joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426670
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x466c98]
sub esp, 0x58
push ebp
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
push esi
push edi
xor edi, edi
cmp eax, edi
mov esi, ecx
je 0x4266a9
mov ecx, dword [esi + 0x1055]
push 0x10
push 0x45f5dc
push str.The_OE5DXL_Is_not_Supported_Under_NT_
call fcn.00401480
push eax
call ebp
mov dword [esi + 0x14c3], edi
push edi
push 0x44000000
push edi
push edi
push edi
push edi
push str..AGWDXL.vxd
mov dword [esi + 0x14bf], 7
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x212d], eax
jne 0x42671e
push str.AgwDxl.vxd_Not_Found__n_Tnc_Will_Be_IDLE__
push str.DXL1
push 0x45f65c
mov dword [esi + 0x14c3], edi
mov dword [esi + 0x162c], edi
call fcn.0040d190
mov ecx, dword [esi + 0x1055]
add esp, 0xc
push 0x10
push 0x45f664
push 0x466a30
call fcn.00401480
push eax
call ebp
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x58
ret 4
mov edi, dword [esp + 0x68]
push ebx
push edi
push 3
push 0x45f678
push 0x45f67c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push edi
push 0xa
mov dword [esp + 0x18], eax
mov ebx, eax
lea eax, [esp + 0x50]
push eax
push 0x45f68c
push 0x45f690
push 0x45f698
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x4c]
push 0x45f6a8
push edx
call fcn.0043a803
mov eax, dword [esp + 0x1c]
push 2
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x3d]
push edx
mov dword [esp + 0x2c], eax
mov byte [esp + 0x40], bl
call fcn.004394b0
add esp, 0x18
xor edi, edi
push edi
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esi + 0x212d]
push 0xa
lea ecx, [esp + 0x28]
push ecx
push 5
lea edx, [esp + 0x3c]
push edx
push 0x222000
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov al, byte [esp + 0x1c]
test al, al
pop ebx
je 0x426710
movsx eax, al
dec eax
cmp eax, 3
ja case.default.0x4267cf
jmp dword [eax*4 + 0x4268a0]
push str.OE5DXL_Driver_Not_Installed__Hook_Irq_Failed__
push str.DXL2
push 0x45f6e4
call fcn.0040d190
add esp, 0xc
push 0x10
push 0x45f6ec
jmp 0x426874
push str.OE5DXL_Driver_Not_Installed__Com_ini_Failed__
push str.DXL3
push 0x45f738
call fcn.0040d190
add esp, 0xc
push 0x10
push 0x45f740
jmp 0x426874
push str.OE5DXL_Driver_Not_Installed__Timer_ini_Failed__
push str.DXL4
push 0x45f78c
call fcn.0040d190
add esp, 0xc
push 0x10
push 0x45f794
jmp 0x426874
push str.OE5DXL_Driver_Not_Installed__Port_Trap_Failed__
push str.DXL5
push 0x45f7e0
call fcn.0040d190
add esp, 0xc
push 0x10
push 0x45f7e8
jmp 0x426874
push str.OE5DXL_Driver_Not_Installed_
push str.DXL6
push 0x45f824
call fcn.0040d190
add esp, 0xc
push 0x10
push 0x45f82c
mov ecx, dword [esi + 0x1055]
push 0x466a30
call fcn.00401480
push eax
call ebp
mov dword [esi + 0x14c3], edi
mov dword [esi + 0x162c], edi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x58
ret 4
Function at 0x427610
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x466c98]
sub esp, 0x58
push ebp
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
push esi
push edi
xor edi, edi
cmp eax, edi
mov esi, ecx
je 0x427649
mov ecx, dword [esi + 0x1055]
push 0x10
push 0x460158
push str.The_PICPAR_Is_not_Supported_Under_NT_
call fcn.00401480
push eax
call ebp
mov dword [esi + 0x14c3], edi
push edi
push 0x44000000
push edi
push edi
push edi
push edi
push str.._agwpicpr.vxd
mov dword [esi + 0x14bf], 0xd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x212d], eax
jne 0x4276be
push str.Agwpicpr.vxd_Not_Found__n_Tnc_Will_Be_IDLE__
push str.PICPAR1
push 0x4601dc
mov dword [esi + 0x14c3], edi
mov dword [esi + 0x162c], edi
call fcn.0040d190
mov ecx, dword [esi + 0x1055]
add esp, 0xc
push 0x10
push 0x4601e4
push 0x466a30
call fcn.00401480
push eax
call ebp
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x58
ret 4
mov edi, dword [esp + 0x68]
push ebx
push edi
push 7
push 0x4601f8
push 0x4601fc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push edi
push 0xa
mov dword [esp + 0x18], eax
mov ebx, eax
lea eax, [esp + 0x50]
push eax
push 0x46020c
push 0x460210
push 0x460218
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x4c]
push 0x460228
push edx
call fcn.0043a803
mov eax, dword [esp + 0x1c]
push 2
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x3d]
push edx
mov dword [esp + 0x2c], eax
mov byte [esp + 0x40], bl
call fcn.004394b0
add esp, 0x18
xor edi, edi
push edi
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esi + 0x212d]
push 0xa
lea ecx, [esp + 0x28]
push ecx
push 5
lea edx, [esp + 0x3c]
push edx
push 0x222000
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov al, byte [esp + 0x1c]
test al, al
pop ebx
je 0x4276b0
movsx eax, al
dec eax
je 0x4277ce
dec eax
je 0x4277ae
dec eax
je 0x42778e
push str.PICPAR_BP96_Driver_Not_Installed_
push str.PICPAR5
push 0x460364
call fcn.0040d190
add esp, 0xc
push 0x10
push 0x46036c
jmp 0x4277ec
push str.PICPAR_BP96_Driver_Not_Installed__Timer_ini_Failed__
push str.PICPAR4
push 0x46031c
call fcn.0040d190
add esp, 0xc
push 0x10
push 0x460324
jmp 0x4277ec
push str.PICPAR_BP96_Driver_Not_Installed__LPT_ini_Failed__
push str.PICPAR3
push 0x4602c0
call fcn.0040d190
add esp, 0xc
push 0x10
push 0x4602c8
jmp 0x4277ec
push str.PICPAR_BP96_Driver_Not_Installed__Hook_Irq_Failed__
push str.PICPAR2
push 0x460268
call fcn.0040d190
add esp, 0xc
push 0x10
push 0x460270
mov ecx, dword [esi + 0x1055]
push 0x466a30
call fcn.00401480
push eax
call ebp
mov dword [esi + 0x14c3], edi
mov dword [esi + 0x162c], edi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x58
ret 4
Function at 0x427b40
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x445664
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esi + 0x14bf], 3
push edi
mov edi, dword [0x466d00]
mov ebx, 1
mov dword [0x466cfc], ebx
inc edi
mov dword [0x466d00], edi
mov eax, dword [esi + 0x1055]
mov dword [esi + 0x14c3], ebx
mov dword [esi + 0x162c], ebx
mov dword [eax + 0x328], ebx
mov ecx, dword [0x466d00]
and ecx, 0x80000001
jns 0x427ba9
dec ecx
or ecx, 0xfffffffe
inc ecx
push ecx
push str.SOUNDCARD.HowMany
call fcn.00436550
mov edx, dword [0x466d00]
add esp, 8
and edx, 0x80000001
jns 0x427bca
dec edx
or edx, 0xfffffffe
inc edx
je 0x427c41
push 0x6af18
call fcn.004394a2
add esp, 4
mov dword [esp + 0x10], eax
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], ebp
je 0x427bf0
mov ecx, eax
call fcn.0040f8e0
jmp 0x427bf2
xor eax, eax
mov edx, dword [esp + 0x24]
mov dword [esi + 0x1051], eax
mov eax, dword [esi + 0x1504]
mov dword [0x466d0c], eax
mov ecx, dword [esi + 0x1051]
mov dword [0x466d20], ecx
mov ecx, dword [esi + 0x1051]
push edx
mov dword [esp + 0x20], 0xffffffff
call fcn.004105b0
test eax, eax
jne 0x427c39
mov dword [esi + 0x14c3], ebp
mov dword [esi + 0x162c], ebp
jmp 0x427cae
mov dword [esi + 0x162c], ebx
jmp 0x427ca6
mov edi, dword [esp + 0x24]
push edi
xor ebp, ebp
push ebp
push 0x460618
push 0x460624
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [esi + 0x1055]
mov dword [esi + 0x160c], eax
mov eax, dword [0x466d04]
mov dword [esi + 0x212d], eax
mov dword [esi + 0x162c], ebp
mov edx, dword [0x466d0c]
mov eax, dword [ecx + edx*4 + 0x30]
mov ecx, dword [esi + 0x1504]
mov dword [eax + 0x160c], ecx
mov edx, dword [0x466d20]
push edi
mov ecx, edx
mov dword [esi + 0x1051], edx
call fcn.0040f9e0
mov dword [esi + 0x162c], ebp
mov dword [esi + 0x14c3], ebx
mov eax, ebx
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4282e0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x258
push ebx
push esi
mov esi, ecx
push str.axipdrv
mov dword [esi + 0x14bf], 0x10
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0x1039], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi + 0x1039]
xor ebx, ebx
cmp ecx, ebx
jne 0x42833e
push eax
push str.Error_load_AXIPDRV_instance_Error_d
call fcn.00436550
add esp, 8
mov dword [esi + 0x14c3], ebx
mov dword [esi + 0x162c], ebx
pop esi
xor eax, eax
pop ebx
add esp, 0x258
ret 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.StartDll
push ecx
call edi
mov dword [esi + 0x103d], eax
mov eax, dword [esi + 0x1039]
push str.EndDll
push eax
call edi
mov ecx, dword [esi + 0x1039]
push str.ReadData
push ecx
mov dword [esi + 0x1049], eax
call edi
mov edx, dword [esi + 0x1039]
push str.SentData
push edx
mov dword [esi + 0x1041], eax
call edi
cmp dword [esi + 0x103d], ebx
mov dword [esi + 0x1045], eax
jne 0x4283cb
push str.Error_retrieve_AXIPDRV_Startdll
call fcn.00436550
mov eax, dword [esi + 0x1039]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x14c3], ebx
mov dword [esi + 0x162c], ebx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x258
ret 4
cmp dword [esi + 0x1049], ebx
jne 0x428407
push str.Error_retrieve_AXIPDRV_enddll
call fcn.00436550
mov ecx, dword [esi + 0x1039]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov dword [esi + 0x14c3], ebx
mov dword [esi + 0x162c], ebx
pop esi
xor eax, eax
pop ebx
add esp, 0x258
ret 4
cmp dword [esi + 0x1041], ebx
jne 0x428443
push str.Error_retrieve_AXIPDRV_Readdata
call fcn.00436550
mov edx, dword [esi + 0x1039]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov dword [esi + 0x14c3], ebx
mov dword [esi + 0x162c], ebx
pop esi
xor eax, eax
pop ebx
add esp, 0x258
ret 4
cmp eax, ebx
jne 0x428451
push str.Error_retrieve_AXIPDRV_sentdata
jmp 0x42839c
lea edi, [esi + 0x10]
push edi
push 0x32
lea ecx, [esp + 0x78]
push ecx
push 0x46095c
push 0x460960
mov dword [esi + 0x14c3], ebx
mov dword [esi + 0x162c], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x46096c
call ebx
push edi
push 0x32
lea edx, [esp + 0x14]
push edx
push 0x460970
push 0x460974
push 0x460980
call ebx
push edi
push 0x32
lea eax, [esp + 0xdc]
push eax
push 0x460984
push 0x460988
push 0x460994
call ebx
lea ecx, [esp + 0xd4]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x144]
push str._s_s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea edx, [esp + 0x138]
push edx
call dword [esi + 0x103d]
cmp eax, 0x4d2
jne 0x4283bd
mov eax, 1
pop edi
mov dword [esi + 0x14c3], eax
mov dword [esi + 0x162c], eax
pop esi
pop ebx
add esp, 0x258
ret 4
Function at 0x428e10
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4456fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x100
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x4466d0
push str.SERIALPORT1
mov dword [esp + 0x118], 2
call fcn.00436550
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 0xc0
mov byte [esp + 0x14], al
mov byte [esp + 0x16], al
mov eax, dword [esi + 0x14c3]
xor ebx, ebx
add esp, 4
cmp eax, ebx
mov byte [esp + 0x11], 0xff
mov byte [esp + 0x13], 0xd
mov byte [esp + 0x14], bl
je 0x428fd2
push edi
push str.SERIALPORT2
call fcn.00436550
mov eax, dword [esi + 0x162c]
add esp, 4
cmp eax, ebx
je 0x428f8b
mov eax, dword [esi + 0x2141]
push eax
call ebp
cmp dword [esi + 0x14bf], 1
mov dword [esi + 0x162c], ebx
jne 0x428eee
lea ecx, [esi + 0x10]
push ecx
push 1
push 0x45e820
push 0x45e82c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x428eee
push str.SERIALPORT3
call fcn.00436550
mov eax, dword [esi + 0x212d]
push 4
lea edx, [esp + 0x1c]
push edx
push eax
call fcn.00435fc0
add esp, 0x10
push str.SERIALPORT4
call fcn.00436550
mov eax, dword [esi + 0x14bf]
add esp, 4
cmp eax, 3
je 0x428f14
cmp eax, 0x10
je 0x428f14
mov ecx, dword [esi + 0x212d]
push ecx
call ebp
mov edi, dword [esi + 0x144]
cmp edi, ebx
je 0x428f2e
mov ecx, edi
call fcn.00435ae0
push edi
call fcn.0043904c
add esp, 4
cmp dword [esi + 0x14bf], 3
jne 0x428f51
mov edi, dword [esi + 0x1051]
cmp edi, ebx
je 0x428f51
mov ecx, edi
call fcn.004104a0
push edi
call fcn.0043904c
add esp, 4
cmp dword [0x466c98], ebx
je 0x428f8b
cmp dword [esi + 0x14bf], 0xe
jne 0x428f72
mov ecx, dword [esi + 0x104d]
cmp ecx, ebx
je 0x428f72
mov edx, dword [ecx]
push 1
call dword [edx]
cmp dword [esi + 0x14bf], 8
jne 0x428f8b
mov ecx, dword [esi + 0x104d]
cmp ecx, ebx
je 0x428f8b
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [esi + 0x14bf], 0xf
jne 0x428fae
mov edi, dword [esi + 0x144]
cmp edi, ebx
je 0x428fae
mov ecx, edi
call fcn.00435ae0
push edi
call fcn.0043904c
add esp, 4
push str.SERIALPORT5
call fcn.00436550
mov ecx, dword [esi + 0x2145]
add esp, 4
cmp ecx, ebx
mov dword [esi + 0x162c], ebx
pop edi
je 0x428fd2
mov edx, dword [ecx]
push 1
call dword [edx]
cmp dword [esi + 0x14bf], 0x10
jne 0x428fee
call dword [esi + 0x1049]
mov eax, dword [esi + 0x1039]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.SERIALPORT_end
call fcn.00436550
add esp, 4
lea ecx, [esi + 0x148]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [esi + 0x120]
mov byte [esp + 0x114], bl
call fcn.00424970
mov edx, dword [esi + 8]
push edx
mov dword [esi], 0x4464c0
call ebp
mov ecx, dword [esp + 0x10c]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10c
ret
Function at 0x429040
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x144]
push 1
call fcn.00435b60
mov ecx, dword [esp + 8]
xor edx, edx
cmp ecx, edx
mov dword [esi + 0x1630], edx
jbe 0x4292ac
push ebx
push ebp
push edi
jmp 0x429070
cmp dword [esi + 0x2127], 1
mov eax, dword [esi + 0x1630]
jne 0x4290ca
mov dword [esi + 0x2127], edx
mov al, byte [eax + esi + 0x1634]
cmp al, 0xdc
jne 0x4290ab
movsx eax, word [esi + 0x212b]
mov byte [eax + esi + 0x160], 0xc0
inc word [esi + 0x212b]
jmp 0x429292
cmp al, 0xdd
jne 0x4290be
movsx eax, word [esi + 0x212b]
mov byte [eax + esi + 0x160], 0xdb
inc word [esi + 0x212b]
jmp 0x429292
movsx edi, word [esi + 0x212b]
mov al, byte [eax + esi + 0x1634]
mov byte [edi + esi + 0x160], al
mov bp, word [esi + 0x212b]
movsx ebx, bp
movzx eax, byte [ebx + esi + 0x160]
sub eax, 0xc0
lea edi, [ebx + esi + 0x160]
je 0x42914d
sub eax, 0x1b
jne 0x429279
mov ebp, dword [esi + 0x1630]
inc ebp
mov eax, ebp
cmp eax, ecx
mov dword [esi + 0x1630], ebp
jne 0x42912a
mov dword [esi + 0x2127], 1
jmp 0x429292
mov al, byte [eax + esi + 0x1634]
cmp al, 0xdc
jne 0x42913d
mov byte [edi], 0xc0
jmp 0x429279
cmp al, 0xdd
jne 0x429279
mov byte [edi], 0xdb
jmp 0x429279
mov al, byte [esi + 0x2126]
test al, al
jne 0x42916b
dec ebp
mov byte [esi + 0x2126], 1
mov word [esi + 0x212b], bp
jmp 0x429279
cmp bp, dx
mov byte [esi + 0x2126], 0
mov dword [esi + 0x2127], edx
jne 0x429192
mov byte [esi + 0x2126], 0
mov word [esi + 0x212b], 0xffff
jmp 0x429292
mov eax, dword [esi + 0x1618]
sub eax, edx
je 0x429249
dec eax
je 0x429203
dec eax
jne 0x42926a
lea edi, [esi + 0x160]
push ebx
push edi
call fcn.00425090
add esp, 8
test ax, ax
jne 0x4291f6
lea eax, [ebp - 2]
movsx ecx, ax
mov word [esi + 0x212b], ax
mov byte [ecx + esi + 0x160], 0
mov cl, byte [edi]
mov eax, dword [esi + 0x1500]
mov edx, dword [esi]
add cl, 0x80
mov byte [edi], cl
movsx ecx, word [esi + 0x212b]
push 0
push eax
push ecx
push edi
mov ecx, esi
call dword [edx + 0x10]
jmp 0x42926a
push str.SMACK_ERROR
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x42926a
lea edx, [ebx - 1]
push edx
lea ebp, [esi + 0x160]
push ebp
call fcn.00425070
mov cl, byte [ebx + esi + 0x15f]
add esp, 8
cmp al, cl
jne 0x42926a
mov byte [edi], 0
dec word [esi + 0x212b]
mov ax, word [esi + 0x212b]
mov ecx, dword [esi + 0x1500]
mov edx, dword [esi]
push 0
push ecx
movsx eax, ax
push eax
push ebp
mov ecx, esi
call dword [edx + 0x10]
jmp 0x42926a
push edx
mov byte [edi], 0
mov ecx, dword [esi + 0x1500]
movsx edx, word [esi + 0x212b]
mov eax, dword [esi]
push ecx
push edx
lea ecx, [esi + 0x160]
push ecx
mov ecx, esi
call dword [eax + 0x10]
mov ecx, dword [esp + 0x14]
mov word [esi + 0x212b], 0xffff
xor edx, edx
inc word [esi + 0x212b]
cmp word [esi + 0x212b], 0xaef
jle 0x429292
mov word [esi + 0x212b], dx
mov edi, dword [esi + 0x1630]
inc edi
mov eax, edi
cmp eax, ecx
mov dword [esi + 0x1630], edi
jb 0x429070
pop edi
pop ebp
pop ebx
pop esi
ret 4
Function at 0x429ef0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
mov esi, ecx
mov eax, dword [esi + 0x10]
push 0x1009
push eax
call edi
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
push 0
lea ecx, [esp + 0x14]
push 0x460c20
push ecx
mov dword [esi + 0x74], 0
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0xc
push 0x4668f8
push 0x104
push 0x468028
push 0x460c28
lea edx, [esp + 0x20]
push edx
push 0x460c2c
call ebx
cmp byte [0x468028], 0x30
je 0x429fd8
jmp 0x429f60
push 0x468000
mov dword [0x468000], 5
mov dword [0x468014], 0x468028
mov eax, dword [esi + 0x74]
push 0
mov dword [0x468020], eax
mov dword [0x468008], 0
mov ecx, dword [esi + 0x10]
push 0x1007
push ecx
call edi
mov edx, dword [esi + 0x74]
inc edx
push edx
lea eax, [esp + 0x14]
push 0x460c20
push eax
mov dword [esi + 0x74], edx
call ebp
add esp, 0xc
push 0x4668f8
push 0x104
push 0x468028
push 0x460c28
lea ecx, [esp + 0x20]
push ecx
push 0x460c2c
call ebx
cmp byte [0x468028], 0x30
jne 0x429f60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x42f820
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 4]
cmp eax, 0x74
jb 0x42f84c
cmp eax, 0x75
jbe 0x42f839
cmp eax, 0x79
jne 0x42f84c
cmp dword [ecx + 8], 1
jne 0x42f84c
mov ecx, esi
call fcn.0042eca0
mov al, 1
pop esi
ret 0xc
cmp dword [ecx + 8], 0xffffff36
jne 0x42f8a3
push 0x4614a0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x466c98]
test eax, eax
mov ecx, esi
jne 0x42f889
call fcn.0042c180
test al, al
jne 0x42f88e
mov eax, dword [esp + 8]
push 2
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov al, 1
pop esi
ret 0xc
call fcn.0042c180
mov ecx, dword [esp + 8]
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov al, 1
pop esi
ret 0xc
xor al, al
pop esi
ret 0xc
Function at 0x4306d0
Capabilities:
Create tcp socket
Create udp socket
Print debug messages
Read .ini file
Resume thread

Disassembly:
sub esp, 0x10
push ebp
push esi
push edi
mov esi, ecx
call fcn.00412b10
lea eax, [esi + 0x14]
push eax
mov dword [esi], 0x447570
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [esp + 0x24]
push 0x4668f8
push 0x1f40
push 0x463230
push 0x463238
mov dword [esi + 0x44], ecx
mov dword [esi + 0x10], 0
mov dword [esi + 0x38], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [esp + 0x20]
push 6
push 1
push 2
mov edi, eax
mov dword [esi + 0x2c], edx
call dword [sym.imp.WS2_32.dll_socket]
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esi + 0x30], eax
jne 0x430745
push str.ERROR_CREATE_SOCKET
call ebp
push edi
mov word [esp + 0x10], 2
mov dword [esp + 0x14], 0
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esi + 0x30]
mov word [esp + 0xe], ax
push 0x10
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x43077c
push str.bind_error
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0
call edi
test eax, eax
mov dword [esi + 0x34], eax
jne 0x43079a
push 0x46326c
call ebp
mov edx, dword [esi + 0x34]
mov eax, dword [esi + 0x30]
push 8
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
test eax, eax
je 0x4307b5
push 0x46327c
call ebp
push 0
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0x3c], eax
call edi
mov ecx, dword [esi + 0x30]
push 0x3e8
push ecx
mov dword [esi + 0x40], eax
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x4307e9
push str.listen_sOCKET_error
call ebp
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x10
ret 8

Function at 0x430c20
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 0xffffffffffffffff
push 0x445976
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00412b10
xor ebx, ebx
lea ecx, [esi + 0xc18]
mov dword [esp + 0x14], ebx
mov dword [esi], 0x447580
call fcn.00424950
mov eax, dword [esp + 0x20]
push 1
push ebx
push ebx
push 6
push 1
push 2
mov byte [esp + 0x2c], 1
mov dword [esi + 0x1a2e], eax
call dword [sym.imp.WS2_32.dll_WSASocketA]
cmp eax, 0xffffffff
mov dword [esi + 0xc3c], eax
jne 0x430c91
push 0x4634d0
call fcn.00436550
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0xc10], ecx
mov byte [esi + 0x55], bl
mov byte [esi + 0x57], 1
mov byte [esi + 0x56], bl
mov byte [esi + 0x10], bl
mov dword [esi + 0x1a01], ebx
mov eax, dword [0x46825c]
inc eax
push eax
push str.Socket_interface_allocated:_d
mov dword [0x46825c], eax
call fcn.00436550
mov ecx, dword [esp + 0x14]
add esp, 8
mov dword [esi + 0x17f9], ebx
mov dword [esi + 0x17fd], ebx
mov byte [esi + 0x1a05], bl
mov dword [esi + 0x1a32], ebx
mov dword [esi + 0x1a36], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x430ed0
Capabilities:
Print debug messages
Send data
Send data on socket

Disassembly:
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x1a32]
test eax, eax
je 0x430eee
push str.SOCKWIN::NOSEND
call fcn.00436550
add esp, 4
pop edi
pop ecx
ret
push ebx
push ebp
lea ebp, [edi + 0xc18]
push esi
mov ecx, ebp
call fcn.00424820
test al, al
je 0x431074
jmp 0x430f10
mov ecx, ebp
mov dword [esp + 0x10], 0
call fcn.00424810
mov esi, eax
test esi, esi
jne 0x430f30
push str.DOSEND::NOOUTREQ
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edx, dword [esi + 0xc]
push 0
push edx
mov edx, dword [edi + 0xc3c]
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea ecx, [esi + 4]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp ebx, 0xffffffff
jne 0x430fb4
cmp eax, 0x3e5
jne 0x431002
mov eax, dword [edi + 0x1a01]
inc eax
cmp eax, 0x32
jl 0x430f8b
mov dword [edi + 0x1a32], 1
mov dword [edi + 0x1a01], eax
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx + 0x10]
mov dword [edi + eax*4 + 0x17fd], edx
mov eax, dword [edi + 0x1a01]
mov ecx, ebp
mov dword [edi + eax*4 + 0x18fd], esi
call fcn.00424850
jmp 0x430fed
mov ecx, ebp
call fcn.00424850
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov eax, dword [esi + 8]
push eax
call fcn.0043904c
mov ecx, dword [esi + 0xc]
push ecx
call fcn.0043904c
push esi
call fcn.0043904c
add esp, 0xc
mov dword [edi + 0x1a32], 0
mov ecx, ebp
call fcn.00424820
test al, al
jne 0x430f10
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
cmp eax, 0x2733
je 0x43102e
push eax
push str.DOSEND_ERROR_DELETE_THE_SOCKWIN_ERROR_x
call fcn.00436550
add esp, 8
mov ecx, edi
call fcn.00430d60
pop esi
pop ebp
pop ebx
mov dword [edi + 0x1a32], 1
pop edi
pop ecx
ret
mov edx, dword [0x46825c]
push edx
push str.DOSEND:MOULDBLOCK_sockif_d
call fcn.00436550
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0x10]
add esp, 8
push ecx
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov edx, dword [esi + 8]
push edx
call fcn.0043904c
mov eax, dword [esi + 0xc]
push eax
call fcn.0043904c
push esi
call fcn.0043904c
add esp, 0xc
mov dword [edi + 0x1a32], 1
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret