joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453a4b
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c690
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x468084], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x468080], ecx
shl ecx, 8
add ecx, edx
mov dword [0x46807c], ecx
shr eax, 0x10
mov dword [0x468078], eax
push 1
call fcn.004551a9
pop ecx
test eax, eax
jne 0x453ab6
push 0x1c
call fcn.00453b60
pop ecx
call fcn.0045484f
test eax, eax
jne 0x453ac7
push 0x10
call fcn.00453b60
pop ecx
and dword [ebp - 4], 0
call fcn.00454fed
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4696b8], eax
call fcn.00454ebb
mov dword [0x467f80], eax
call fcn.00454c6e
call fcn.00454bb5
call fcn.0045491d
mov eax, dword [0x468094]
mov dword [0x468098], eax
push eax
push dword [0x46808c]
push dword [0x468088]
call fcn.0044d4c8
add esp, 0xc
mov dword [ebp - 0x1c], eax
push eax
call fcn.0045494a
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call fcn.00454a3d
pop ecx
pop ecx
ret

Function at 0x455301
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x44a640
cmp edx, dword [eax]
je 0x455323
add eax, 8
inc ecx
cmp eax, 0x44a6d0
jl 0x455314
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x44a640]
jne 0x455451
mov eax, dword [0x467f88]
cmp eax, 1
je 0x45542b
test eax, eax
jne 0x455354
cmp dword [0x44a454], 1
je 0x45542b
cmp edx, 0xfc
je 0x455451
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x45538b
lea eax, [ebp - 0x1a4]
push 0x44c9b8
push eax
call fcn.004565c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004539d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4553ce
lea eax, [ebp - 0x1a4]
push eax
call fcn.004539d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x44c9b4
push edi
call fcn.00453e30
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x44c998
push eax
call fcn.004565c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004565d0
lea eax, [ebp - 0xa0]
push 0x44c994
push eax
call fcn.004565d0
push dword [esi + 0x44a644]
lea eax, [ebp - 0xa0]
push eax
call fcn.004565d0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x44c96c
push eax
call fcn.00456bae
add esp, 0x2c
pop edi
jmp 0x455451
lea eax, [ebp + 8]
lea esi, [esi + 0x44a644]
push 0
push eax
push dword [esi]
call fcn.004539d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4586f0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x468314]
mov ecx, dword [eax + 0x228]
test ecx, ecx
je 0x45870a
mov ecx, dword [esp + 4]
mov dword [eax + 0x22c], ecx
ret
push 0x44c218
call fcn.00458930
add esp, 4
mov ecx, dword [0x468314]
mov eax, dword [ecx + 0x20]
cmp eax, 0x18
jge 0x458733
mov edx, dword [ecx + eax*4 + 0x24]
mov eax, dword [edx*4 + 0x44b0e0]
push eax
jmp 0x458738
push 0x44c214
call fcn.00458930
add esp, 4
push esi
push 0x44a928
push 0xa
call fcn.0045e41c
mov ecx, dword [0x468314]
add esp, 8
mov esi, dword [ecx + 0x20]
dec esi
js 0x4587ae
push edi
lea edi, [esi*4 + 0x24]
push 0x44c1f8
call fcn.00458930
add esp, 4
cmp esi, 0x18
jge 0x458789
mov edx, dword [0x468314]
mov eax, dword [edi + edx]
mov ecx, dword [eax*4 + 0x44b0e0]
push ecx
jmp 0x45878e
push 0x44c214
call fcn.00458930
add esp, 4
push 0x44a928
push 0xa
call fcn.0045e41c
add esp, 8
dec esi
sub edi, 4
test esi, esi
jge 0x458764
pop edi
mov edx, dword [esp + 8]
pop esi
lea eax, [edx - 1]
cmp eax, 0x1b
ja case.default.0x4587bf
jmp dword [eax*4 + 0x4588bc]
push 0x44c1d0
jmp 0x4588ad
push 0x44c1b4
jmp 0x4588ad
push 0x44c198
jmp 0x4588ad
push 0x44c178
jmp 0x4588ad
push 0x44c164
jmp 0x4588ad
push 0x44c14c
jmp 0x4588ad
push 0x44c130
jmp 0x4588ad
push 0x44c120
jmp 0x4588ad
push 0x44c100
jmp 0x4588ad
push 0x44c0dc
jmp 0x4588ad
push 0x44c0bc
jmp 0x4588ad
push 0x44c08c
jmp 0x4588ad
push 0x44c07c
jmp 0x4588ad
push 0x44c068
jmp 0x4588ad
push 0x44c048
jmp 0x4588ad
push 0x44c024
jmp 0x4588ad
push 0x44c00c
jmp 0x4588ad
push 0x44bfdc
jmp 0x4588ad
push 0x44bfc8
jmp 0x4588ad
push 0x44bfb4
jmp 0x4588ad
push 0x44bfa0
jmp 0x4588ad
push 0x44bf78
jmp 0x4588ad
push 0x44bf44
jmp 0x4588ad
push 0x44bf20
jmp 0x4588ad
push 0x44bef4
jmp 0x4588ad
push 0x44beb4
jmp 0x4588ad
push 0x44be94
jmp 0x4588ad
push 0x44be80
jmp 0x4588ad
push 0x44be6c
call fcn.00458930
add esp, 4
push 0
call fcn.0045494a
mov byte [edi - 0x782fffbb], 0x45
add dl, bl
xchg dword [ebp], eax
in al, 0x87
inc ebp
add dh, ch
xchg dword [ebp], eax
clc
xchg dword [ebp], eax
add cl, byte [eax - 0x77f3ffbb]
inc ebp
add byte [esi], dl
mov byte [ebp], al
and byte [eax - 0x77d5ffbb], cl
inc ebp
add byte [ecx], dh
mov byte [ebp], al
cmp byte [eax - 0x77c0ffbb], cl
inc ebp
add byte [esi - 0x78], al
inc ebp
add byte [ebp - 0x78], cl
inc ebp
add byte [eax + ecx*4 + 0x45], dl
add byte [ebx - 0x78], bl
inc ebp
add byte [edx - 0x78], ah
inc ebp
add byte [ecx - 0x78], ch
inc ebp
add byte [eax - 0x78], dh
inc ebp
add byte [edi - 0x78], dh
inc ebp
add byte [esi - 0x78], bh
inc ebp
add byte [ebp - 0x73ffba78], al
mov byte [ebp], al
xchg ebx, eax
mov byte [ebp], al
lcall 0x4588, 0xa1004588
add byte [eax + 1452314768], dl
push esi
mov esi, dword [esp + 8]
mov al, byte [esi]
test al, al
je 0x458953
movsx eax, al
push 0x44a928
push eax
inc esi
call fcn.0045e41c
mov al, byte [esi]
add esp, 8
test al, al
jne 0x45893b
pop esi
ret
Function at 0x45dfa0
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0045e023
jae 0x45dfae
xor ecx, ecx
call fcn.0045e023
jae 0x45dfdd
xor eax, eax
call fcn.0045e023
jae 0x45dfed
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0045e023
adc al, al
jae 0x45dfcf
jne 0x45e019
stosb byte es:[edi], al
jmp 0x45dfb1
call fcn.0045e02f
sub ecx, ebx
jne 0x45dff6
call fcn.0045e02d
jmp 0x45e015
lodsb al, byte [esi]
shr eax, 1
je 0x45e03f
adc ecx, ecx
jmp 0x45e012
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0045e02d
cmp eax, 0x7d00
jae 0x45e012
cmp ah, 5
jae 0x45e013
cmp eax, 0x7f
ja 0x45e014
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x45dfb1
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret
Function at 0x45e330
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x44c234
sub eax, eax
test esi, esi
je 0x45e410
sub eax, 1
test ecx, ecx
je 0x45e40e
test esi, 3
je 0x45e36e
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x45e353
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x45e3f5
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x45e37c
mov ecx, edx
test ecx, ecx
je 0x45e40e
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x45e3fb
not eax
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x4015f4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], str.WindowsApp
mov dword [ebp - 0x48], sym._WindowProcedure_16
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x50], 0x30
add esp, 0xfffffff8
push 0x4015e2
push 0
call sub.USER32.dll_LoadIconA
add esp, 8
mov eax, eax
mov dword [ebp - 0x38], eax
add esp, 0xfffffff8
push 0x4015e2
push 0
call sub.USER32.dll_LoadIconA
add esp, 8
mov eax, eax
mov dword [ebp - 0x24], eax
add esp, 0xfffffff8
push 0x7f00
push 0
call sub.USER32.dll_LoadCursorA
add esp, 8
mov eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
add esp, 0xfffffff8
push 0xc8d0d4
push 6
call sub.GDI32.dll_CreateHatchBrush
add esp, 8
mov eax, eax
mov dword [ebp - 0x30], eax
add esp, 0xfffffff4
lea eax, [ebp - 0x50]
push eax
call sub.USER32.dll_RegisterClassExA
add esp, 0xc
mov eax, eax
test ax, ax
jne 0x4016b0
xor eax, eax
jmp 0x401747
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push 0x258
push 0x320
push 0x80000000
push 0x80000000
push 0xcb0000
push 0x4015ec
push str.WindowsApp
push 0
call sub.USER32.dll_CreateWindowExA
mov eax, eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [0x54f510], eax
add esp, 0xfffffff8
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0x54]
push eax
call sub.USER32.dll_ShowWindow
add esp, 8
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call sub.USER32.dll_GetMessageA
mov eax, eax
test eax, eax
jne 0x401720
jmp 0x401740
add esp, 0xfffffff4
lea eax, [ebp - 0x20]
push eax
call sub.USER32.dll_TranslateMessage
add esp, 0xc
add esp, 0xfffffff4
lea eax, [ebp - 0x20]
push eax
call sub.USER32.dll_DispatchMessageA
add esp, 0xc
jmp 0x401704
mov edx, dword [ebp - 0x18]
mov eax, edx
jmp 0x401747
leave
ret 0x10
Function at 0x40174c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x401800
cmp eax, 3
ja 0x401772
cmp eax, 1
je 0x4017a0
cmp eax, 2
je 0x4017d2
jmp 0x4018c4
cmp eax, 7
je 0x401800
cmp eax, 7
ja 0x401790
cmp eax, 5
je 0x4017e4
jmp 0x4018c4
cmp eax, 0x200
je 0x401820
jmp 0x4018c4
call sym._update
mov dword [0x54f520], 0
mov dword [0x54f524], 0
add esp, 0xfffffffc
push 0
push 0
push sym._timerThread
call sym.__beginthread
add esp, 0x10
jmp 0x4018e0
add esp, 0xfffffff4
push 0
call sub.USER32.dll_PostQuitMessage
add esp, 0xc
jmp 0x4018e0
cmp dword [ebp + 0x10], 1
je 0x4017f9
add esp, 0xfffffff4
mov eax, dword [ebp + 8]
push eax
call sym._blit
add esp, 0x10
jmp 0x4018e0
call sym._update
add esp, 0xfffffff4
mov eax, dword [ebp + 8]
push eax
call sym._blit
add esp, 0x10
jmp 0x4018e0
mov eax, dword [ebp + 0x14]
shr eax, 0x10
movzx edx, ax
mov dword [ebp - 8], edx
movzx eax, word [ebp + 0x14]
mov dword [ebp - 4], eax
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x54f540]
je 0x4018c2
mov eax, dword [ebp - 0xc]
mov dword [0x54f540], eax
cmp dword [ebp - 4], 0x31
jg 0x401861
mov eax, dword [ebp - 4]
add eax, 0xffffffce
mov dword [0x54f550], eax
jmp 0x40188a
cmp dword [ebp - 4], 0x2ea
jle 0x401880
mov eax, dword [ebp - 4]
add eax, 0xfffffd16
mov dword [0x54f550], eax
jmp 0x40188a
mov dword [0x54f550], 0
cmp dword [ebp - 8], 0x31
jg 0x4018a0
mov eax, dword [ebp - 8]
add eax, 0xffffffce
mov dword [0x54f530], eax
jmp 0x4018c2
cmp dword [ebp - 8], 0x208
jle 0x4018b8
mov eax, dword [ebp - 8]
add eax, 0xfffffdf8
mov dword [0x54f530], eax
jmp 0x4018c2
mov dword [0x54f530], 0
jmp 0x4018e0
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.USER32.dll_DefWindowProcA
mov edx, eax
mov eax, edx
jmp 0x4018e0
leave
ret 0x10

Function at 0x4018f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
call sym.___main
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
add esp, 0xfffffff4
lea eax, [ebp - 0x50]
push eax
call sub.KERNEL32.dll_GetStartupInfoA
add esp, 0xc
test ebx, ebx
je 0x40195c
jmp 0x401919
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x401918
cmp al, 9
je 0x401918
mov al, byte [ebx]
cmp al, 0x22
jne 0x401943
lea esi, [esi]
inc ebx
mov al, byte [ebx]
cmp al, 0x22
je 0x401951
test al, al
jne 0x401930
jmp 0x401952
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x401951
cmp al, 9
je 0x401952
test al, al
jne 0x401940
jmp 0x401952
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x401951
cmp al, 9
je 0x401951
mov eax, 0xa
test byte [ebp - 0x24], 1
je 0x40196b
movzx eax, word [ebp - 0x20]
push eax
push ebx
push 0
add esp, 0xfffffff4
push 0
call sub.KERNEL32.dll_GetModuleHandleA
add esp, 0xc
push eax
call sym._WinMain_16
mov ebx, dword [ebp - 0x68]
leave
ret
Function at 0x401a20
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebx
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov bl, 1
test eax, eax
je 0x401a31
mov eax, ebx
pop ebx
ret
push str.sbiedll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x401a2d
push str.sbieDll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x401a2d
push str.vboxhook.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x401a2d
push str.VBoxHook.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x401a2d
push str.vmcheck.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x401a2d
push str.vmsrvc.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x401a2d
push str.vmtools.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x401a2d
push str.vgauth.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x401a2d
push str.vmhgfs.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x401a2d
push str.vmguestlib.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x401a2d
push str.vmhgfs.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
setne bl
mov eax, ebx
pop ebx
ret

Function at 0x4051f0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 8]
lock inc dword [0x441178]
test eax, eax
je 0x40520b
lock inc dword [0x44117c]
push esi
push eax
call sub.msvcrt.dll_realloc
add esp, 8
test eax, eax
je 0x405237
mov ecx, dword [esp + 0x10]
sub esi, ecx
jbe 0x405235
mov edx, eax
add edx, ecx
push esi
push 0
push edx
mov esi, eax
call sub.msvcrt.dll_memset
mov eax, esi
add esp, 0xc
pop esi
ret
push 2
call dword [0x43e020]
add esp, 4
push eax
push 1
push 0x10
push str.realloc_failed__n
call sub.msvcrt.dll_fwrite
add esp, 0x10
push 0xffffffffffffffff
call sub.msvcrt.dll_exit
int3

Function at 0x405260
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
lock inc dword [0x441178]
push eax
push 1
call sub.msvcrt.dll_calloc
add esp, 8
test eax, eax
je 0x40527b
ret
push 2
call dword [0x43e020]
add esp, 4
push eax
push 1
push 0xf
push 0x438830
call sub.msvcrt.dll_fwrite
add esp, 0x10
push 0xffffffffffffffff
call sub.msvcrt.dll_exit
int3
Function at 0x4062c0
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x14]
mov ecx, dword [esi + 0x24]
test cl, 8
jne 0x40643a
and ecx, 0xffffc007
or ecx, 8
mov dword [esi + 0x24], ecx
mov eax, dword [0x441118]
inc eax
mov dword [0x441118], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov edi, dword [esi]
movd xmm0, dword [edi + 0x24]
movd xmm1, dword [edi + 0x20]
punpckldq xmm1, xmm0
pshufd xmm0, xmm1, 0x44
movdqu xmmword [esi + 0x48], xmm0
and ecx, 0xffff800f
mov dword [esi + 0x24], ecx
mov edx, dword [edi + 0xc0]
test edx, edx
je 0x406340
mov eax, dword [edi + 0xbc]
jmp 0x406366
mov dword [edi + 0xc0], 0x2000
push 0x2000
call fcn.00405260
add esp, 4
mov dword [edi + 0xbc], eax
mov edx, dword [edi + 0xc0]
mov ecx, dword [esi + 0x24]
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], edx
pxor xmm0, xmm0
movdqu xmmword [esi + 0x60], xmm0
mov dword [esi + 0x70], 0x2000000
mov dword [esi + 0x74], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0x2000000
and ecx, 0xffff7fff
movdqu xmmword [esi + 0xa8], xmm0
movdqu xmmword [esi + 0xb8], xmm0
movdqu xmmword [esi + 0xc8], xmm0
movdqu xmmword [esi + 0xd8], xmm0
movdqu xmmword [esi + 0xe8], xmm0
pxor xmm0, xmm0
movq qword [esi + 0xf8], xmm0
mov dword [esi + 0x24], ecx
mov dword [esi + 0x100], 0
mov dword [esi + 0x104], 0
mov dword [esp], 0
mov dword [esp + 4], 4
lea eax, [esp + 4]
mov edi, esp
push eax
push edi
push 0x1008
push 0xffff
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
je 0x406440
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2736
jne 0x406459
mov ecx, dword [esi + 0x30]
mov eax, 0x10
cmp ecx, 2
ja 0x406437
mov eax, dword [ecx*4 + 0x438b4c]
mov dword [esi + 0x28], eax
add esp, 8
pop esi
pop edi
ret
mov eax, dword [esp]
cmp eax, 1
je 0x406459
cmp eax, 2
je 0x40646c
cmp eax, 3
jne 0x406473
mov eax, 0x100
jmp 0x406478
mov dword [esi + 0x28], 0x100000
mov eax, dword [esi + 0x30]
mov dword [esp], 1
jmp 0x406485
mov eax, 0x1000
jmp 0x406478
mov eax, 0xfffff00
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x30]
mov dword [esp], 0
push edi
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4064da
cmp dword [esi + 0x44], 0
je 0x4064ed
mov dword [esp], 0x1c
push edi
push eax
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_getsockname]
movzx eax, word [esi + 0x2a]
test eax, 0xff0
je 0x40643a
mov dword [esp], 0x1c
push edi
push dword [esi + 0x44]
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_getpeername]
add esp, 8
pop esi
pop edi
ret
push 0x1c
call fcn.00405260
add esp, 4
mov dword [esi + 0x40], eax
cmp dword [esi + 0x44], 0
jne 0x40649f
push 0x1c
call fcn.00405260
add esp, 4
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x40]
jmp 0x40649f
Function at 0x407390
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
cmp dword [ebp], 0
je 0x407450
cmp dword [ebp + 4], 0
je 0x40745d
mov eax, dword [ebp + 8]
or eax, dword [ebp + 0xc]
je 0x407470
lea edi, [ebx + 0xe0]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0xcc]
cmp eax, 0xffffffff
je 0x407480
push 0
push 1
push 0x438b58
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x4074ae
mov ecx, dword [ebx + 0xd8]
test ecx, ecx
je 0x4074cd
mov esi, dword [ebx + 0xd4]
cmp esi, ecx
jne 0x407512
mov eax, ecx
add eax, ecx
mov esi, 0x10
cmovne esi, eax
lea eax, [esi*8]
lea eax, [eax + eax*4]
shl ecx, 3
lea ecx, [ecx + ecx*4]
push ecx
push eax
push dword [ebx + 0xd0]
call fcn.004051f0
add esp, 0xc
mov dword [ebx + 0xd0], eax
mov dword [ebx + 0xd8], esi
mov edx, dword [ebx + 0xdc]
jmp 0x407554
mov dword [ebp], ebx
cmp dword [ebp + 4], 0
jne 0x4073b1
mov dword [ebp + 4], 0x400
mov eax, dword [ebp + 8]
or eax, dword [ebp + 0xc]
jne 0x4073bd
call fcn.00406280
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], eax
jmp 0x4073bd
lea eax, [ebx + 0xc8]
push eax
push 0
push 1
push 2
call fcn.0040fe20
add esp, 0x10
test eax, eax
je 0x407594
call fcn.00405f60
push str.hloop_create_eventfds
push str._s:_socketpair_create_failed_
jmp 0x4074bd
call fcn.00405f60
push str.hloop_post_event
push str._s:_hloop_post_event_failed_
push 4
push eax
call fcn.00405460
add esp, 0x10
jmp 0x407585
mov dword [ebx + 0xdc], 0
mov dword [ebx + 0xd4], 0
mov dword [ebx + 0xd8], 0x10
push 0x280
call fcn.00405260
add esp, 4
mov dword [ebx + 0xd0], eax
mov ecx, dword [ebx + 0xd8]
mov esi, dword [ebx + 0xd4]
cmp esi, ecx
je 0x40740d
mov dword [esp], edi
mov eax, dword [ebx + 0xd0]
mov edx, dword [ebx + 0xdc]
lea edi, [edx + esi]
cmp edi, ecx
jne 0x407551
lea ecx, [edx + edx*4]
lea ecx, [eax + ecx*8]
shl esi, 3
lea edx, [esi + esi*4]
push edx
push ecx
push eax
call sub.msvcrt.dll_memmove
add esp, 0xc
mov dword [ebx + 0xdc], 0
mov eax, dword [ebx + 0xd0]
xor edx, edx
mov edi, dword [esp]
mov ecx, dword [ebx + 0xd4]
lea edx, [edx + edx*4]
lea eax, [eax + edx*8]
lea ecx, [ecx + ecx*4]
movsd xmm0, qword [ebp + 0x20]
movsd qword [eax + ecx*8 + 0x20], xmm0
movups xmm0, xmmword [ebp]
movups xmm1, xmmword [ebp + 0x10]
movups xmmword [eax + ecx*8 + 0x10], xmm1
movups xmmword [eax + ecx*8], xmm0
inc dword [ebx + 0xd4]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [ebx + 0xc8]
push ebx
call fcn.00408310
add esp, 8
mov esi, eax
mov dword [eax + 0xa8], 0x408930
push eax
call fcn.00409250
add esp, 4
mov dword [esi + 0x20], 3
inc dword [ebx + 0x3c]
mov eax, dword [ebx + 0xcc]
jmp 0x4073d9
Function at 0x408710
Capabilities:
Create udp socket

Disassembly:
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x30]
xorps xmm0, xmm0
movups xmmword [esp + 0xc], xmm0
movups xmmword [esp], xmm0
xor esi, esi
test eax, eax
js 0x40877c
mov edi, esp
push eax
push dword [esp + 0x30]
push edi
call fcn.0040fce0
add esp, 0xc
test eax, eax
jne 0x40877c
movzx eax, word [esp]
push 0
push 2
push eax
call dword [sym.imp.WS2_32.dll_socket]
test eax, eax
js 0x408784
push eax
push dword [esp + 0x2c]
call fcn.00408310
add esp, 8
mov esi, eax
mov dword [eax + 0x28], 0x1000
push edi
call fcn.0040fd40
add esp, 4
push eax
push edi
push esi
call fcn.00406b60
add esp, 0xc
mov eax, esi
add esp, 0x1c
pop esi
pop edi
ret
push 0x438c0c
call sub.msvcrt.dll_perror
add esp, 4
jmp 0x40877c

Function at 0x4090d0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov esi, dword [ebp + 8]
mov edi, dword [esi + 0x30]
mov ebx, dword [esi + 0x44]
push ebx
call fcn.0040fd40
add esp, 4
push eax
push ebx
push edi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x409136
jne 0x409145
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
xorps xmm1, xmm1
movsd qword [esp + 0x20], xmm1
movaps xmmword [esp], xmm0
mov dword [esp + 0x10], 0x409b30
mov dword [esp + 0x14], esi
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x18], eax
mov eax, esp
push eax
push dword [esi]
call fcn.00407390
add esp, 8
xor eax, eax
jmp 0x409184
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x40918c
mov eax, dword [esi + 0xbc]
test eax, eax
mov ecx, 0x2710
cmovne ecx, eax
push 1
push ecx
push 0x4091b0
push dword [esi]
call fcn.00407c70
add esp, 0x10
mov dword [esi + 0xd8], eax
mov dword [eax + 0x18], esi
or byte [esi + 0x24], 0x80
push 4
push 0x408a50
push esi
call fcn.00408430
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x438c72
call sub.msvcrt.dll_perror
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x34], eax
push esi
call fcn.00408520
add esp, 4
mov eax, edi
jmp 0x409184