joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4252f0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 8], eax
cmp edx, ecx
ja 0x425328
jb 0x42531e
cmp eax, ebx
jae 0x425328
mov eax, ebx
mov edx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 0x18]
push 0
push eax
push edx
push ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
jne 0x42534e
call fcn.0041e520
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [ebp + 0x10]
test ebx, ebx
jne 0x42535f
mov ecx, dword [ebp - 8]
sub ecx, edx
mov dword [esi + 4], ecx
jmp 0x425362
mov dword [esi + 4], ebx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x10], edx
mov edx, dword [ebp + 0x14]
push 0
mov dword [esi + 0x14], edx
mov edx, dword [esi + 4]
push edx
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push ecx
push eax
mov dword [esi + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [esi], eax
test eax, eax
jne 0x4253b0
call fcn.0041e520
mov edi, eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
mov dword [esi + 8], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x425550
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x24]
mov word [ebp - 0x24], ax
mov eax, dword [ebp + 8]
push edx
push eax
mov dword [ebp - 8], 0x1c
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x42557f
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.00425430
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x4255a0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
push 0
push 0x80
push 3
push 0
push 1
push Ordinal_1
test ecx, ecx
je 0x4255ce
mov eax, dword [ebp + 8]
push eax
call fcn.004251c0
jmp 0x4255d8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x42563d
call fcn.0041e520
test eax, eax
js 0x425650
mov eax, dword [edi]
lea edx, [ebp - 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x425607
call fcn.0041e520
test eax, eax
js 0x425650
mov eax, dword [ebp - 8]
push esi
mov esi, dword [ebp - 4]
test esi, esi
jne 0x425613
test eax, eax
je 0x425641
mov edx, dword [ebp + 0x14]
xor ecx, ecx
cmp esi, ecx
ja 0x425641
jb 0x425622
cmp eax, edx
ja 0x425641
mov eax, dword [edi]
mov ecx, dword [ebp + 0x10]
push 4
push 2
push 0
push 0
push 0
push eax
call fcn.004252f0
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov dword [edi], eax
jmp 0x4255e6
or eax, esi
mov eax, 0x800703ee
je 0x42564f
mov eax, 0x800700df
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x425750
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x88]
push esi
xor esi, esi
push esi
push eax
push esi
lea ecx, [ebp - 4]
push ecx
mov dword [eax + 0x34], edx
mov dword [eax + 0x18], 3
push 1
lea edx, [eax + 0x1c]
mov dword [ebp - 4], esi
mov dword [eax + 0x28], 2
mov eax, dword [eax + 0x34]
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x42579e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4257b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x88]
push esi
xor esi, esi
push esi
push eax
mov dword [eax + 0x34], edx
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
mov edx, dword [eax + 0x34]
push 1
lea ecx, [eax + 0x1c]
push ecx
push edx
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [eax + 0x18], 4
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x4257fc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x3e5
jne 0x42580b
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4259e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x88]
push esi
xor esi, esi
push esi
push eax
push esi
lea ecx, [ebp - 4]
push ecx
mov dword [eax + 0x34], edx
mov dword [eax + 0x18], 3
push 1
lea edx, [eax + 0x1c]
mov dword [ebp - 4], esi
mov dword [eax + 0x28], 2
mov eax, dword [eax + 0x34]
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x425a2b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x3e5
jne 0x425a3a
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x425a50
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x5ca120]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, dword [ebp + 0x10]
mov dword [esi + 2], eax
mov dword [esi + 6], eax
mov dword [esi + 0xa], eax
mov dword [esi + 0xe], eax
mov dword [esi + 0x12], eax
push edi
mov dword [esi + 0x16], eax
mov dword [ebp - 0xa8], eax
mov word [esi + 0x1a], ax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
movzx eax, word [esi]
push 3
lea edx, [ebp - 0x84]
push ecx
lea ecx, [ebp - 0x88]
mov dword [ebp - 0xac], pe_nt_image_headers32
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x88], edx
call fcn.00425820
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0xac]
push ecx
push 0
push edx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, eax
mov eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x84]
cmp eax, ecx
je 0x425b19
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
test edi, edi
je 0x425b36
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005448c8
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp - 0x8c]
xor edi, edi
mov eax, ebx
test ebx, ebx
je 0x425b71
mov ecx, dword [eax + 4]
cmp ecx, 2
je 0x425b5b
cmp ecx, 0x17
je 0x425b5b
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x425b45
jmp 0x425b71
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x18]
push edx
push eax
push esi
call sub.MSVCR100.dll_memcpy
add esp, 0xc
mov edi, 1
push ebx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
pop ebx
test edi, edi
je 0x425b9d
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 2], ax
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005448c8
mov esp, ebp
pop ebp
ret
push 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.005448c8
mov esp, ebp
pop ebp
ret
Function at 0x425d80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov al, byte [edx]
push esi
push edi
mov edi, ecx
mov esi, 0x811c9dc5
test al, al
je 0x425db3
lea ecx, [eax - 0x41]
inc edx
cmp cl, 0x19
ja 0x425da2
add al, 0x20
imul esi, esi, 0x1000193
movsx eax, al
xor esi, eax
mov al, byte [edx]
test al, al
jne 0x425d97
mov edx, dword [edi + 0x20]
mov eax, edx
and eax, esi
cmp dword [edi + 0x24], eax
pop edi
pop esi
ja 0x425dca
shr edx, 1
or ecx, 0xffffffff
sub ecx, edx
add eax, ecx
pop ebp
ret 4

Function at 0x428660
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
cmp esi, dword [eax]
jne 0x42868f
cmp ecx, eax
jne 0x42868f
mov ecx, ebx
call fcn.00428330
mov eax, dword [ebx + 4]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 0xc
cmp esi, ecx
je 0x42874b
push edi
mov edx, dword [esi]
mov dword [ebp + 0xc], edx
mov edx, dword [esi + 8]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4286a5
sub eax, edi
add eax, edx
mov edi, 0x811c9dc5
cmp edx, eax
je 0x4286d0
lea esp, [esp]
movsx ecx, byte [edx]
imul edi, edi, 0x1000193
inc edx
xor edi, ecx
cmp edx, eax
jne 0x4286c0
mov ecx, dword [ebx + 0x20]
mov eax, ecx
and eax, edi
cmp dword [ebx + 0x24], eax
ja 0x4286e5
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [ebx + 0x10]
cmp dword [ecx + eax*8 + 4], esi
lea ecx, [ecx + eax*8]
jne 0x42870e
cmp dword [ecx], esi
jne 0x428706
mov edx, dword [ebx + 4]
mov dword [ecx], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 0x10]
mov dword [edx + eax*8 + 4], ecx
jmp 0x428716
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x428716
cmp dword [ecx], esi
jne 0x428716
mov edx, dword [esi]
mov dword [ecx], edx
cmp esi, dword [ebx + 4]
je 0x42873e
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [esi + 4]
lea ecx, [esi + 8]
mov dword [edx + 4], eax
call fcn.0041fab0
push esi
call sub.mfc100u.dll_delete
add esp, 4
dec dword [ebx + 8]
mov esi, dword [ebp + 0xc]
cmp esi, dword [ebp + 0x10]
jne 0x428698
pop edi
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x42a5e0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [edx - 2]
cmp ecx, 0xa
ja case.default.0x42a5ec
jmp dword [ecx*4 + 0x42a748]
cmp al, 0x40
jne 0x42a5fd
mov eax, 4
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x42a60c
cmp cl, 0x7a
jbe 0x42a65c
cmp al, 0x30
jl 0x42a614
cmp al, 0x39
jle 0x42a65c
cmp al, 0x2d
je 0x42a65c
cmp al, 0x5f
je 0x42a65c
cmp al, 0x2e
je 0x42a65c
cmp al, 0x21
je 0x42a65c
cmp al, 0x7e
je 0x42a65c
cmp al, 0x2a
je 0x42a65c
cmp al, 0x27
je 0x42a65c
cmp al, 0x28
je 0x42a65c
cmp al, 0x29
je 0x42a65c
cmp al, 0x25
je 0x42a65c
cmp al, 0x3b
je 0x42a65c
cmp al, 0x3a
je 0x42a65c
cmp al, 0x26
je 0x42a65c
cmp al, 0x3d
je 0x42a65c
cmp al, 0x2b
je 0x42a65c
cmp al, 0x24
je 0x42a65c
cmp al, 0x2c
jne case.default.0x42a5ec
mov eax, 3
ret
cmp al, 0x5b
jne 0x42a66c
mov eax, 5
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x42a67b
cmp cl, 0x7a
jbe 0x42a68f
cmp al, 0x30
jl 0x42a683
cmp al, 0x39
jle 0x42a68f
cmp al, 0x2e
je 0x42a68f
cmp al, 0x2d
jne case.default.0x42a5ec
mov eax, 6
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x42a6a4
cmp cl, 0x7a
jbe 0x42a68f
cmp al, 0x30
jl 0x42a6ac
cmp al, 0x39
jle 0x42a68f
cmp al, 0x2e
je 0x42a68f
cmp al, 0x2d
je 0x42a68f
cmp al, 0x3a
jne case.default.0x42a5ec
mov eax, 0xb
ret
cmp al, 0x5d
jne case.0x42a5ec.5
mov eax, 8
ret
cmp al, 0x30
jl 0x42a6d4
cmp al, 0x39
jle 0x42a6fa
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x42a6e3
cmp cl, 0x66
jbe 0x42a6fa
cmp al, 0x3a
je 0x42a6fa
cmp al, 0x2e
je 0x42a6fa
cmp edx, 7
jne case.default.0x42a5ec
cmp al, 0x25
jne case.default.0x42a5ec
mov eax, 9
ret
mov eax, 7
ret
cmp al, 0x5d
je 0x42a6c6
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x42a713
cmp cl, 0x7a
jbe 0x42a72f
cmp al, 0x30
jl 0x42a71b
cmp al, 0x39
jle 0x42a72f
cmp al, 0x25
je 0x42a72f
cmp al, 0x2e
je 0x42a72f
cmp al, 0x2d
je 0x42a72f
cmp al, 0x5f
je 0x42a72f
cmp al, 0x7e
jne case.default.0x42a5ec
mov eax, 0xa
ret
sub al, 0x30
cmp al, 9
mov eax, 0xc
jbe 0x42a745
mov eax, 1
ret
Function at 0x42e200
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp dword [ebp + 0xc], ebx
je 0x42e26f
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
push 0x30
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x42e2e5
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x1c]
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x42e264
cmp eax, 0xffffffff
jne 0x42e25c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x42e264
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x42e2e5
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x42e2e5
mov dword [esi + 0x4c], 1
push 0
mov dword [esi + 0x50], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov edx, dword [eax + 0xb0]
mov ecx, esi
call edx
cmp eax, 2
jne 0x42e264
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42e2de
mov eax, 0x4c7
push eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8

Function at 0x42e520
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x18c]
push edi
test eax, eax
jne 0x42e5dc
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
lea esp, [esp]
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x5c]
mov edx, dword [esi + 0x1c]
push 0
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jle 0x42e5af
push 0
call ebx
mov eax, dword [esi + 0x5c]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0xc0]
mov ecx, esi
call eax
cmp eax, 2
jne 0x42e5b8
mov edx, dword [esi + 0x24]
push edx
push str._C_CNNID:__Iu__OnReceive___event_return_HR_ERROR__connection_will_be_closed___n
call fcn.0041ed30
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42e594
mov eax, 0x4c7
mov dword [esi + 0x10], 4
mov dword [esi + 0x14], eax
mov ecx, 1
mov dword [esi + 0x18], ecx
pop edi
mov dword [esi + 0xc], ecx
pop esi
xor eax, eax
pop ebx
ret
cmp edi, 0xffffffff
je 0x42e5cf
test edi, edi
je 0x42e5e5
mov ecx, dword [esi + 0x18c]
test ecx, ecx
je 0x42e540
pop edi
pop esi
mov eax, 1
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x42e594
pop edi
pop esi
mov eax, 1
pop ebx
ret
mov dword [esi + 0x10], 5
mov dword [esi + 0x14], 0
mov ecx, 1
mov dword [esi + 0x18], ecx
pop edi
mov dword [esi + 0xc], ecx
pop esi
xor eax, eax
pop ebx
ret
Function at 0x42e610
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x18]
push esi
mov esi, ecx
mov ecx, dword [ebx + 0x14]
sub eax, ecx
push edi
je 0x42e6b6
lea esp, [esp]
mov edx, dword [esi + 0x2c]
cmp eax, edx
jl 0x42e639
mov eax, edx
push 0
push eax
mov eax, dword [esi + 0x1c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jle 0x42e6a3
lea ebx, [esi + 0x154]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [esi + 0x188], edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x14]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0xb8]
mov ecx, esi
call eax
cmp eax, 2
jne 0x42e699
mov ecx, dword [esi + 0x24]
push ecx
push str._C_CNNID:__Iu__OnSend___event_should_not_return_HR_ERROR____n
call fcn.0041ed30
add esp, 8
push edi
mov ecx, ebx
call fcn.0042d5c0
jmp 0x42e6a8
cmp edi, 0xffffffff
je 0x42e6c2
mov ecx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x18]
sub eax, ecx
jne 0x42e630
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x42e6e4
mov edx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [edx], 1
mov eax, 1
pop ebx
pop ebp
ret 8
mov ecx, 1
pop edi
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 3
mov dword [esi + 0x18], ecx
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8

Function at 0x42f530
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x44]
push eax
push 0
push esi
push 0x42f330
push 0
push 0
call dword [sym.imp.MSVCR100.dll__beginthreadex]
xor ecx, ecx
add esp, 0x18
test eax, eax
setne cl
mov dword [esi + 0x40], eax
pop esi
mov eax, ecx
ret
Function at 0x433c20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x14], 0
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0
jbe 0x433d6f
push esi
push edi
push 0
push 0
push ebx
push 0x433af0
push 0
push 0
call dword [sym.imp.MSVCR100.dll__beginthreadex]
mov edi, eax
add esp, 0x18
mov dword [ebp - 4], edi
test edi, edi
je 0x433d52
mov eax, dword [ebx + 0x70]
lea esi, [ebx + 0x6c]
lea ecx, [ebp - 4]
cmp ecx, eax
jae 0x433cdb
mov edx, dword [esi]
cmp edx, ecx
ja 0x433cdb
mov edi, ecx
mov ecx, dword [esi + 8]
sub edi, edx
sar edi, 2
cmp eax, ecx
jne 0x433ccb
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x433d47
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x433ccb
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x433cb8
xor ecx, ecx
jmp 0x433cba
add ecx, edx
cmp ecx, eax
jae 0x433cc0
mov ecx, eax
push ecx
mov ecx, esi
call fcn.00437930
mov ebx, dword [ebp - 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x433d29
mov edx, dword [esi]
mov ecx, dword [edx + edi*4]
mov dword [eax], ecx
jmp 0x433d29
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x433d20
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x433d47
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x433d20
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x433d0d
xor ecx, ecx
jmp 0x433d0f
add ecx, edx
cmp ecx, eax
jae 0x433d15
mov ecx, eax
push ecx
mov ecx, esi
call fcn.00437930
mov ebx, dword [ebp - 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x433d29
mov dword [eax], edi
mov eax, dword [ebp - 0xc]
add dword [esi + 4], 4
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebx + 0x14]
jb 0x433c46
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.vector_T__too_long
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [ebx + 0x68], 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov dword [ebp - 0x10], 0
pop esi
mov eax, dword [ebp - 0x10]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434e70
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
push edi
xor edi, edi
cmp eax, edi
je 0x434ea4
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x434ea4
xor eax, eax
cmp dword [ebp - 4], 0x103
sete al
cmp eax, edi
jne 0x434f92
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x434ecc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
push 0x18
call sub.mfc100u.dll_new
add esp, 4
cmp eax, edi
je 0x434ef3
mov edx, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov edi, eax
mov edx, dword [edi]
mov dword [esi + 0x10], edx
mov eax, dword [edi + 4]
mov dword [esi + 0x14], eax
mov ecx, dword [edi + 8]
mov dword [esi + 0x18], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x1c], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x20], eax
mov ecx, dword [edi + 0x14]
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x18]
lea edx, [esi + 8]
mov dword [esi + 0x24], ecx
mov ecx, dword [ebp + 0x20]
push edx
test ebx, ebx
jne 0x434f3f
push ebx
push edi
push 0x4343d0
push eax
push ecx
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0xc], eax
jmp 0x434f6b
push 4
push edi
push 0x4343d0
push eax
push ecx
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
je 0x434f6b
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [esi + 0xc], 0
pop ebx
jne 0x434fa7
push 0x65f
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
xor esi, esi
call sub.mfc100u.dll_delete
add esp, 4
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
push 0x139f
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x1c
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4359c0
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54a602
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5ca120]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 4], eax
lea eax, [ebp + 0xb]
mov dword [esi + 0x10], edx
push eax
lea edx, [ebp + 0xa]
xor edi, edi
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x38]
push edx
mov dword [esi], edi
mov dword [esi + 8], edi
call fcn.0041f500
lea eax, [ebp + 0xb]
push eax
lea edx, [ebp + 0xa]
lea ecx, [esi + 0x64]
push edx
mov dword [ebp - 4], edi
call fcn.0041f500
mov eax, dword [0x5ca148]
mov edx, dword [eax + 0xc]
mov ecx, 0x5ca148
mov byte [ebp - 4], 1
call edx
add eax, 0x10
mov dword [esi + 0x90], eax
mov eax, dword [0x5ca148]
mov edx, dword [eax + 0xc]
mov ecx, 0x5ca148
mov byte [ebp - 4], 2
call edx
add eax, 0x10
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0xffff0001
add ecx, 0xffff
mov byte [ebp - 4], 3
mov word [esi + 0x98], cx
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
cmp eax, edi
je 0x435ac8
push 0x20
call sub.mfc100u.dll_new__
add esp, 4
cmp eax, edi
je 0x435aef
push fcn.0041e6b0
push 0x41e810
push 7
lea ebx, [eax + 4]
push 4
push ebx
mov dword [eax], 7
call fcn.00544b9b
jmp 0x435af1
push 4
call sub.mfc100u.dll_new
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x435aef
mov edx, dword [0x5ca148]
mov eax, dword [edx + 0xc]
mov ecx, 0x5ca148
call eax
add eax, 0x10
mov dword [ebx], eax
jmp 0x435af1
xor ebx, ebx
xor ecx, ecx
cmp dword [esi + 4], edi
lea edx, [esi + 0x18]
sete cl
mov dword [esi + 0x9c], ebx
push ecx
push edx
call fcn.0042a560
add esp, 8
mov dword [esi + 0x30], esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc