joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e8a5
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0x28
call fcn.0043e388
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0xa
rep stosd dword es:[edi], eax
push ebx
push 8
call fcn.0043e388
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
pop ebx
mov dword [ebp - 8], esp
mov eax, dword [ebp - 4]
push eax
push 0x24
call fcn.0043e388
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], eax
push ebx
mov ebx, dword [ebx]
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
pop ebx
add ebx, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
nop
cmp dword [ebp - 8], esp
je 0x40e9aa
push 0
push 0x402ec71
push 6
call fcn.0043e37c
add esp, 0xc
mov ebx, dword [ebp - 0xc]
push ebx
mov edi, dword [ebp - 0x10]
push edi
mov edi, dword [edi]
push ebx
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
pop ebx
add ebx, 4
pop edi
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
call fcn.0043e38e
add esp, 4
cmp dword [ebp + 8], 1
jge 0x40ea78
mov ebx, dword [ebp - 4]
add ebx, 0x14
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
fild dword [ebx]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x46e6be]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x46e6fa]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.00401272
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
jmp 0x40ea80
push eax
mov ebx, dword [ebp - 4]
push ebx
push ebx
mov ebx, dword [ebx]
push ebx
call fcn.0043e38e
add esp, 4
pop ebx
call fcn.0043e38e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x40eafd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x400
push 0x80
call fcn.0040ebfc
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_getsockname
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.004405b0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
mov eax, 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0x10000
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push dword [ebp - 8]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40eb86
push 0x59
push 0x402ecf7
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
mov eax, 0
sete al
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x40ebdd
cmp dword [ebp - 4], 0
je 0x40ebd8
mov dword [ebp - 8], esp
push dword [ebp - 4]
xor eax, eax
call dword [0x46fa89]
nop
nop
cmp dword [ebp - 8], esp
je 0x40ebd8
push 0x103
push 0x402ecf7
push 6
call fcn.0043e37c
add esp, 0xc
jmp 0x40ebe5
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x40ebf6
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40f976
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040fa75
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40f9a1
mov eax, 0
jmp 0x40fa6f
push dword [ebp + 0xc]
call fcn.0040f7fc
mov dword [ebp - 4], eax
fild dword [ebp + 0xc]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x46e89b]
fstp qword [ebp - 0x14]
mov dword [ebp - 0x18], esp
push 0
push dword [ebp + 0xc]
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 1
fld qword [ebp - 0x14]
call fcn.00401272
push eax
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.WS2_32.dll_WSARecv]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x40fa18
push 0xfb
push 0x402ec8b
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x40fa65
mov dword [ebp - 4], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
nop
nop
cmp dword [ebp - 4], esp
je 0x40fa4e
push 0x17c
push 0x402ec8b
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3e5
mov eax, 0
sete al
jmp 0x40fa6f
mov eax, 1
jmp 0x40fa6f
mov esp, ebp
pop ebp
ret 8
Function at 0x4183ee
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 1
push 0
push 0
push 6
push 1
push 2
xor eax, eax
call dword [sym.imp.WS2_32.dll_WSASocketA]
nop
nop
cmp dword [ebp - 8], esp
je 0x418445
push 0x19
push 0x402dd97
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x4184b9
cmp dword [ebp + 0xc], 0
je 0x41846a
cmp dword [ebp + 8], 1
je 0x41846a
xor eax, eax
jmp 0x41846f
mov eax, 1
test eax, eax
je 0x4184b9
push 1
push dword [ebp - 4]
call fcn.004184c7
push 1
push dword [ebp - 4]
call fcn.00418560
push 1
push dword [ebp - 4]
call fcn.00418708
push 1
push 0xbb8
push 1
push 0xbb8
push 1
push dword [ebp - 4]
call fcn.004187a1
mov eax, dword [ebp - 4]
jmp 0x4184c1
mov esp, ebp
pop ebp
ret 8

Function at 0x4184c7
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esp
push 0
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
xor eax, eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
cmp dword [ebp - 4], esp
je 0x418505
push 0x47
push 0x402dd85
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 1
push dword [ebp - 8]
push 4
push 0xffff
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.WS2_32.dll_setsockopt]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x418546
push 0x47
push 0x402dd85
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
mov eax, 0
sete al
jmp 0x41855a
mov esp, ebp
pop ebp
ret 8
Function at 0x418560
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 8
call fcn.0043e388
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
je 0x4185ac
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov word [ebx], 1
jmp 0x4185ba
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov word [ebx], 0
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov word [ebx], 0
mov dword [ebp - 0xc], esp
mov eax, dword [ebp - 4]
push eax
push 4
call fcn.0043e388
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x418625
push 0xcd
push 0x402dd82
push 6
call fcn.0043e37c
add esp, 0xc
push eax
mov ebx, dword [ebp - 0x10]
push ebx
mov edi, dword [ebp - 0x14]
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
call fcn.0043e38e
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
mov eax, dword [ebp - 4]
push eax
push 4
call fcn.0043e388
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
push 0x80
push 0xffff
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.WS2_32.dll_setsockopt]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4186b9
push 0x10c
push 0x402dd82
push 6
call fcn.0043e37c
add esp, 0xc
push eax
mov ebx, dword [ebp - 0x10]
push ebx
mov edi, dword [ebp - 0x14]
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
call fcn.0043e38e
add esp, 4
pop eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
mov eax, 0
sete al
jmp 0x4186f4
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.0043e38e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8

Function at 0x418708
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esp
push 0
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
xor eax, eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
cmp dword [ebp - 4], esp
je 0x418746
push 0x47
push 0x402dd92
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 1
push dword [ebp - 8]
push 1
push 6
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.WS2_32.dll_setsockopt]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x418787
push 0x47
push 0x402dd92
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
mov eax, 0
sete al
jmp 0x41879b
mov esp, ebp
pop ebp
ret 8
Function at 0x4187a1
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push 0xc
call fcn.0043e388
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push 0
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
xor eax, eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41880c
push 0x47
push 0x402dd89
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push 1
push dword [ebp - 0x10]
push 8
push 0xffff
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.WS2_32.dll_setsockopt]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41884d
push 0x47
push 0x402dd89
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4189f5
cmp dword [ebp + 0xc], 0
je 0x4189eb
cmp dword [ebp + 0x14], 0
jne 0x418875
mov dword [ebp + 0x10], 0x1388
cmp dword [ebp + 0x1c], 0
jne 0x418886
mov dword [ebp + 0x18], 0x3e8
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebx], 1
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp - 0xc]
mov dword [ebx], eax
mov ebx, dword [ebp - 4]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp - 0xc]
mov dword [ebx], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4188eb
push 0x206
push 0x402dd89
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41891a
push 0x230
push 0x402dd89
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push 0
push dword [ebp - 4]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x418951
push 0x24a
push 0x402dd89
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
nop
nop
cmp dword [ebp - 0x24], esp
je 0x418980
push 0x274
push 0x402dd89
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], esp
push 0
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push 0x98000004
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
nop
nop
cmp dword [ebp - 0x2c], esp
je 0x4189cf
push 0x274
push 0x402dd89
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x4189e6
mov eax, 1
jmp 0x4189ff
jmp 0x4189f5
mov eax, 1
jmp 0x4189ff
mov eax, 0
jmp 0x4189ff
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.0043e38e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x18
Function at 0x418a64
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push 0xc
call fcn.0043e388
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push 0
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
xor eax, eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x418acf
push 0x47
push 0x402dd72
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push 1
push dword [ebp - 0x10]
push 8
push 0xffff
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.WS2_32.dll_setsockopt]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x418b10
push 0x47
push 0x402dd72
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x418cb8
cmp dword [ebp + 0xc], 1
jne 0x418cae
cmp dword [ebp + 0x14], 0
jne 0x418b38
mov dword [ebp + 0x10], 0x1388
cmp dword [ebp + 0x1c], 0
jne 0x418b49
mov dword [ebp + 0x18], 0x3e8
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebx], 1
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp - 0xc]
mov dword [ebx], eax
mov ebx, dword [ebp - 4]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp - 0xc]
mov dword [ebx], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x418bae
push 0x21c
push 0x402dd72
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x418bdd
push 0x246
push 0x402dd72
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push 0
push dword [ebp - 4]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x418c14
push 0x260
push 0x402dd72
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
nop
nop
cmp dword [ebp - 0x24], esp
je 0x418c43
push 0x28a
push 0x402dd72
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], esp
push 0
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push 0x98000004
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
nop
nop
cmp dword [ebp - 0x2c], esp
je 0x418c92
push 0x28a
push 0x402dd72
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x418ca9
mov eax, 1
jmp 0x418cc2
jmp 0x418cb8
mov eax, 1
jmp 0x418cc2
mov eax, 0
jmp 0x418cc2
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.0043e38e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x18
Function at 0x418cd6
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 8
call fcn.0043e388
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 1
jne 0x418d22
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov word [ebx], 1
jmp 0x418d30
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov word [ebx], 0
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov word [ebx], 0
mov dword [ebp - 0xc], esp
mov eax, dword [ebp - 4]
push eax
push 4
call fcn.0043e388
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x418d9b
push 0xe3
push 0x402dd73
push 6
call fcn.0043e37c
add esp, 0xc
push eax
mov ebx, dword [ebp - 0x10]
push ebx
mov edi, dword [ebp - 0x14]
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
call fcn.0043e38e
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
mov eax, dword [ebp - 4]
push eax
push 4
call fcn.0043e388
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
push 0x80
push 0xffff
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.WS2_32.dll_setsockopt]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x418e2f
push 0x122
push 0x402dd73
push 6
call fcn.0043e37c
add esp, 0xc
push eax
mov ebx, dword [ebp - 0x10]
push ebx
mov edi, dword [ebp - 0x14]
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
call fcn.0043e38e
add esp, 4
pop eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
mov eax, 0
sete al
jmp 0x418e6a
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.0043e38e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x418e7e
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 8
call fcn.0043e388
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov word [ebx], 1
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov word [ebx], 0
mov dword [ebp - 8], esp
push 4
mov eax, dword [ebp - 4]
push eax
push 4
call fcn.0043e388
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
push 0x80
push 0xffff
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.WS2_32.dll_setsockopt]
nop
nop
cmp dword [ebp - 8], esp
je 0x418f31
push 0x90
push 0x402de42
push 6
call fcn.0043e37c
add esp, 0xc
push eax
mov ebx, dword [ebp - 0xc]
push ebx
mov edi, dword [ebp - 0x10]
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
call fcn.0043e38e
add esp, 4
pop eax
jmp 0x418f5d
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.0043e38e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x418f71
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 8
call fcn.0043e388
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov word [ebx], 1
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov word [ebx], 0
mov dword [ebp - 8], esp
push 4
mov eax, dword [ebp - 4]
push eax
push 4
call fcn.0043e388
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
push 4
push 0xffff
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.WS2_32.dll_setsockopt]
nop
nop
cmp dword [ebp - 8], esp
je 0x419024
push 0x8e
push 0x402de44
push 6
call fcn.0043e37c
add esp, 0xc
push eax
mov ebx, dword [ebp - 0xc]
push ebx
mov edi, dword [ebp - 0x10]
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
call fcn.0043e38e
add esp, 4
pop eax
jmp 0x419050
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.0043e38e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x41b37a
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 6
push 1
push 2
xor eax, eax
call dword [sym.imp.WS2_32.dll_socket]
nop
nop
cmp dword [ebp - 8], esp
je 0x41b3c2
push 0x3a
push 0x402de34
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x41b3cd
mov esp, ebp
pop ebp
ret
Function at 0x42090e
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x420932
mov eax, 0
jmp 0x420937
mov eax, 1
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
lea eax, [ebp - 4]
push eax
push 0x8004667e
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
nop
nop
cmp dword [ebp - 8], esp
je 0x42096f
push 0x6a
push 0x402ece0
push 6
call fcn.0043e37c
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
mov eax, 0
setne al
jmp 0x420983
mov esp, ebp
pop ebp
ret 0xc

Function at 0x420989
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 8
call fcn.0043e388
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.0043e388
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
cmp dword [ebp + 0xc], 0xffffffff
jle 0x420a16
push dword [ebp + 0xc]
call fcn.00420ab1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.0043e38e
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x10]
call fcn.00420b85
mov dword [ebp - 8], eax
jmp 0x420a1d
mov dword [ebp - 8], 0
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx], 1
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x10]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x10]
call fcn.00420b85
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 8]
push 0
push dword [ebp - 0x14]
push 0
push 0
xor eax, eax
call dword [sym.imp.WS2_32.dll_select]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x420a8c
push 0x159
push 0x402ece5
push 6
call fcn.0043e37c
add esp, 0xc
jmp 0x420a91
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.0043e38e
add esp, 4
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0043e38e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8