jb 0x42e4c4
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0045ce75
add esp, 4
mov eax, 1
jmp 0x42e513
mov ecx, dword [eax + 0x48]
mov edi, 0x10
cmp ecx, edi
jb 0x42e4dc
mov eax, dword [eax + 0x34]
jmp 0x42e4df
add eax, 0x34
mov edx, dword [esp + 0x3c]
push edx
push 0x46fa7c
push eax
call fcn.004488a9
add esp, 0xc
mov esi, eax
mov eax, dword [esp + 0x20]
dec esi
neg esi
sbb esi, esi
and esi, 2
cmp eax, edi
jb 0x42e511
mov eax, dword [esp + 0xc]
push eax
call fcn.0045ce75
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x20]
pop esi
call fcn.00446654
add esp, 0x2c
ret 8

Function at 0x42e700
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46993b
push eax
mov dword fs:[0], esp
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x44]
push ebx
mov ecx, edi
call fcn.0042d260
test eax, eax
je 0x42e752
mov ecx, dword [esp + 0x20]
push 0xffffffffffffffff
push 0
push ecx
lea ecx, [eax + 0x30]
call fcn.00403ac0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
push 0x54
call fcn.0045ce45
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov dword [esp + 0x14], 0
je 0x42e77b
mov edx, dword [esp + 0x20]
push edx
push ebx
mov ecx, eax
call fcn.0042dff0
jmp 0x42e77d
xor eax, eax
test eax, eax
mov dword [esp + 0x14], 0xffffffff
je 0x42e7af
mov dword [eax + 0x50], edi
mov ecx, dword [edi + 0x4c]
mov dword [eax + 0x4c], ecx
mov edx, dword [edi + 0x4c]
mov dword [edx + 0x50], eax
mov dword [edi + 0x4c], eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
test esi, esi
je 0x42e7f3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
test eax, eax
jne 0x42e7d9
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x42e7b3
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x10]
test eax, eax
je 0x42e7f3
push 0
push 0
push 0
push 3
mov ecx, eax
call fcn.0042ae70
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8
Function at 0x430160
Capabilities:
Get session user name

Disassembly:
push ecx
mov eax, 0x489150
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x430170
sub eax, edx
mov dword [esp], eax
jne 0x4301a6
push edi
xor eax, eax
mov ecx, 0x41
mov edi, 0x489150
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push eax
push 0x489150
mov dword [esp + 0xc], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
pop edi
mov eax, 0x489150
pop ecx
ret

Function at 0x430490
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push edi
mov dword [esi], eax
call fcn.00449d75
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
mov dword [esp + 0x10], 0
call fcn.00430350
test eax, eax
jne 0x4304dc
mov esi, dword [esp + 0xc]
push esi
push edi
call fcn.00448f46
push esi
call fcn.004486b2
add esp, 0xc
xor eax, eax
pop edi
pop esi
ret 8

Function at 0x430ab0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x469b08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x74
mov eax, dword [0x487cdc]
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0x78], eax
push edi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
xor eax, eax
mov byte [esp + 0x2c], bl
mov ecx, 0x13
lea edi, [esp + 0x2d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x94]
push eax
lea ecx, [esp + 0x30]
push 0x46fa7c
push ecx
mov dword [esp + 0x94], ebx
call fcn.004472e3
lea eax, [esp + 0x38]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x430b26
sub eax, edx
push eax
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x18]
call fcn.00403bf0
mov esi, dword [esp + 0x90]
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x18]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push eax
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00403ac0
cmp dword [esp + 0x28], 0x10
jb 0x430b75
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0045ce75
add esp, 4
mov ecx, dword [esp + 0x80]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x74]
pop ebx
call fcn.00446654
add esp, 0x80
ret
Function at 0x431af0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1394
call fcn.00446b30
mov eax, dword [0x487cdc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x1394], eax
push esi
xor eax, eax
test ebx, ebx
push edi
mov esi, ecx
je 0x431bc1
mov byte [esp + 0x10], al
mov ecx, 0x4e1
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x1388
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov cl, byte [esp + eax + 0x10]
dec eax
cmp cl, 0x5c
jne 0x431b42
push ebx
lea edx, [esp + 0x14]
push edx
push str._s_s
push esi
mov byte [esp + eax + 0x21], 0
call fcn.0042f210
mov eax, dword [esi]
add esp, 0x10
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push 0
test eax, eax
mov eax, dword [esi]
push 0
jne 0x431ba1
push 1
push 0
push 0
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 4], eax
xor eax, eax
mov ecx, dword [esp + 0x139c]
call fcn.00446654
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 3
push 0
push 0
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
test eax, eax
mov dword [esi + 4], eax
je 0x431bbc
cmp eax, 0xffffffff
jne 0x431b8a
mov eax, 1
mov ecx, dword [esp + 0x139c]
call fcn.00446654
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x432180
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
mov dword [esi], 0
push eax
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x20], ecx
je 0x432226
cmp word [ecx + 8], 2
push ebp
push edi
jne 0x4321f9
cmp word [ecx + 0xa], 4
jne 0x4321f9
mov edi, dword [ecx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x4321f9
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov ecx, dword [eax]
mov edx, dword [esp + 0x20]
push ecx
push edx
push ebx
push ebp
call fcn.00432110
test eax, eax
mov dword [esi], eax
je 0x43221a
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x4321d0
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov eax, dword [ecx]
push 0x400
push eax
push ebx
call fcn.0044a270
add esp, 0xc
pop edi
pop ebp
pop esi
mov byte [ebx + 0x400], 0
xor eax, eax
pop ebx
ret 0x18
pop edi
pop ebp
pop esi
mov eax, 8
pop ebx
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x432236.11001
jmp dword [eax*4 + 0x43225c]
pop esi
mov eax, 0x2af9
pop ebx
ret 0x18
pop esi
mov eax, 0x2afa
pop ebx
ret 0x18
pop esi
mov eax, 0x2afb
pop ebx
ret 0x18
Function at 0x432a60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
mov eax, dword [0x487cdc]
mov dword [esp + 0x22c], eax
mov eax, dword [0x48955c]
test eax, eax
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x4324e0
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x4327d0
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.00432490
jne 0x432bc2
push 0x104
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x432bb8
xor eax, eax
jmp 0x432ad0
mov cl, byte [esp + eax + 0x124]
mov byte [esp + eax + 0x18], cl
inc eax
test cl, cl
jne 0x432ad0
push edi
lea edi, [esp + 0x1c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x432ae6
mov edx, dword [str.ws2_32]
mov eax, dword [0x472828]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
lea ecx, [esp + 0x28]
mov dword [edi], edx
push ecx
mov dword [edi + 4], eax
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x432b2d
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x432b7f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
nop
mov cl, byte [esp + eax + 0x134]
mov byte [esp + eax + 0x28], cl
inc eax
test cl, cl
jne 0x432b30
lea edi, [esp + 0x28]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x432b45
mov edx, dword [str.wship6]
mov eax, dword [0x472820]
lea ecx, [esp + 0x28]
mov dword [edi], edx
push ecx
mov dword [edi + 4], eax
call ebp
mov esi, eax
test esi, esi
je 0x432bb4
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x432b7f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x432bb4
xor edi, edi
mov edx, dword [esp + edi*8 + 0x10]
push edx
push esi
call ebx
test eax, eax
mov dword [esp + edi*8 + 0x14], eax
je 0x432b76
inc edi
cmp edi, 3
jl 0x432b81
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov dword [0x486ad0], eax
mov dword [0x486ad8], ecx
mov dword [fcn.00432490], edx
pop esi
pop ebp
pop ebx
pop edi
mov dword [0x48955c], 1
movzx eax, word [esp + 0x234]
mov ecx, dword [esp + 0x22c]
mov eax, dword [eax*8 + 0x486ad0]
call fcn.00446654
add esp, 0x230
ret 4

Function at 0x432f90
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
push eax
call fcn.00431d00
add esp, 4
jmp fcn.00432d20

Function at 0x432fe0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push esi
push 1
mov esi, ecx
mov eax, dword [esi]
push 0
neg eax
push 0
sbb eax, eax
push 0
and eax, 0x15
push 1
add eax, 2
push eax
call dword [sym.imp.WS2_32.dll_WSASocketA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x433026
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x27
push str.CVSRLSourceCVSKHStreamDragonSourcePublicWSASocket.cpp
mov esi, eax
push 2
push esi
call fcn.004310d0
add esp, 0x10
mov eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x433030
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, ecx
cmp dword [esi], 0
push edi
push edx
je 0x433070
xor eax, eax
lea edi, [esi + 0x60]
mov ecx, edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov word [edi], 0x17
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 0x62], ax
mov ebx, 0x1c
jmp 0x4330a4
lea edi, [esi + 0x34]
xor eax, eax
mov ecx, edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov word [edi], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 0x36], ax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esi + 0x38], eax
mov ebx, 0x10
mov ecx, dword [esi + 4]
push ebx
push edi
push ecx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x4330e9
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x5e
push str.CVSRLSourceCVSKHStreamDragonSourcePublicWSASocket.cpp
mov esi, eax
push 2
push esi
call fcn.004310d0
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
mov ecx, dword [esi + 4]
lea eax, [esp + 0x14]
push eax
push edi
push ecx
mov dword [esp + 0x20], ebx
call dword [sym.imp.WS2_32.dll_getsockname]
pop edi
pop esi
xor eax, eax
pop ebx
ret 8

Function at 0x4367b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x46a31b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
mov eax, dword [edi + 0x30]
mov ecx, dword [eax]
lea esi, [edi + 0x2c]
push eax
push ecx
lea eax, [esp + 0x18]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [esp + 0x28], ebx
call fcn.00434f50
mov eax, dword [esi + 4]
push eax
call fcn.0045ce75
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov eax, dword [edi + 0x24]
mov ecx, dword [eax]
add esp, 4
lea esi, [edi + 0x20]
push eax
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
mov dword [esp + 0x28], 0xffffffff
call fcn.00434f50
mov edx, dword [esi + 4]
push edx
call fcn.0045ce75
mov ecx, dword [esp + 0x18]
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x437230
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x487cdc]
push edi
mov dword [esp + 0x19c], eax
xor eax, eax
mov word [esp + 8], 0
mov ecx, 0x63
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.00431970
push 0
call fcn.00432f90
mov ecx, dword [esp + 0x1a0]
add esp, 4
call fcn.00446654
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4376a0
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 0x10
jb 0x4376b6
mov eax, dword [eax + 4]
mov dword [esp + 4], eax
jmp fcn.004375e0
add eax, 4
mov dword [esp + 4], eax
jmp fcn.004375e0
Function at 0x43b620
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
lea edi, [ebp - 2]
xor ecx, ecx
test edi, edi
jle 0x43b6a7
push ebx
lea esp, [esp]
movzx edx, byte [esi + ecx]
shr edx, 2
mov dl, byte [edx + 0x474100]
mov byte [eax], dl
movzx ebx, byte [esi + ecx + 1]
xor edx, edx
mov dl, byte [esi + ecx]
shr ebx, 4
inc eax
add ecx, 3
and edx, 3
shl edx, 4
or edx, ebx
mov dl, byte [edx + 0x474100]
mov byte [eax], dl
movzx edx, byte [esi + ecx - 1]
xor ebx, ebx
mov bl, byte [esi + ecx - 2]
shr edx, 6
inc eax
and ebx, 0xf
shl ebx, 2
or edx, ebx
mov dl, byte [edx + 0x474100]
mov byte [eax], dl
xor edx, edx
mov dl, byte [esi + ecx - 1]
inc eax
and edx, 0x3f
mov dl, byte [edx + 0x474100]
mov byte [eax], dl
inc eax
cmp ecx, edi
jl 0x43b640
pop ebx
cmp ecx, ebp
jge 0x43b71c
movzx edx, byte [ecx + esi]
shr edx, 2
mov dl, byte [edx + 0x474100]
mov byte [eax], dl
inc eax
dec ebp
cmp ecx, ebp
jne 0x43b6e9
movsx ecx, byte [ecx + esi]
and ecx, 3
shl ecx, 4
mov dl, byte [ecx + 0x474100]
mov byte [eax], dl
mov edx, dword [esp + 0x10]
inc eax
mov byte [eax], 0x3d
inc eax
mov byte [eax], 0x3d
inc eax
pop edi
mov byte [eax], 0
sub eax, edx
pop esi
inc eax
pop ebp
ret
lea edx, [ecx + esi + 1]
movsx ecx, byte [ecx + esi]
movzx esi, byte [edx]
and ecx, 3
shl ecx, 4
shr esi, 4
or ecx, esi
mov cl, byte [ecx + 0x474100]
mov byte [eax], cl
movsx edx, byte [edx]
and edx, 0xf
mov cl, byte [edx*4 + 0x474100]
inc eax
mov byte [eax], cl
inc eax
mov byte [eax], 0x3d
inc eax
mov edx, dword [esp + 0x10]
pop edi
mov byte [eax], 0
sub eax, edx
pop esi
inc eax
pop ebp
ret

Function at 0x43c7b0
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x44], eax
neg eax
sbb eax, eax
push 0
and eax, 0x15
push ecx
add eax, 2
push eax
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x43c7fa
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x52
push str.CVSRLSourceCVSKHStreamDragonSourcePublicSocket.cpp
mov esi, eax
push 2
push esi
call fcn.004310d0
add esp, 0x10
mov eax, esi
pop esi
ret 8
lea edx, [esp + 0xc]
push edx
push 0x8004667e
push eax
mov dword [esp + 0x18], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
xor eax, eax
pop esi
ret 8

Function at 0x43cae0
Capabilities:
Connect socket

Disassembly:
mov edx, dword [esp + 4]
test edx, edx
je 0x43cb1d
mov eax, dword [esp + 8]
test eax, eax
jle 0x43cb1d
push esi
push eax
mov eax, dword [ecx + 4]
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x43cb17
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x2733
je 0x43cb17
call esi
pop esi
ret 8
xor eax, eax
pop esi
ret 8
mov eax, 0xc353
ret 8