joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f28a
Capabilities:
Read file on windows

Disassembly:
push 0x24
mov eax, 0x446fb0
call fcn.00431dc6
mov edi, ecx
lea ecx, [edi + 0x38]
push 0x44e920
call fcn.00402e73
mov ecx, dword [edi + 0x68]
mov eax, dword [ecx]
call dword [eax + 0x90]
lea ecx, [ebp - 0x2c]
call fcn.00401c6e
xor ebx, ebx
push 0xffffffffffffffff
push ebx
lea eax, [edi + 8]
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.00401fe4
push str..version
mov eax, esi
push eax
call fcn.00401cb3
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40f2e4
lea eax, [ebp - 0x28]
push 0x44da38
push eax
call fcn.0042d580
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
mov dword [ebp - 0x30], esi
jne 0x40f30d
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.004022b6
xor eax, eax
call fcn.00431e49
ret
push 2
push ebx
push esi
call fcn.0042f54a
push esi
call fcn.0042f767
push ebx
push ebx
push dword [ebp - 0x30]
mov esi, eax
call fcn.0042f54a
add esp, 0x1c
cmp esi, ebx
ja 0x40f33a
push dword [ebp - 0x30]
call fcn.0042d82b
pop ecx
jmp 0x40f2fa
lea eax, [esi + 1]
push eax
call fcn.0042cfe8
mov ebx, eax
test ebx, ebx
pop ecx
push dword [ebp - 0x30]
jne 0x40f356
call fcn.0042d82b
pop ecx
push ebx
jmp 0x40f2fb
push esi
push 1
push ebx
call fcn.0042fa71
add esp, 0x10
cmp eax, esi
je 0x40f38b
push ebx
call fcn.0042f0fb
push dword [ebp - 0x30]
call fcn.0042d82b
pop ecx
xor edi, edi
pop ecx
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.004022b6
mov eax, edi
jmp 0x40f307
push dword [ebp - 0x30]
call fcn.0042d82b
pop ecx
push ebx
lea ecx, [edi + 0x38]
mov byte [ebx + esi], 0
call fcn.00402e73
and dword [edi + 0x58], 0
lea esi, [edi + 0x28]
mov eax, esi
call fcn.0041c186
test eax, eax
je 0x40f3e9
mov eax, esi
call fcn.0041c186
dec eax
mov dword [ebp - 0x30], eax
mov eax, esi
call fcn.0041c186
cmp dword [ebp - 0x30], eax
jb 0x40f3cf
call fcn.0042eebc
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0x30]
lea eax, [eax + ecx*4]
mov ecx, dword [eax]
add ecx, 0x64
lea eax, [edi + 0x38]
call fcn.00410bb3
test al, al
je 0x40f3f0
mov dword [edi + 0x58], 1
push ebx
call fcn.0042f0fb
xor edi, edi
inc edi
jmp 0x40f377

Function at 0x40f3fe
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x446f5a
call fcn.00431dc6
test ebx, ebx
mov edi, ecx
jne 0x40f418
xor eax, eax
call fcn.00431e49
ret
mov ecx, dword [edi + 0x68]
mov eax, dword [ecx]
call dword [eax + 0x90]
lea ecx, [ebp - 0x2c]
call fcn.00401c6e
and dword [ebp - 4], 0
push 0xffffffffffffffff
push 0
lea eax, [edi + 8]
lea esi, [ebp - 0x2c]
call fcn.00401fe4
push str..version
mov eax, esi
push eax
call fcn.00401cb3
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40f457
lea eax, [ebp - 0x28]
push 0x44d7d0
push eax
call fcn.0042d580
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x40f477
push eax
push 1
lea esi, [ebp - 0x2c]
call fcn.004022b6
jmp 0x40f410
push esi
push 1
push ebx
call fcn.0042d420
pop ecx
push eax
push ebx
call fcn.0042d6f2
add esp, 0x10
cmp eax, 1
push esi
je 0x40f4ac
call fcn.0042d82b
pop ecx
xor edi, edi
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.004022b6
mov eax, edi
jmp 0x40f412
call fcn.0042d82b
pop ecx
push ebx
lea ecx, [edi + 0x38]
call fcn.00402e73
xor edi, edi
inc edi
jmp 0x40f499
Function at 0x40f608
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebx + 0x80]
sub esp, 0x10
test eax, eax
push esi
push edi
je 0x40f636
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40f62e
mov eax, ebx
call fcn.0040f728
xor eax, eax
inc eax
jmp 0x40f724
lea edi, [ebx + 0x28]
lea esi, [ebp - 8]
call fcn.0040ecc4
lea esi, [ebp - 0x10]
call fcn.0041c16c
mov eax, dword [ebp - 8]
test eax, eax
je 0x40f655
cmp eax, dword [ebp - 0x10]
je 0x40f65a
call fcn.0042eebc
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
je 0x40f67f
lea esi, [ebp - 8]
call fcn.0041c1cb
mov esi, dword [eax]
cmp dword [esi + 0x9c], 0
jne 0x40f68e
lea esi, [ebp - 8]
call fcn.004109c9
jmp 0x40f649
xor edi, edi
inc edi
and dword [ebx + 0x64], 0
mov dword [ebx + 0x58], edi
jmp 0x40f722
mov ecx, dword [esi + 0x9c]
mov eax, dword [ecx]
call dword [eax + 0x1c]
xor edi, edi
inc edi
cmp eax, edi
je 0x40f6dd
cmp eax, 4
jle 0x40f722
cmp eax, 0xe
jg 0x40f722
cmp dword [esi + 0x24], 8
jb 0x40f6b5
mov esi, dword [esi + 0x10]
jmp 0x40f6b8
add esi, 0x10
push eax
push esi
mov esi, dword [ebx + 0x68]
push str.download_file__s__failed__u_.
push 2
call fcn.00409217
add esp, 0x10
mov ecx, ebx
mov dword [ebx + 0x5c], edi
mov dword [ebx + 0x60], edi
call fcn.0041043e
xor eax, eax
jmp 0x40f724
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
push 0x40f80a
push eax
push eax
mov dword [ebp - 4], eax
mov dword [ebx + 0x84], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x80], eax
cmp dword [esi + 0x24], 8
jb 0x40f70c
mov esi, dword [esi + 0x10]
jmp 0x40f70f
add esi, 0x10
push esi
mov esi, dword [ebx + 0x68]
push str.download_file__s__success.
push 0
call fcn.00409217
add esp, 0xc
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x4104d6
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x78
lea ebp, [esp - 4]
mov eax, dword [0x45b1d4]
xor eax, ebp
mov dword [ebp + 0x78], eax
push 0x10
mov eax, 0x4478f5
call fcn.00431d5d
mov ebx, dword [ebp + 0x88]
test ebx, ebx
mov edi, dword [ebp + 0x84]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], ebx
jne 0x410514
xor eax, eax
jmp 0x4106b5
mov eax, dword [edi + 0x24]
sub eax, 0
je 0x410697
dec eax
je 0x410680
dec eax
je 0x410561
dec eax
je 0x410547
cmp dword [edi + 0x20], 8
jb 0x410538
mov edi, dword [edi + 0xc]
jmp 0x41053b
add edi, 0xc
push edx
push edi
push str.Unknown
jmp 0x4106ac
cmp dword [edi + 0x20], 8
jb 0x410552
mov edi, dword [edi + 0xc]
jmp 0x410555
add edi, 0xc
push edx
push edi
push str.Zip7
jmp 0x4106ac
lea esi, [edi + 8]
cmp dword [esi + 0x18], 8
jb 0x41056f
mov eax, dword [esi + 4]
jmp 0x410572
lea eax, [esi + 4]
push edx
push eax
push str.Package
push ecx
call ebx
mov eax, esi
add esp, 0x10
lea esi, [ebp + 0x1c]
call fcn.00401c8a
and dword [ebp - 4], 0
xor eax, eax
inc eax
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x58]
push str..ex__d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp + 0x58]
push eax
mov eax, esi
push eax
call fcn.00401cb3
mov ecx, dword [edi + 0x68]
mov eax, dword [ecx]
call dword [eax + 0x90]
lea ecx, [ebp]
call fcn.00401c6e
push 0xffffffffffffffff
mov eax, esi
push 0
lea esi, [ebp]
mov byte [ebp - 4], 1
call fcn.00401fe4
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x4105e3
lea eax, [ebp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x410666
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x4105fa
lea eax, [ebp + 0x20]
push dword [ebp - 0x1c]
push eax
push str.Package
push dword [ebp - 0x18]
call ebx
add esp, 0x10
inc dword [ebp - 0x10]
push 0xffffffffffffffff
lea eax, [ebp + 0x1c]
push eax
xor ebx, ebx
lea eax, [edi + 8]
call fcn.00402089
push dword [ebp - 0x10]
lea eax, [ebp + 0x38]
push str..ex__d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.00401cb3
mov ecx, dword [edi + 0x68]
mov eax, dword [ecx]
call dword [eax + 0x90]
lea esi, [ebp]
call fcn.0040210f
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x1c]
call fcn.00401fe4
mov ebx, dword [ebp - 0x14]
jmp 0x4105d7
push 0
push 1
lea esi, [ebp]
call fcn.004022b6
push 0
push 1
lea esi, [ebp + 0x1c]
call fcn.004022b6
jmp 0x4106b2
cmp dword [edi + 0x20], 8
jb 0x41068b
mov edi, dword [edi + 0xc]
jmp 0x41068e
add edi, 0xc
push edx
push edi
push 0x45375c
jmp 0x4106ac
cmp dword [edi + 0x20], 8
jb 0x4106a2
mov edi, dword [edi + 0xc]
jmp 0x4106a5
add edi, 0xc
push edx
push edi
push str.Single
push ecx
call ebx
add esp, 0x10
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x78]
xor ecx, ebp
call fcn.0042d4ab
add ebp, 0x7c
leave
ret 8
Function at 0x4107c1
Capabilities:
Hash data using jshash

Disassembly:
push 0x22c
mov eax, 0x4478bd
call fcn.00431dc6
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x230]
mov dword [ebp - 0x238], ecx
call fcn.00401c8a
mov eax, esi
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.004108dc
cmp dword [ebp - 0x218], 8
mov eax, dword [ebp - 0x22c]
jae 0x410806
lea eax, [ebp - 0x22c]
cmp eax, edi
mov dword [ebp - 0x234], edi
je 0x41083d
jmp 0x41082b
mov edx, dword [ebp - 0x234]
imul edx, edx, 0x1003f
movzx ecx, cx
add edx, ecx
inc eax
mov dword [ebp - 0x234], edx
inc eax
movzx ecx, word [eax]
cmp cx, di
jne 0x410812
and dword [ebp - 0x234], 0x7fffffff
cmp dword [ebp - 0x218], 8
mov ecx, dword [ebp - 0x22c]
jae 0x410852
lea ecx, [ebp - 0x22c]
xor edx, edx
cmp ecx, edi
je 0x410882
mov edx, 0x4e67c6a7
jmp 0x410874
mov esi, edx
shl esi, 5
mov ebx, edx
shr ebx, 2
add esi, ebx
movzx eax, ax
add esi, eax
xor edx, esi
inc ecx
inc ecx
movzx eax, word [ecx]
cmp ax, di
jne 0x41085f
and edx, 0x7fffffff
cmp dword [ebp + 0xc], edi
mov eax, 0x44d8a0
jne 0x410891
mov eax, str..jld
push eax
push edx
push dword [ebp - 0x234]
lea eax, [ebp - 0x214]
push str._02lX_02lX_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [ebp - 0x238]
add esp, 0x14
lea eax, [ebp - 0x214]
mov word [ebp - 0x16], di
call fcn.0040210f
push edi
push 1
lea esi, [ebp - 0x230]
call fcn.004022b6
xor eax, eax
inc eax
call fcn.00431e49
ret 8
Function at 0x4116e1
Capabilities:
Hash data with md5

Disassembly:
and dword [eax], 0
and dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x4118cd
Capabilities:
Check if file exists
Create directory
Delete file
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x1f90]
mov eax, 0x2010
call fcn.0043f800
mov eax, dword [0x45b1d4]
xor eax, ebp
mov dword [ebp + 0x1f8c], eax
mov eax, dword [ebp + 0x1f98]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], eax
jne 0x411909
xor eax, eax
jmp 0x411a3d
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push esi
call edi
test eax, eax
je 0x411a54
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
je 0x411a54
cmp dword [ebp - 0x7c], ebx
je 0x411a3a
push 0x5c
push esi
call fcn.0042d23b
cmp eax, ebx
pop ecx
pop ecx
push 0x2f
mov dword [ebp - 0x78], eax
push esi
je 0x411957
call fcn.0042d23b
cmp eax, ebx
pop ecx
pop ecx
je 0x411961
jmp 0x41195e
call fcn.0042d23b
pop ecx
pop ecx
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], ebx
je 0x411a3a
push dword [ebp - 0x7c]
add dword [ebp - 0x78], 2
push str._sdelete_
mov edi, 0x800
lea eax, [ebp + 0xf8c]
push edi
push eax
call fcn.0042d92a
add esp, 0x10
cmp word [ebp + 0xf8c], bx
mov word [ebp + 0x1f8a], bx
je 0x4119d9
lea esi, [ebp + 0xf8c]
movzx eax, word [esi]
cmp ax, 0x2f
je 0x4119b0
cmp ax, 0x5c
jne 0x4119c8
and word [esi], 0
push 0
lea eax, [ebp + 0xf8c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov word [esi], 0x5c
inc ebx
lea esi, [ebp + ebx*2 + 0xf8c]
cmp word [esi], 0
jne 0x4119a1
mov esi, dword [ebp - 0x80]
xor ebx, ebx
test ebx, ebx
lea eax, [ebp + 0xf8c]
je 0x4119fe
push ebx
push dword [ebp - 0x78]
push eax
push str._s_s_d
lea eax, [ebp - 0x74]
push edi
push eax
call fcn.0042d92a
add esp, 0x18
jmp 0x411a14
push dword [ebp - 0x78]
push eax
push str._s_s
lea eax, [ebp - 0x74]
push edi
push eax
call fcn.0042d92a
add esp, 0x14
and word [ebp + 0xf8a], 0
push 1
lea eax, [ebp - 0x74]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x411a54
inc ebx
cmp ebx, 0x64
jl 0x4119db
xor eax, eax
pop edi
mov ecx, dword [ebp + 0x1f8c]
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d4ab
add ebp, 0x1f90
leave
ret
xor eax, eax
inc eax
jmp 0x411a3c
Function at 0x411a59
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x411a8e
mov dword [ebp - 4], 1
jmp 0x411aeb
push ebx
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 8], edi
je 0x411aaf
mov dword [ebp - 4], 1
jmp 0x411ae4
cmp byte [ebp + 0x10], bl
je 0x411ac0
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [ebp + 0x18], bl
je 0x411ae4
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
je 0x411ae4
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push eax
push eax
push esi
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x411fa2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [esi]
test edi, edi
je 0x411fea
and dword [esi], 0
mov eax, 0x400000
cmp edi, eax
ja 0x411fbb
mov eax, edi
and dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
add dword [ebp + 0xc], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x411fef
test ecx, ecx
je 0x411fea
test edi, edi
ja 0x411fb0
xor eax, eax
pop edi
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x411fec

Function at 0x415672
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor ecx, ecx
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
dec esi
not esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x41567a
mov dword [ecx*4 + 0x460d40], eax
inc ecx
cmp ecx, 0x100
jb 0x415675
mov edx, 0x800
jmp 0x4156c7
mov eax, dword [ecx*4 + 0x460940]
mov esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x460d40]
inc ecx
mov dword [ecx*4 + 0x460d3c], eax
cmp ecx, edx
jb 0x4156a6
mov dword [0x45db34], 0x415f26
call fcn.0041607e
test eax, eax
jne 0x4156e8
mov dword [0x45db34], 0x415fbc
pop esi
ret
Function at 0x41646f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
sub esp, 0xc
xor eax, eax
and edx, 7
cmp ecx, 5
push edi
mov edi, dword [ebp + 8]
jb 0x4165b7
or dword [ebp - 4], 0xffffffff
lea ecx, [edi + ecx - 4]
push ebx
mov dword [ebp - 8], ecx
push esi
lea esi, [eax + edi]
jmp 0x4164a7
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x4164ac
inc esi
cmp esi, dword [ebp - 8]
jb 0x41649e
mov eax, esi
sub eax, edi
cmp esi, dword [ebp - 8]
jae 0x416598
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x41652b
xor edx, edx
mov cl, byte [esi + 4]
test cl, cl
mov dword [ebp - 4], eax
je 0x4164d8
cmp cl, 0xff
jne 0x41655a
xor ebx, ebx
mov bh, cl
movzx ecx, byte [esi + 2]
mov bl, byte [esi + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
mov edi, ebx
sub edi, eax
sub edi, 5
test edx, edx
mov ebx, edi
mov dword [ebp - 0xc], ebx
je 0x41656b
movzx edi, byte [edx + 0x44f870]
push 0x18
shl edi, 3
pop ecx
sub ecx, edi
shr ebx, cl
test bl, bl
je 0x41651b
cmp bl, 0xff
jne 0x416568
push 0x20
pop ecx
sub ecx, edi
xor edi, edi
inc edi
shl edi, cl
dec edi
xor edi, dword [ebp - 0xc]
jmp 0x4164f3
dec ecx
shl edx, cl
and edx, 7
je 0x4164c5
movzx ecx, byte [edx + 0x44f870]
mov ebx, esi
sub ebx, ecx
cmp byte [edx + 0x44f868], 0
mov cl, byte [ebx + 4]
je 0x416557
test cl, cl
je 0x416557
cmp cl, 0xff
jne 0x4164c5
mov dword [ebp - 4], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x416499
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi + 2], cl
mov byte [esi + 1], bl
add eax, 5
jmp 0x416499
mov esi, eax
sub esi, dword [ebp - 4]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
and ecx, edx
mov edx, dword [ebp + 0xc]
pop esi
mov dword [edx], ecx
pop ebx
pop edi
leave
ret

Function at 0x416b6b
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push edi
mov esi, eax
push 8
lea edi, [esi + 0x3c]
push 0
push edi
mov bl, 1
call fcn.0042d8b0
and dword [esi + 0x40], 0
add esp, 0xc
push 8
push edi
push 0x1005
push 0xffff
push dword [esi + 4]
mov dword [edi], 0x1e
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x416bae
xor bl, bl
call fcn.00416d87
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x416bb4
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
xor ebx, ebx
mov dword [esi + 0x1c], ebx
call dword [eax + 0x18]
test al, al
je 0x416cba
mov eax, dword [esi + 0xc]
cmp eax, ebx
push edi
mov edi, dword [ebp + 8]
je 0x416be7
cmp edi, dword [esi + 0x10]
je 0x416be7
push eax
call fcn.0042d26b
pop ecx
mov dword [esi + 0xc], ebx
cmp dword [esi + 0xc], ebx
jne 0x416bf9
push edi
mov dword [esi + 0x10], edi
call fcn.0042dbee
pop ecx
mov dword [esi + 0xc], eax
mov dword [esi + 8], ebx
lea ebx, [esi + 0x78]
mov eax, ebx
call fcn.0041687d
call fcn.0040ad46
mov eax, dword [esi + 0x18]
dec eax
je 0x416c6f
dec eax
jne 0x416c91
cmp byte [esi + 0x29], 1
mov dword [ebp + 8], 0x10
jne 0x416c48
lea ebx, [esi + 0x64]
lea eax, [ebp + 8]
push eax
push ebx
push 0
push edi
push dword [esi + 0xc]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [esi + 0x1c], eax
call fcn.00416d87
cmp dword [esi + 8], 9
je 0x416c24
jmp 0x416c91
lea ebx, [esi + 0x54]
lea eax, [ebp + 8]
push eax
push ebx
push 0
push edi
push dword [esi + 0xc]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [esi + 0x1c], eax
call fcn.00416d87
cmp dword [esi + 8], 9
je 0x416c4b
jmp 0x416c91
push dword [esi + 0x24]
mov eax, dword [esi + 0xc]
add eax, dword [esi + 0x1c]
push edi
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_recv]
mov dword [esi + 0x1c], eax
call fcn.00416d87
cmp dword [esi + 8], 9
je 0x416c6f
lea ebx, [esi + 0x80]
call fcn.0040ad46
call fcn.00416d87
cmp dword [esi + 0x1c], 0xffffffff
pop edi
jne 0x416cba
mov eax, dword [esi + 0xc]
test eax, eax
je 0x416cba
push eax
call fcn.0042d26b
and dword [esi + 0xc], 0
pop ecx
mov eax, dword [esi + 0x1c]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x416cf9
Capabilities:
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push 0
push dword [ebx]
or esi, 0xffffffff
push dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], esi
call fcn.00438a17
add esp, 0xc
cmp eax, esi
jne 0x416d23
mov eax, esi
jmp 0x416d7c
cmp dword [ebp + 0x14], esi
push edi
jle 0x416d6c
mov esi, 0x45dbb0
mov edi, dword [ebp + 0x14]
sub edi, dword [ebp - 4]
mov eax, 0x2000
cmp edi, eax
jl 0x416d3f
mov edi, eax
push edi
push esi
push dword [ebp + 0xc]
call fcn.004391d4
add esp, 0xc
cmp eax, edi
jne 0x416d82
push 0
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, edi
jne 0x416d82
add dword [ebp - 4], edi
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x14]
jl 0x416d2e
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
add dword [ebx], edi
call fcn.00416d87
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
or eax, 0xffffffff
jmp 0x416d7b
Function at 0x416e75
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov edx, dword [esi + 4]
xor ecx, ecx
push edi
lea eax, [esi + 0x420]
lea edi, [esi + 0x31c]
lea ebx, [esi + 0x218]
mov dword [eax], ecx
mov dword [edi], ecx
mov dword [ebx], ecx
mov dword [esi + 0x424], edx
inc dword [eax]
cmp dword [edi], ecx
mov byte [ebp - 1], 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
jbe 0x416ed0
lea ecx, [esi + 0x320]
mov edx, dword [esi + 4]
cmp dword [ecx], edx
je 0x416ed0
inc dword [ebp - 8]
mov edx, dword [ebp - 8]
add ecx, 4
cmp edx, dword [edi]
jb 0x416ebc
mov ecx, dword [edi]
mov edx, dword [ebp - 8]
cmp edx, ecx
jne 0x416eea
cmp ecx, 0x40
jae 0x416eea
mov ecx, dword [esi + 4]
mov dword [esi + edx*4 + 0x320], ecx
inc dword [edi]
and dword [ebp - 8], 0
cmp dword [ebx], 0
jbe 0x416f0d
lea ecx, [esi + 0x21c]
mov edx, dword [esi + 4]
cmp dword [ecx], edx
je 0x416f0d
inc dword [ebp - 8]
mov edx, dword [ebp - 8]
add ecx, 4
cmp edx, dword [ebx]
jb 0x416ef9
mov ecx, dword [ebx]
mov edx, dword [ebp - 8]
cmp edx, ecx
jne 0x416f27
cmp ecx, 0x40
jae 0x416f27
mov ecx, dword [esi + 4]
mov dword [esi + edx*4 + 0x21c], ecx
inc dword [ebx]
mov edx, dword [ebp + 8]
test edx, edx
mov ecx, dword [ebp + 0xc]
jg 0x416f35
test ecx, ecx
jle 0x416f40
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edx
lea ecx, [ebp - 0x14]
jmp 0x416f43
mov ecx, dword [ebp - 0x10]
push ecx
push eax
mov eax, dword [esi + 4]
push ebx
push edi
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x416f5f
mov dword [esi + 8], 5
jmp 0x416fb8
push edi
push dword [esi + 4]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x416f79
push ebx
push dword [esi + 4]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x416fb8
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1007
push 0xffff
push dword [esi + 4]
mov dword [ebp + 8], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x416fb3
call fcn.00433cc1
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
cmp dword [ebp - 0xc], 0
jne 0x416fb3
mov byte [ebp - 1], 1
call fcn.00416d87
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x416fc2
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov esi, eax
push 0x10
lea edi, [esi + 0x44]
push 0
push edi
mov byte [ebp - 1], 0
call fcn.0042d8b0
add esp, 0xc
push dword [ebp + 8]
mov word [edi], 2
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
mov dword [esi + 0x524], eax
jne 0x417003
call fcn.00416d87
xor al, al
jmp 0x417096
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 8]
push eax
call fcn.0042f100
mov eax, dword [ebp - 8]
add esp, 0xc
cmp eax, 0xffffffff
mov dword [esi + 0x48], eax
je 0x416ff7
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 0x46], ax
lea ebx, [esi + 0x78]
mov eax, ebx
call fcn.0041687d
call fcn.0040ad46
push 0x10
push edi
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x41707e
call fcn.00416d87
cmp byte [esi + 0x28], 0
jne 0x417087
mov eax, dword [esi + 8]
cmp eax, 6
je 0x41706a
cmp eax, 8
jne 0x417087
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x10]
mov byte [ebp - 1], al
jmp 0x417087
call fcn.00416d87
mov byte [ebp - 1], 1
lea ebx, [esi + 0x80]
call fcn.0040ad46
mov al, byte [ebp - 1]
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x41709c
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov esi, eax
push 0x10
lea edi, [esi + 0x44]
push 0
push edi
mov byte [ebp - 1], 0
call fcn.0042d8b0
add esp, 0xc
push dword [ebp + 8]
mov word [edi], 2
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
mov dword [esi + 0x524], eax
jne 0x4170da
call fcn.00416d87
xor al, al
jmp 0x417141
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 8]
push eax
call fcn.0042f100
mov eax, dword [ebp - 8]
add esp, 0xc
cmp eax, 0xffffffff
mov dword [esi + 0x48], eax
je 0x4170d1
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 0x46], ax
lea ebx, [esi + 0x78]
mov eax, ebx
call fcn.0041687d
call fcn.0040ad46
push 0x10
push edi
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x41712d
mov byte [ebp - 1], 1
call fcn.00416d87
lea ebx, [esi + 0x80]
call fcn.0040ad46
mov al, byte [ebp - 1]
pop ebx
pop edi
pop esi
leave
ret 8