joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d520
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ae530
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x2c]
push esi
push edi
push eax
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CBrush::CBrush
mov esi, dword [esp + 0x20]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CDC::SelectObject_2
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edi, eax
mov eax, dword [esp + 0x2c]
push 0xf00021
push edx
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
push edi
mov ecx, esi
call sub.MFC42.DLL_CDC::SelectObject_2
mov dword [esp + 8], vtable.CGdiObject.0
lea ecx, [esp + 8]
mov dword [esp + 0x18], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x40da90
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x7a
xor eax, eax
lea edi, [esi + 0x40]
mov dword [esp + 0xc], 0x94
rep stosd dword es:[edi], eax
mov ecx, 0x24
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
mov dword [esi + 0x228], ebx
mov dword [esi + 0x22c], 1
mov dword [esi + 0x230], 1
mov dword [esi + 0x26c], ebx
mov dword [esi + 0x270], 1
mov dword [esi + 0x234], ebx
mov dword [esi + 0x250], ebx
mov dword [esi + 0x268], ebx
mov dword [esi + 0x23c], ebx
mov dword [esi + 0x274], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x1c], 2
jne 0x40db32
cmp dword [esp + 0x10], 5
jb 0x40db32
mov eax, 1
pop edi
mov dword [esi + 0x238], eax
pop esi
pop ebx
add esp, 0x94
ret
mov dword [esi + 0x238], ebx
pop edi
pop esi
pop ebx
add esp, 0x94
ret
Function at 0x40fb00
Capabilities:
Get memory capacity

Disassembly:
push 0xffffffffffffffff
push 0x4ae7af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push esi
push edi
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString_2
mov eax, 0x20
xor ecx, ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x44], 1
lea edi, [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x34]
shr eax, 0xa
shr ecx, 0xa
push eax
mov eax, dword [esp + 0x34]
shr edx, 0xa
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
shr eax, 0xa
shr ecx, 0xa
push eax
mov eax, dword [esp + 0x2c]
shr edx, 0xa
push ecx
push edx
push eax
lea ecx, [esp + 0x24]
push str.Memory_Used__lu____Total_Physical_Memory__luKB__Physical_Memory_Available__luKB__Total_Virtual_Memory__luKB__Available_Virtual_Memory__luKB__Working_Set_Min_:__luKB_Max_:__luKB_._r_n
push ecx
call sub.MFC42.DLL_CString::Format_1
mov esi, dword [esp + 0x6c]
add esp, 0x24
lea edx, [esp + 8]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0x14], 1
lea ecx, [esp + 8]
mov byte [esp + 0x40], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x38]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x3c
ret 4

Function at 0x40fe70
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40fee6
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40fee6
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
xor ebp, ebp
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x40fee6
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x40fed4
mov edx, esi
cmp edi, ebx
jb 0x40fede
add edx, ebx
cmp edi, edx
jbe 0x40fef0
inc ebp
add eax, 0x28
cmp ebp, ecx
jb 0x40fec6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebp
sub edi, ebx
mov dword [edx], ebp
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret

Function at 0x4106e0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x404
lea eax, [esp + 0x40c]
lea edx, [esp + 4]
push esi
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_vsprintf]
mov edx, dword [0x4e5a88]
add esp, 0xc
mov esi, eax
lea eax, [esp + 4]
push 0
push eax
lea ecx, [esp + 0x10]
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
pop esi
add esp, 0x404
ret
Function at 0x411ee0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x8058]
test eax, eax
je 0x411ef8
pop edi
mov eax, 1
pop esi
ret 8
mov eax, dword [esi + 0x8040]
test eax, eax
je 0x411f0c
pop edi
mov eax, 1
pop esi
ret 8
mov eax, dword [esi + 0x8050]
test eax, eax
jne 0x411f1d
mov ecx, esi
call fcn.00411eb0
mov eax, dword [esi + 0x8050]
test eax, eax
jne 0x411f2c
pop edi
pop esi
ret 8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ProcessCommand
push eax
call edi
mov dword [esi + 0x8060], eax
mov eax, dword [esi + 0x8050]
push str.DecryptMessage
push eax
call edi
mov ecx, dword [esi + 0x8050]
push str.EncryptMessage
push ecx
mov dword [esi + 0x8064], eax
call edi
mov edx, dword [esi + 0x8050]
push str.EncryptData
push edx
mov dword [esi + 0x8068], eax
call edi
mov dword [esi + 0x806c], eax
mov eax, dword [esi + 0x8050]
push str.DecryptData
push eax
call edi
mov ecx, dword [esi + 0x8050]
push str.InitGSS
push ecx
mov dword [esi + 0x8070], eax
call edi
mov edx, dword [esi + 0x8050]
push str.KillGSS
push edx
mov dword [esi + 0x8074], eax
call edi
mov dword [esi + 0x8078], eax
mov eax, dword [esi + 0x8050]
push str.DoClientAuth
push eax
call edi
mov ecx, dword [esi + 0x8050]
push str.ProcessReply
push ecx
mov dword [esi + 0x807c], eax
call edi
mov edx, dword [esi + 0x8050]
push str.GetUserFromKrbTicket
push edx
mov dword [esi + 0x8080], eax
call edi
mov ecx, dword [esi + 0x8060]
mov dword [esi + 0x8084], eax
test ecx, ecx
je 0x412052
mov ecx, dword [esi + 0x8074]
test ecx, ecx
je 0x412052
mov ecx, dword [esi + 0x8078]
test ecx, ecx
je 0x412052
mov ecx, dword [esi + 0x8064]
test ecx, ecx
je 0x412052
mov ecx, dword [esi + 0x8068]
test ecx, ecx
je 0x412052
mov ecx, dword [esi + 0x806c]
test ecx, ecx
je 0x412052
mov ecx, dword [esi + 0x8070]
test ecx, ecx
je 0x412052
mov ecx, dword [esi + 0x807c]
test ecx, ecx
je 0x412052
mov ecx, dword [esi + 0x8080]
test ecx, ecx
je 0x412052
test eax, eax
jne 0x412059
pop edi
xor eax, eax
pop esi
ret 8
mov eax, dword [esp + 0xc]
mov edi, 1
test eax, eax
jne 0x41208e
push 4
call sub.MFC42.DLL_operatornew
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x8054], eax
push ecx
push esi
push 0x4126b0
push eax
call dword [esi + 0x8074]
add esp, 0x14
mov dword [esi + 0x8040], edi
mov dword [esi + 0x8058], edi
mov eax, edi
pop edi
pop esi
ret 8
Function at 0x416180
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, ecx
call fcn.00417750
cmp eax, 0xffffffff
je 0x41619d
push 0x2735
call sub.WS2_32.dll_WSASetLastError
xor eax, eax
pop esi
ret 0x10
mov ecx, esi
call fcn.00416500
test eax, eax
jne 0x4161b8
push 0x276d
call sub.WS2_32.dll_WSASetLastError
xor eax, eax
pop esi
ret 0x10
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x4161ef
mov edx, dword [esp + 0x14]
push edi
mov eax, dword [ecx]
push edx
mov edx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push edx
call dword [eax + 0x28]
mov edi, eax
test edi, edi
je 0x4161e8
push 1
mov ecx, esi
call fcn.004178a0
mov eax, edi
pop edi
pop esi
ret 0x10
mov eax, dword [esp + 0xc]
push 0
push eax
push 2
call sub.WS2_32.dll_socket
cmp eax, 0xffffffff
jne 0x416208
xor eax, eax
pop esi
ret 0x10
push eax
mov ecx, esi
mov dword [esi + 0x14], eax
call fcn.00416340
mov eax, dword [esi + 0x38]
test eax, eax
je 0x41624f
mov edx, dword [esi + 0x18]
mov ecx, dword [esp + 0x10]
add edx, 0x402
mov dword [esi + 0x1c], ecx
push 0x3f
push edx
mov ecx, esi
call fcn.00417760
push eax
mov eax, dword [esi + 0x14]
push eax
call sub.WS2_32.dll_WSAAsyncSelect
test eax, eax
je 0x41626c
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 8]
xor eax, eax
pop esi
ret 0x10
mov eax, dword [esp + 0x10]
mov ecx, esi
push eax
call fcn.00417580
test eax, eax
jne 0x41626c
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 8]
xor eax, eax
pop esi
ret 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push eax
push ecx
mov ecx, esi
call fcn.004162a0
test eax, eax
jne 0x41628e
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 8]
xor eax, eax
pop esi
ret 0x10
push 1
mov ecx, esi
call fcn.004178a0
mov eax, 1
pop esi
ret 0x10

Function at 0x417170
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [ecx + 0x38]
test eax, eax
je 0x417190
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
push ecx
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, eax
call dword [edx + 0x40]
ret 0xc
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push edx
mov edx, dword [esp + 8]
push eax
mov eax, dword [ecx + 0x14]
push edx
push eax
call sub.WS2_32.dll_recv
ret 0xc

Function at 0x4171b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [ecx + 0x38]
test eax, eax
je 0x4171d0
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
push ecx
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, eax
call dword [edx + 0x44]
ret 0xc
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push edx
mov edx, dword [esp + 8]
push eax
mov eax, dword [ecx + 0x14]
push edx
push eax
call sub.WS2_32.dll_send
ret 0xc
Function at 0x4172f0
Capabilities:
Connect socket

Disassembly:
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x38]
test ecx, ecx
je 0x417316
mov edx, dword [esp + 0x10]
mov eax, dword [ecx]
push edx
mov edx, dword [esp + 0x10]
push edx
call dword [eax + 0x20]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov esi, ecx
jmp 0x417333
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov ecx, dword [edi + 0x14]
push edx
push eax
push ecx
call sub.WS2_32.dll_connect
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov esi, edx
test esi, esi
jne 0x417343
call fcn.004176a0
cmp eax, 0x2733
jne 0x41734c
push 2
mov ecx, edi
call fcn.004178a0
mov eax, esi
pop edi
pop esi
ret 8

Function at 0x417ba0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
test eax, eax
je 0x417bb7
push eax
call sub.WS2_32.dll_WSASetLastError
or eax, 0xffffffff
pop esi
ret 0xc
mov ecx, esi
call fcn.00418090
test eax, eax
jne 0x417bd3
push 0x2736
call sub.WS2_32.dll_WSASetLastError
or eax, 0xffffffff
pop esi
ret 0xc
mov ecx, esi
call fcn.00418090
cmp eax, 1
je 0x417c37
mov ecx, esi
call fcn.00418090
cmp eax, 2
je 0x417c37
mov ecx, esi
call fcn.00418090
cmp eax, 3
je 0x417c37
mov ecx, dword [esi + 0x14]
test ecx, ecx
jne 0x417c1f
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push ecx
mov ecx, dword [esi + 4]
push edx
call fcn.00417750
push eax
call sub.WS2_32.dll_send
pop esi
ret 0xc
mov edx, dword [esp + 0x10]
mov eax, dword [ecx]
push edx
mov edx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push edx
call dword [eax + 0x44]
pop esi
ret 0xc
push 0x2749
call sub.WS2_32.dll_WSASetLastError
or eax, 0xffffffff
pop esi
ret 0xc

Function at 0x417c50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
test eax, eax
je 0x417c67
push eax
call sub.WS2_32.dll_WSASetLastError
or eax, 0xffffffff
pop esi
ret 0xc
mov ecx, esi
call fcn.00418090
test eax, eax
jne 0x417c83
push 0x2736
call sub.WS2_32.dll_WSASetLastError
or eax, 0xffffffff
pop esi
ret 0xc
mov ecx, esi
call fcn.00418090
cmp eax, 1
je 0x417ce7
mov ecx, esi
call fcn.00418090
cmp eax, 2
je 0x417ce7
mov ecx, esi
call fcn.00418090
cmp eax, 3
je 0x417ce7
mov ecx, dword [esi + 0x14]
test ecx, ecx
jne 0x417ccf
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push ecx
mov ecx, dword [esi + 4]
push edx
call fcn.00417750
push eax
call sub.WS2_32.dll_recv
pop esi
ret 0xc
mov edx, dword [esp + 0x10]
mov eax, dword [ecx]
push edx
mov edx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push edx
call dword [eax + 0x40]
pop esi
ret 0xc
push 0x2749
call sub.WS2_32.dll_WSASetLastError
or eax, 0xffffffff
pop esi
ret 0xc
Function at 0x417d00
Capabilities:
Connect socket
Resolve dns

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x417d21
mov edx, dword [esp + 0x20]
mov eax, dword [ecx]
push edx
mov edx, dword [esp + 0x20]
push edx
call dword [eax + 0x24]
mov esi, eax
jmp 0x417d9c
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 8], eax
push esi
mov dword [esp + 0x10], eax
mov word [esp + 0xc], 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x417d6e
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x417d64
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [esp + 0xc], eax
jmp 0x417d6e
push 0x2726
call sub.WS2_32.dll_WSASetLastError
mov ecx, dword [esp + 0x20]
push ecx
call sub.WS2_32.dll_htons
mov ecx, dword [edi + 4]
lea edx, [esp + 8]
push 0x10
push edx
mov word [esp + 0x12], ax
call fcn.00417750
push eax
call sub.WS2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov esi, ecx
test esi, esi
jne 0x417dac
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x417db5
push 2
mov ecx, edi
call fcn.004180a0
mov eax, esi
pop edi
pop esi
add esp, 0x10
ret 8

Function at 0x417dc0
Capabilities:
Connect socket

Disassembly:
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x417dde
mov edx, dword [esp + 0x10]
mov eax, dword [ecx]
push edx
mov edx, dword [esp + 0x10]
push edx
call dword [eax + 0x20]
mov esi, eax
jmp 0x417e00
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
mov ecx, dword [edi + 4]
call fcn.00417750
push eax
call sub.WS2_32.dll_connect
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov esi, edx
test esi, esi
jne 0x417e10
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x417e19
push 2
mov ecx, edi
call fcn.004180a0
mov eax, esi
pop edi
pop esi
ret 8
Function at 0x418340
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x41837a
mov edx, dword [esp + 0x18]
mov eax, dword [ecx]
push edx
mov edx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push edx
call dword [eax + 0x28]
mov edi, eax
test edi, edi
je 0x418373
push 1
mov ecx, esi
call fcn.004180a0
mov eax, edi
pop edi
pop esi
ret 0x10
mov eax, dword [esp + 0x10]
push 0
push eax
push 2
call sub.WS2_32.dll_socket
mov ecx, dword [esi + 4]
push eax
mov dword [ecx + 0x14], eax
mov ecx, dword [esi + 4]
call fcn.00416340
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 4]
push edx
call fcn.00417580
test eax, eax
jne 0x4183b0
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 0x38]
test eax, eax
je 0x4183e4
mov edx, dword [ecx + 0x18]
push 0x3f
add edx, 0x402
push edx
call fcn.00417760
push eax
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x14]
push ecx
call sub.WS2_32.dll_WSAAsyncSelect
test eax, eax
je 0x4183e4
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
push eax
push ecx
mov ecx, dword [esi + 4]
call fcn.004162a0
test eax, eax
jne 0x418402
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
call dword [edx + 8]
mov edi, 1
mov ecx, esi
push edi
call fcn.004180a0
mov eax, edi
pop edi
pop esi
ret 0x10

Function at 0x418697
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4aeb08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004178b0
xor ebx, ebx
lea ecx, [esi + 0x3c]
mov dword [esp + 0x14], ebx
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 0xc]
mov dword [esi], vtable.CAsyncSslSocketLayer.0
mov dword [esi + 0x50], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x54], ebx
mov byte [esi + 0x1c], bl
mov dword [esi + 0x24], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x41bfb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4aedf6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x14]
call fcn.00495b00
mov al, byte [esp + 0x20]
xor ebx, ebx
push 0xe8
mov dword [esp + 0x1c], ebx
mov byte [esi + 0x28], al
call sub.MFC42.DLL_operatornew
mov dword [eax], eax
mov dword [eax + 4], eax
add esp, 4
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ebx
lea edi, [esi + 0x38]
push ebx
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.004ac87e
mov dword [edi], vtable.CCriticalSection.0
add edi, 8
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [esp + 0x20]
mov dword [esi], vtable.CCommandQueue.0
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x10], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 4], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x41ca70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4af105
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 0xb0]
mov dword [esp + 0x18], 4
call fcn.00453280
lea edi, [esi + 0x48]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 7
call fcn.00453280
lea ecx, [edi + 8]
mov byte [esp + 0x18], 6
call fcn.00496c60
lea ecx, [edi + 4]
mov byte [esp + 0x18], 5
call sub.MFC42.DLL_CString::CString
mov ecx, edi
mov byte [esp + 0x18], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x2c]
mov byte [esp + 0x18], 2
call fcn.00496c60
lea ecx, [esi + 0x10]
mov byte [esp + 0x18], 1
call fcn.00496c60
lea ecx, [esi + 8]
mov byte [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 4]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x41e040
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4af7a7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov esi, ecx
push ebp
mov dword [esp + 0x14], esi
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString_1
lea ecx, [ebp + 8]
mov byte [esp + 0x1c], 1
push ecx
lea ecx, [esi + 8]
call fcn.00496af0
mov edx, dword [ebp + 0x24]
lea edi, [ebp + 0x30]
mov dword [esi + 0x24], edx
mov eax, dword [ebp + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [ebp + 0x2c]
lea ebx, [esi + 0x30]
mov dword [esi + 0x2c], ecx
push edi
mov ecx, ebx
mov byte [esp + 0x20], 2
mov dword [esp + 0x28], ebx
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [edi + 4]
lea eax, [edi + 8]
push eax
lea ecx, [ebx + 8]
mov byte [esp + 0x20], 3
mov dword [ebx + 4], edx
call sub.MFC42.DLL_CString::CString_1
lea ecx, [edi + 0xc]
mov byte [esp + 0x1c], 4
push ecx
lea ecx, [ebx + 0xc]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [edi + 0x10]
lea eax, [edi + 0x14]
push eax
lea ecx, [ebx + 0x14]
mov byte [esp + 0x20], 5
mov dword [ebx + 0x10], edx
call sub.MFC42.DLL_CString::CString_1
mov ecx, dword [edi + 0x18]
lea eax, [edi + 0x20]
mov dword [ebx + 0x18], ecx
mov edx, dword [edi + 0x1c]
push eax
lea ecx, [ebx + 0x20]
mov byte [esp + 0x20], 6
mov dword [ebx + 0x1c], edx
call sub.MFC42.DLL_CString::CString_1
mov ecx, dword [edi + 0x24]
mov dword [ebx + 0x24], ecx
mov edx, dword [edi + 0x28]
mov dword [ebx + 0x28], edx
mov eax, dword [ebp + 0x5c]
mov dword [esi + 0x5c], eax
mov ecx, dword [ebp + 0x60]
mov dword [esi + 0x60], ecx
mov edx, dword [ebp + 0x64]
mov dword [esi + 0x64], edx
mov eax, esi
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 8]
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4238f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b154a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea edi, [esi + 0x40]
mov dword [esi], vtable.CControlSocket.1.0
mov dword [edi], vtable.CControlSocket.0
push str.CControlSocket__
push 8
push esi
push 0x48
push ecx
mov dword [esp + 0x30], 2
mov ecx, esp
mov dword [esp + 0x24], esp
push str.E:uworkflow8uftp3.68uftp_sourceControlSocket.cpp
call fcn.004ac728
push edi
call fcn.00410bd0
add esp, 0x18
mov ecx, esi
call fcn.00423c10
lea ecx, [esi + 0x78]
mov byte [esp + 0x1c], 1
call fcn.00453280
mov ecx, esi
mov byte [esp + 0x1c], 0
neg ecx
sbb ecx, ecx
and ecx, edi
call fcn.00410a20
mov ecx, esi
mov dword [esp + 0x1c], 0xffffffff
call fcn.00416120
mov ecx, dword [esp + 0x14]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x18
ret

Function at 0x4240a0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b1628
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
push eax
call fcn.00474fd0
add esp, 4
cmp eax, 1
jne 0x4240fd
mov ecx, dword [esp + 0x30]
push ecx
call fcn.00474fd0
add esp, 4
cdq
push 0
push 0x400
push edx
push eax
call fcn.004ad300
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10
cmp eax, 2
jne 0x4241a3
push 1
push 0x4e66d8
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CSingleLock::CSingleLock
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x28]
mov dword [esp + 0x20], 0
xor esi, esi
mov eax, dword [edi + 4]
test eax, eax
je 0x424192
mov edx, dword [edi + 8]
sub edx, eax
sar edx, 2
cmp esi, edx
jae 0x424192
mov ecx, dword [eax + esi*4]
push ebx
call fcn.004a4c90
test al, al
je 0x424155
mov eax, dword [edi + 4]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax + 0x1c]
test ecx, ecx
jne 0x424158
inc esi
jmp 0x424128
mov edi, dword [edi + 4]
mov dword [esp + 0x20], 0xffffffff
mov ecx, dword [edi + esi*4]
mov eax, dword [ecx + 0x1c]
lea ecx, [esp + 0xc]
shl eax, 0xa
cdq
mov esi, eax
mov edi, edx
call sub.MFC42.DLL_CSingleLock::Unlock
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CSingleLock::Unlock
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov eax, 0xd4a51000
mov edx, 0xe8
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10