joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cd30
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42a378
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x5ac], ebx
jne 0x41cf46
mov eax, dword [esi + 0x5c0]
mov dword [esi + 0x88], ebx
cmp eax, ebx
jne 0x41cda4
mov eax, dword [esi + 0x94]
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str.TDebugerConfig.ini
push eax
push str.ObjPath
push str.Setting
call edi
mov eax, dword [esi + 0x520]
push str.TDebugerConfig.ini
push eax
push str.DescribeFilePath
push str.Setting
call edi
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 0x9c]
call sub.MFC42.DLL_CRichEditCtrl::SetSel
mov eax, dword [esi + 0xbc]
push 0x432278
push ebx
push 0xc2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x10]
call fcn.00426fd2
lea edi, [esi + 0x94]
push 0x5c
mov ecx, edi
mov dword [ebp - 4], ebx
call sub.MFC42.DLL_CString::ReverseFind
inc eax
lea ecx, [ebp - 0x14]
push eax
push ecx
mov ecx, edi
call sub.MFC42.DLL_CString::Mid
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00426fc6
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call sub.MFC42.DLL_CString::CString
push 0x2e
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::Find
lea edx, [ebp - 0x14]
push eax
push edx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00426fc6
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], ebx
je 0x41cf37
push ebx
push 4
push ebx
push 1
push 0x42bae0
call sub.MFC42.DLL_AfxBeginThread_1
lea ebx, [esi + 0x15c]
push 0
mov ecx, ebx
mov dword [esi + 0x5ac], eax
call sub.MFC42.DLL_CWnd::EnableWindow
lea ecx, [esi + 0x11c]
push 0
call sub.MFC42.DLL_CWnd::EnableWindow
push 0
lea ecx, [esi + 0x45c]
call sub.MFC42.DLL_CWnd::EnableWindow
push 0
lea ecx, [esi + 0x39c]
call sub.MFC42.DLL_CWnd::EnableWindow
push 0
lea ecx, [esi + 0x21c]
call sub.MFC42.DLL_CWnd::EnableWindow
push 0
lea ecx, [esi + 0x25c]
call sub.MFC42.DLL_CWnd::EnableWindow
push 0
push 1
mov ecx, esi
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
push 0
mov ecx, ebx
call sub.MFC42.DLL_CWnd::EnableWindow
push 0
lea ecx, [esi + 0x11c]
call sub.MFC42.DLL_CWnd::EnableWindow
push 1
lea ecx, [esi + 0x2dc]
call sub.MFC42.DLL_CWnd::EnableWindow
push 1
lea ecx, [esi + 0xdc]
call sub.MFC42.DLL_CWnd::EnableWindow
mov ecx, dword [esi + 0x5ac]
push edi
add ecx, 0x6c
call fcn.00426fc6
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [esi + 0x5ac]
add ecx, 0x70
call fcn.00426fc6
mov edx, dword [esi + 0x5ac]
mov eax, dword [esi + 0x5c0]
mov dword [edx + 0x78], eax
mov ecx, dword [esi + 0x5ac]
mov dword [ecx + 0x74], esi
mov esi, dword [esi + 0x5ac]
mov edx, dword [esi + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x41e6bc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x41e703
cmp edx, 0x10
jl 0x41e6ef
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x41e6dc
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x41e703
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x41e6fb
and edx, 3
cmp edx, 3
jne 0x41e717
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x41e71c
cmp edx, 2
jne 0x41e728
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x41e72d
cmp edx, 1
jne 0x41e733
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x422090
Capabilities:
Encode data using xor

Disassembly:
push esi
mov eax, 0x8000
xor cx, cx
push edi
mov edi, dword [esp + 0xc]
mov word [edi + 0x3c], ax
mov esi, dword [edi + 0x14]
mov dword [edi + 0x20], 0
mov dword [edi + 0x34], eax
movzx eax, cx
inc cx
xor edx, edx
mov dl, byte [eax + esi + 0x8000]
mov eax, dword [edi + 0x20]
shl eax, 5
xor edx, eax
and edx, 0x7fff
cmp cx, 2
mov dword [edi + 0x20], edx
jb 0x4220af
pop edi
pop esi
ret
Function at 0x427510
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x1c]
or al, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x34], 0
jne 0x42752d
mov ecx, dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp + 0x34], ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x28]
push eax
mov ecx, dword [ebp + 0x24]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp + 0x34]
test eax, eax
jne 0x427560
xor eax, eax
jmp 0x4275d8
cmp dword [ebp + 0x30], 0
je 0x42757a
mov eax, dword [ebp + 0x30]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 1
mov dword [ebp - 0x18], eax
jmp 0x427581
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 0x30]
push edx
call fcn.00427470
push eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004275e0
add esp, 0x14
test eax, eax
jne 0x4275a7
xor eax, eax
jmp 0x4275d8
cmp dword [ebp + 0x2c], 0
je 0x4275bf
push 0x10
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x2c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp + 0x1c]
and ecx, 4
test ecx, ecx
jne 0x4275d3
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
mov esp, ebp
pop ebp
ret 0x30
Function at 0x427a7f
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x5c
push 0
push esi
call sub.MSVCRT.dll_memset
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
add esp, 0xc
and dword [esi + 0x58], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
pop ebp
ret
Function at 0x4012e0
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0x24
push esi
push edi
mov esi, dword [esp + 0x30]
push 0x446718
push 0x446718
mov edi, dword [sym.imp.MSVCRT.dll_fprintf]
push str.Client
push 0x446718
push 0x446718
push 0x446718
push str.Engine
push str.Databases
push str._n__10.10s___6.6s___6.6s___6.6s___6.6s___6.6s___6.6s___6.6s_n
push esi
call edi
push str.busy
push str.idle
push str.wait
push str.busy
push str.idle
push str.detach
push str.free
push 0x446718
push str.__10.10s__6.6s__6.6s__6.6s__6.6s__6.6s__6.6s__6.6s_n
push esi
call edi
mov eax, dword [0x446220]
xor edi, edi
add esp, 0x50
cmp eax, edi
mov dword [esp + 0x1c], edi
jle 0x401499
xor esi, esi
push ebx
push ebp
mov dword [esp + 0x28], esi
mov eax, dword [0x446224]
add esi, eax
mov eax, dword [esi + 0xc5]
cmp eax, edi
mov dword [esp + 0x30], eax
je 0x401472
mov eax, dword [0x446520]
xor ebp, ebp
xor ebx, ebx
xor edx, edx
cmp eax, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x1c], edi
je 0x4013f3
mov edi, dword [0x446518]
mov ecx, eax
cmp edx, edi
jge 0x4013f1
mov eax, dword [esp + 0x24]
mov ebp, dword [ecx + 0xe]
cmp eax, ebp
jne 0x4013e7
mov eax, dword [ecx]
cmp eax, 0xca
jne 0x4013d1
inc dword [esp + 0x14]
cmp eax, 0xcb
jne 0x4013dc
inc dword [esp + 0x18]
cmp eax, 0xcc
jne 0x4013e7
inc dword [esp + 0x10]
mov ebp, dword [esp + 0x2c]
inc edx
add ecx, 0x1a
jmp 0x4013b5
xor edi, edi
mov edx, dword [0x44646c]
xor ecx, ecx
cmp edx, edi
je 0x401443
cmp ecx, dword [esp + 0x30]
jge 0x401443
mov eax, dword [esi + 0xbd]
add eax, ecx
lea edi, [eax + eax*2]
lea eax, [eax + edi*4]
lea eax, [edx + eax*8]
mov eax, dword [eax]
cmp eax, 0x194
jne 0x401423
inc dword [esp + 0x20]
cmp eax, 0x193
jne 0x40142e
inc dword [esp + 0x1c]
cmp eax, 0x191
jne 0x401436
inc ebp
cmp eax, 0x192
jne 0x40143e
inc ebx
inc ecx
xor edi, edi
jmp 0x4013ff
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x44]
push ecx
push ebx
push edx
push ebp
push esi
push str.__10.10s__6d__6d__6d__6d__6d__6d__6d_n
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0x28
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov ecx, dword [0x446220]
inc eax
add esi, 0x97b
cmp eax, ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], esi
jl 0x40136d
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x24
ret
Function at 0x407a80
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x4466c8]
test eax, eax
jne 0x407b46
push esi
call fcn.00408e80
test eax, 0xff000
je 0x407b00
mov eax, dword [sym.imp.MSVCRT.dll__iob]
mov esi, dword [sym.imp.MSVCRT.dll_fprintf]
push edi
add eax, 0x40
push str._nTo_manage_the_service_state_please_call:_n
push eax
call esi
mov edi, dword [esp + 0x14]
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
push edi
add ecx, 0x40
push str._t_s__stopstartremoveinstall__arguments_query__n_n
push ecx
call esi
mov edx, dword [sym.imp.MSVCRT.dll__iob]
push str.To_run_the_multiplexer_directly_from_a_console_please_call:_n
add edx, 0x40
push edx
call esi
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push edi
add eax, 0x40
push str._t_s_noservice
push eax
call esi
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
push str.____tbk__tbkernel_______tbs__tbserver_____n
add ecx, 0x40
push ecx
call esi
add esp, 0x30
pop edi
jmp 0x407b2f
mov edx, dword [esp + 8]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
mov esi, dword [sym.imp.MSVCRT.dll_fprintf]
push edx
add eax, 0x40
push str.Usage:__s
push eax
call esi
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
push str.__tbk__tbkernel___tbs__tbserver___n
add ecx, 0x40
push ecx
call esi
add esp, 0x14
mov edx, dword [sym.imp.MSVCRT.dll__iob]
push str._t_______nolookup____n_t_______d____n_______________i___inactivity_timeout_for_multiplexed_kernels_____n_______________id__inactivity_timeout_for_dedicated_kernels_____n_______________a__accept_timeout_____n_______________sk__start_kernel_timeout_____n_______________p__poll_timeout_____n_______________l__lazy_timeout_____n_______________wta__weight_for_transaction_____n_______________welaps__weight_for_elapsed_seconds_____n_______________restart__restart_value_____n_______________fwstart__val1___fwstop__val2____n
add edx, 0x40
push edx
call esi
add esp, 8
pop esi
jmp 0x407b55
push str.Illegal_Usage
push 1
call fcn.00408090
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop

Function at 0x407da0
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x400
lea eax, [esp]
push 0x4200cc
push str.SYSTEMCurrentControlSetServicesEventLogApplication_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp]
push ecx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor eax, eax
add esp, 0x400
ret
Function at 0x407de0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x408
lea eax, [esp + 8]
push 0x4200cc
push str.SYSTEMCurrentControlSetServicesEventLogApplication_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp]
lea edx, [esp + 8]
push ecx
push edx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x407e20
xor eax, eax
add esp, 0x408
ret
mov edx, dword [esp + 0x40c]
push esi
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x18]
push str.EventMessageFile
push eax
call esi
test eax, eax
jne 0x407e6d
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push eax
push str.TypesSupported
push edx
mov dword [esp + 0x24], 7
call esi
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 0x408
ret

Function at 0x408090
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x40c
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x458954], eax
call fcn.00408e80
test eax, 0xff000
je 0x408102
push 0x4200cc
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
mov eax, dword [esp + 0x418]
test esi, esi
mov dword [esp + 4], eax
je 0x408156
mov edx, dword [esp + 0x414]
lea ecx, [esp + 4]
push 0
push ecx
push 0
push 1
push 0
push 0x40001001
push 0
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
add esp, 0x40c
ret
mov eax, dword [0x4466d0]
lea ecx, [esp + 0xc]
push eax
push str._s_tbmux.log
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [esp + 0x18]
push 0x420244
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0x14
test esi, esi
je 0x408156
mov eax, dword [esp + 0x418]
mov ecx, dword [0x458954]
push eax
push ecx
push str._ld_t_s_n
push esi
call dword [sym.imp.MSVCRT.dll_fprintf]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
pop esi
add esp, 0x40c
ret
Function at 0x408e80
Capabilities:
Check os version

Disassembly:
mov eax, dword [0x446e94]
sub esp, 0x9c
test eax, eax
jne 0x408f77
lea eax, [esp]
mov dword [esp], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x10]
sub eax, 0
je 0x408f6d
dec eax
je 0x408f2d
dec eax
je 0x408eca
mov eax, 0x8000
mov dword [0x446e94], eax
add esp, 0x9c
ret
mov ecx, dword [esp + 4]
lea eax, [ecx - 3]
cmp eax, 3
ja case.0x408ed6.6
jmp dword [eax*4 + 0x408f80]
mov eax, 0x1000
mov dword [0x446e94], eax
add esp, 0x9c
ret
mov eax, 0x2000
mov dword [0x446e94], eax
add esp, 0x9c
ret
mov eax, dword [esp + 8]
sub eax, 0
je 0x408f1c
dec eax
je case.0x408ed6.6
mov eax, 0x10000
mov dword [0x446e94], eax
add esp, 0x9c
ret
mov eax, 0x4000
mov dword [0x446e94], eax
add esp, 0x9c
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x408f5c
cmp eax, 0xa
je 0x408f4b
mov eax, 0x40
mov dword [0x446e94], eax
add esp, 0x9c
ret
mov eax, 0x10
mov dword [0x446e94], eax
add esp, 0x9c
ret
mov eax, 4
mov dword [0x446e94], eax
add esp, 0x9c
ret
mov eax, 2
mov dword [0x446e94], eax
add esp, 0x9c
ret

Function at 0x409000
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push esi
push 0
push eax
push ecx
push edx
call sub.WSOCK32.dll_send
mov esi, eax
cmp esi, 0xffffffff
jne 0x409023
call fcn.00409030
mov eax, esi
pop esi
ret
Function at 0x4090c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0xb
push ebp
call fcn.004092a0
add esp, 8
cmp eax, 0xffffffff
jne 0x4090e5
call fcn.00409030
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
call fcn.00408e80
test eax, 0xff07c
mov eax, dword [0x421668]
je 0x4091d9
cmp eax, 0xffffffff
jne 0x4091d9
push str.SELECTBEFOREREAD
call fcn.004187e0
mov edi, eax
add esp, 4
test edi, edi
je 0x4091cd
mov esi, 0x421698
mov ecx, edi
mov al, byte [ecx]
mov bl, byte [esi]
mov dl, al
cmp al, bl
jne 0x409149
test dl, dl
je 0x409145
mov al, byte [ecx + 1]
mov bl, byte [esi + 1]
mov dl, al
cmp al, bl
jne 0x409149
add ecx, 2
add esi, 2
test dl, dl
jne 0x409121
xor ecx, ecx
jmp 0x40914e
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x40918a
mov esi, 0x421694
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x409181
test cl, cl
je 0x40917d
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x409181
add eax, 2
add esi, 2
test cl, cl
jne 0x409159
xor eax, eax
jmp 0x409186
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4091cd
mov dword [0x421668], 0
mov eax, dword [0x447050]
test eax, eax
je 0x409203
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
push 0
push edi
push ebx
push ebp
call sub.WSOCK32.dll_recv
mov esi, eax
test esi, esi
jg 0x4091fa
push esi
call fcn.00409250
add esp, 4
test eax, eax
jne 0x4091fa
mov eax, dword [0x447050]
test eax, eax
jne 0x4091a5
jmp 0x409203
mov dword [0x421668], 1
jmp 0x4091de
cmp eax, 1
jne 0x409194
push 0xffffffffffffffff
push ebp
call fcn.00409ab0
add esp, 8
test eax, eax
jg 0x409194
call fcn.00409030
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [0x447050]
test eax, eax
jne 0x40921a
mov dword [0x447050], 1
call fcn.0040a2c0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
test esi, esi
jge 0x409223
call fcn.00409030
push 0xa
push ebp
call fcn.004092a0
add esp, 8
cmp eax, 0xffffffff
jne 0x409240
call fcn.00409030
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4092e0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push 8
push eax
push 0x80
push 0xffff
push esi
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0x32
call sub.WSOCK32.dll_setsockopt
push esi
call sub.WSOCK32.dll_closesocket
pop esi
add esp, 8
ret
Function at 0x409870
Capabilities:
Check for time delay via gettickcount
Set socket configuration

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
push edi
push ebx
mov eax, 1
push 0xffffffffffffffff
push 0xffffffffffffffff
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 0x10
call fcn.0040a050
add esp, 0xc
test eax, eax
jne 0x409a9f
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x34]
mov edx, ecx
lea edi, [esp + 0x1c]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
test esi, esi
rep stosb byte es:[edi], al
je 0x4098cd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
jmp 0x4098d1
mov ebp, dword [esp + 0x38]
mov eax, dword [0x447050]
test eax, eax
jne 0x4098f4
push str.localhost
push 0x2b0e
call fcn.0040b400
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edi, dword [esp + 0x30]
push 0xb
push edi
call fcn.004092a0
add esp, 8
cmp eax, 0xffffffff
jne 0x40991d
push 0x708
call fcn.0040b400
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edi
call sub.WSOCK32.dll_accept
cmp eax, 0xffffffff
jne 0x409975
push 0xffffffffffffffff
call fcn.00409250
add esp, 4
test eax, eax
jne 0x4099a7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test esi, esi
jbe 0x409960
lea ecx, [esi + esi*4]
sub eax, ebp
lea ecx, [ecx + ecx*4]
lea edx, [ecx + ecx*4]
shl edx, 3
cmp eax, edx
ja 0x4099ee
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edi
call sub.WSOCK32.dll_accept
cmp eax, 0xffffffff
je 0x409932
push 0xa
push edi
mov dword [ebx], eax
mov dword [ebx + 8], 1
call fcn.004092a0
add esp, 8
cmp eax, 0xffffffff
jne 0x409a17
push 0x708
call fcn.0040b400
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
call fcn.00409030
mov eax, dword [0x447050]
test eax, eax
jne 0x4099dc
push str.localhost
push 0x2b0e
call fcn.0040b400
add esp, 8
mov esi, eax
push ebx
call fcn.0040a010
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
call fcn.004182f0
add esp, 4
test eax, eax
jne 0x4099f5
test esi, esi
je 0x4099f5
push 0x2b16
jmp 0x4099fa
push 0x708
call fcn.0040b400
add esp, 4
mov esi, eax
push ebx
call fcn.0040a010
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov eax, dword [ebx]
lea edx, [esp + 0x14]
push 4
push edx
push 8
push 0xffff
push eax
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
je 0x409a4a
mov edx, dword [ebx]
lea ecx, [esp + 0x18]
push 4
push ecx
push 1
push 6
push edx
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x409a77
mov eax, dword [ebx]
push 2
push eax
call fcn.004090a0
mov ecx, dword [ebx]
push ecx
call fcn.004092e0
push 0x726
mov dword [ebx], 0xffffffff
call fcn.0040b400
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov eax, dword [esp + 0x3c]
mov edx, dword [ebx]
test eax, eax
mov dword [ebx + 4], edx
je 0x409a98
lea eax, [esp + 0x20]
push 4
push eax
push 0x446fc8
call fcn.00409fa0
add esp, 0xc
call fcn.00418730
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x409ad0
Capabilities:
Get socket status

Disassembly:
mov eax, 0x1014
call fcn.0041cd90
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1030]
xor eax, eax
cmp edi, 0xfffffffe
mov ebx, 1
mov dword [esp + 0x14], eax
jne 0x409b07
mov dword [esp + 0x1030], 5
mov edi, dword [esp + 0x1030]
mov ecx, dword [0x447050]
mov dword [esp + 0x10], eax
cmp ecx, eax
je 0x409c2a
mov ebp, dword [esp + 0x102c]
cmp edi, 0xffffffff
je 0x409b33
test edi, edi
je 0x409b33
cmp dword [esp + 0x10], edi
jge 0x409c21
xor edx, edx
test ebp, ebp
mov dword [esp + 0x20], edx
jle 0x409b71
mov eax, dword [esp + 0x1028]
mov esi, ebp
cmp edx, 0x400
jae 0x409b5d
mov ecx, dword [eax]
mov dword [esp + edx*4 + 0x24], ecx
mov edx, dword [esp + 0x20]
inc edx
mov dword [esp + 0x20], edx
mov ecx, dword [eax]
mov ebx, dword [esp + 0x14]
cmp ecx, ebx
jle 0x409b6b
mov dword [esp + 0x14], ecx
add eax, 4
dec esi
jne 0x409b46
lea eax, [esp + 0x18]
xor edx, edx
push eax
push 0
test edi, edi
lea ecx, [esp + 0x28]
push 0
setne dl
push ecx
push 0x400
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], edx
call sub.WSOCK32.dll_select
mov ebx, eax
test ebx, ebx
jge 0x409bce
mov esi, dword [sym.imp.MSVCRT.dll__errno]
call esi
cmp dword [eax], 4
je 0x409bb9
call esi
cmp dword [eax], 0x202
jne 0x409bc3
call fcn.00409030
jmp 0x409b33
test ebx, ebx
jge 0x409bce
call fcn.00409030
jmp 0x409c01
jle 0x409c01
test ebp, ebp
jle 0x409c01
mov esi, dword [esp + 0x1028]
mov edi, ebp
mov eax, dword [esi]
lea edx, [esp + 0x20]
push edx
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x409bf4
mov dword [esi], 0xffffffff
add esi, 4
dec edi
jne 0x409bdd
mov edi, dword [esp + 0x1030]
test ebx, ebx
jne 0x409c21
test edi, edi
je 0x409c21
mov ecx, dword [esp + 0x10]
mov eax, dword [0x447050]
inc ecx
test eax, eax
mov dword [esp + 0x10], ecx
jne 0x409b20
jmp 0x409c2a
mov eax, dword [0x447050]
test eax, eax
jne 0x409c47
mov dword [0x447050], 1
call fcn.0040a2c0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x1014
ret
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x1014
ret