joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4074f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [0x52fec4], eax
mov dword [0x52fec8], eax
mov dword [0x52fecc], eax
mov dword [0x52fed0], eax
mov dword [0x52fed4], eax
push 0x407400
push 0x52fec4
push 0xffffc
push 0x42f6a0
mov ecx, dword [0x42f694]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x407547
mov dword [0x42e128], 0
mov eax, 1
jmp 0x4075aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
push 0x428570
mov eax, dword [str.._Xrnetwk.log]
push eax
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0x10
push str.Cannot_start_KAL_read
mov ecx, dword [str.._Xrnetwk.log]
push ecx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 0x428594
mov edx, dword [str.._Xrnetwk.log]
push edx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 1
call fcn.004150dc
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x407940
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x4078b0
push 0
push 0
call fcn.00415f0e
add esp, 0x18
mov dword [0x42f688], eax
cmp dword [0x42f688], 0
je 0x40796e
jmp 0x4079c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x42819c
mov ecx, dword [str.._Xrnetwk.log]
push ecx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0x10
push str.Cannot_create_helper_child_thread
mov edx, dword [str.._Xrnetwk.log]
push edx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 0x4281cc
mov eax, dword [str.._Xrnetwk.log]
push eax
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 1
call fcn.004150dc
pop ebp
ret
Function at 0x4079d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0x4281f4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
mov al, byte [edx]
mov byte [ebp - 0x11], al
add dword [ebp - 0xc], 1
cmp byte [ebp - 0x11], 0
jne 0x4079ec
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x407a85
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4281f8
mov edx, dword [str.._Xrnetwk.log]
push edx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0x10
push str.Cannot_write_to_STDOUT
mov eax, dword [str.._Xrnetwk.log]
push eax
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 0x42821c
mov ecx, dword [str.._Xrnetwk.log]
push ecx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 1
call fcn.004150dc
jmp 0x407af1
mov edx, dword [ebp - 4]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
mov dl, byte [ecx]
mov byte [ebp - 0x21], dl
add dword [ebp - 0x1c], 1
cmp byte [ebp - 0x21], 0
jne 0x407a94
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x28]
je 0x407af1
push str.Short_write_to_STDOUT
mov edx, dword [str.._Xrnetwk.log]
push edx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 0x42825c
mov eax, dword [str.._Xrnetwk.log]
push eax
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 1
call fcn.004150dc
mov esp, ebp
pop ebp
ret
Function at 0x408710
Capabilities:
Get networking parameters

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423138
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x42d084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x68]
call fcn.00409770
mov dword [ebp - 4], 0
push 0x248
call fcn.00415b77
add esp, 4
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x74], 0x248
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
call dword [sym.imp.IPHLPAPI.DLL_GetNetworkParams]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x6f
jne 0x4087fb
mov edx, dword [ebp - 0x6c]
push edx
call fcn.00415b3d
add esp, 4
mov eax, dword [ebp - 0x74]
push eax
call fcn.00415b77
add esp, 4
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x4087ad
lea ecx, [ebp - 0x74]
push ecx
mov edx, dword [ebp - 0x6c]
push edx
call dword [sym.imp.IPHLPAPI.DLL_GetNetworkParams]
mov dword [ebp - 0x70], eax
jmp 0x4087fb
push str.Cannot_allocate_memory
mov eax, dword [str.._Xrnetwk.log]
push eax
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 0x427ba4
mov ecx, dword [str.._Xrnetwk.log]
push ecx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 1
call fcn.004150dc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.004098f0
jmp 0x4088f4
cmp dword [ebp - 0x70], 0
je 0x408870
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x427bcc
mov edx, dword [str.._Xrnetwk.log]
push edx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0x10
push str.Cannot_get_network_parameters
mov eax, dword [str.._Xrnetwk.log]
push eax
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 0x427bf8
mov ecx, dword [str.._Xrnetwk.log]
push ecx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 1
call fcn.004150dc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.004098f0
jmp 0x4088f4
mov edx, dword [ebp - 0x6c]
add edx, 0x110
push edx
lea ecx, [ebp - 0x2c]
call fcn.004097e0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00409a80
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004098f0
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ecx + 0x10c]
mov dword [ebp - 0x4c], edx
cmp dword [ebp - 0x4c], 0
je 0x4088e5
mov eax, dword [ebp - 0x4c]
add eax, 4
push eax
lea ecx, [ebp - 0x48]
call fcn.004097e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00409a80
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.004098f0
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx]
mov dword [ebp - 0x4c], eax
jmp 0x4088aa
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.004098f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004149ef
mov esp, ebp
pop ebp
ret
Function at 0x408910
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423168
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x42d084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
call fcn.00409990
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.00408710
add esp, 4
push 8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4089a5
push str.Memory_allocation_failed__n
mov ecx, dword [str.._Xrnetwk.log]
push ecx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 0x427c3c
mov edx, dword [str.._Xrnetwk.log]
push edx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 1
call fcn.004150dc
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x28]
call fcn.00409a20
jmp 0x4089c1
push 0
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00409ba0
lea edx, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x28]
call fcn.00409a50
push eax
lea ecx, [ebp - 0x30]
call fcn.00409bd0
movzx eax, al
test eax, eax
je 0x408a2e
lea ecx, [ebp - 0x30]
call fcn.00409b80
mov ecx, eax
call fcn.00409950
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], 1
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov dword [edx + 4], eax
push 0
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 8
push 1
push str.google.com
call dword [sym.imp.DNSAPI.dll_DnsQuery_A]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x408a2c
jmp 0x408a2e
jmp 0x4089b3
push 1
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.DNSAPI.dll_DnsFree]
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0040bcd0
add esp, 4
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004099c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x409360
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x42d084]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x42f66c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x42f698], 0
je 0x4093e8
mov eax, dword [0x42f698]
push eax
push 0x427fc4
mov ecx, dword [str.._Xrnetwk.log]
push ecx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0x10
push str.Cannot_read_from_KAL
mov edx, dword [str.._Xrnetwk.log]
push edx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 0x427fe8
mov eax, dword [str.._Xrnetwk.log]
push eax
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 1
call fcn.004150dc
xor eax, eax
jmp 0x409593
cmp dword [0x42f69c], 0
je 0x40940f
mov ecx, dword [0x42f69c]
push ecx
push 0x42f6a0
call fcn.00409310
add esp, 8
mov dword [0x42f69c], 0
cmp dword [0x42e128], 0
je 0x409428
call fcn.004074f0
test eax, eax
jne 0x409428
xor eax, eax
jmp 0x409593
cmp dword [0x52fea4], 0
je 0x409452
push str.Event_loop_saw_shutdown_request
mov edx, dword [str.._Xrnetwk.log]
push edx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
xor eax, eax
jmp 0x409593
cmp dword [0x52fea0], 0
je 0x40946a
mov dword [0x52fea0], 0
call fcn.00408c30
call fcn.00408ca0
test eax, eax
jne 0x40947a
xor eax, eax
jmp 0x409593
mov dword [ebp - 0x114], 0xffffffff
mov dword [ebp - 0x330], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0x3e8
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x330]
push edx
lea eax, [ebp - 0x114]
push eax
call fcn.0040bdf0
add esp, 0x10
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x330]
push ecx
mov edx, dword [ebp - 0x114]
add edx, 1
push edx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x409566
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x428030
mov eax, dword [str.._Xrnetwk.log]
push eax
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0x10
push str.Cannot_select
mov ecx, dword [str.._Xrnetwk.log]
push ecx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 0x42804c
mov edx, dword [str.._Xrnetwk.log]
push edx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 1
call fcn.004150dc
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x330]
push edx
call fcn.0040c300
add esp, 0xc
push 0x42f66c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004149ef
mov esp, ebp
pop ebp
ret
Function at 0x40b550
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x42e2c4], eax
push 1
push 0x40afe0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
jne 0x40b5ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
push 0x4277b8
mov edx, dword [str.._Xrnetwk.log]
push edx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0x10
push str.Cannot_set_console_control_handler
mov eax, dword [str.._Xrnetwk.log]
push eax
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 0x4277e8
mov ecx, dword [str.._Xrnetwk.log]
push ecx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 1
call fcn.004150dc
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x52feb4], eax
cmp dword [0x52feb4], 0
jne 0x40b64b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
push 0x427810
mov eax, dword [str.._Xrnetwk.log]
push eax
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0x10
push str.Cannot_create_quit_window_created_event
mov ecx, dword [str.._Xrnetwk.log]
push ecx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 0x427844
mov edx, dword [str.._Xrnetwk.log]
push edx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 1
call fcn.004150dc
push 0
push 0
push 0
push 0x40b200
push 0
push 0
call fcn.00415f0e
add esp, 0x18
mov dword [0x52feb8], eax
cmp dword [0x52feb8], 0
jne 0x40b6d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push 0x42786c
mov ecx, dword [str.._Xrnetwk.log]
push ecx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0x10
push str.Cannot_start_quit_window_thread
mov edx, dword [str.._Xrnetwk.log]
push edx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 0x427898
mov eax, dword [str.._Xrnetwk.log]
push eax
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 1
call fcn.004150dc
push 0xffffffffffffffff
mov ecx, dword [0x52feb4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x40b746
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
push 0x4278c0
mov eax, dword [str.._Xrnetwk.log]
push eax
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0x10
push str.Cannot_wait_for_quit_window_created_event
mov ecx, dword [str.._Xrnetwk.log]
push ecx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 0x4278f8
mov edx, dword [str.._Xrnetwk.log]
push edx
call fcn.004063b0
push eax
call fcn.00406470
add esp, 0xc
push 1
call fcn.004150dc
mov eax, dword [0x52feb4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x52feb4], 0
mov esp, ebp
pop ebp
ret
Function at 0x40b8b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword [0x42f5cc]
and eax, 1
je 0x40b8ed
push str.sbappend
push 0x4273dc
mov ecx, dword [0x42f5c8]
push ecx
call fcn.00414be4
add esp, 0xc
mov edx, dword [0x42f5c8]
push edx
call fcn.00414b88
add esp, 4
mov eax, dword [0x42f5cc]
and eax, 1
je 0x40b93f
mov ecx, dword [0x42f5c8]
push ecx
push 0x20
call fcn.00415811
add esp, 8
mov edx, dword [ebp + 8]
push edx
push 0x4273e4
mov eax, dword [0x42f5c8]
push eax
call fcn.00414be4
add esp, 0xc
mov ecx, dword [0x42f5c8]
push ecx
push 0xa
call fcn.00415811
add esp, 8
mov edx, dword [0x42f5c8]
push edx
call fcn.00414b88
add esp, 4
mov eax, dword [0x42f5cc]
and eax, 1
je 0x40b991
mov ecx, dword [0x42f5c8]
push ecx
push 0x20
call fcn.00415811
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
push 0x4273f0
mov eax, dword [0x42f5c8]
push eax
call fcn.00414be4
add esp, 0xc
mov ecx, dword [0x42f5c8]
push ecx
push 0xa
call fcn.00415811
add esp, 8
mov edx, dword [0x42f5c8]
push edx
call fcn.00414b88
add esp, 4
mov eax, dword [0x42f5cc]
and eax, 1
je 0x40b9e6
mov ecx, dword [0x42f5c8]
push ecx
push 0x20
call fcn.00415811
add esp, 8
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x20]
push eax
push str.m__m_len___d
mov ecx, dword [0x42f5c8]
push ecx
call fcn.00414be4
add esp, 0xc
mov edx, dword [0x42f5c8]
push edx
push 0xa
call fcn.00415811
add esp, 8
mov eax, dword [0x42f5c8]
push eax
call fcn.00414b88
add esp, 4
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x20], 0
jg 0x40ba00
mov edx, dword [ebp + 0xc]
push edx
call fcn.00406de0
add esp, 4
jmp 0x40bac5
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
je 0x40ba39
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x3b
push edx
call fcn.0040bad0
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.00406de0
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040d070
add esp, 4
jmp 0x40bac5
mov edx, dword [ebp + 8]
cmp dword [edx + 0x3b], 0
jne 0x40ba62
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x20]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x40ba7d
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x3b
push ecx
call fcn.0040bad0
add esp, 8
jmp 0x40bab9
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 0x20]
je 0x40bab9
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x20]
sub edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x20], edx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x1c]
add edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x1c], edx
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x3b
push edx
call fcn.0040bad0
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.00406de0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x40bcf0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x42d084]
xor eax, ebp
mov dword [ebp - 4], eax
push 7
push str.._slirp.log
call fcn.00402650
add esp, 8
lea eax, [ebp - 0x198]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x40bce0
call fcn.0041638c
add esp, 4
mov dword [0x42f3f0], 1
call fcn.004041d0
call fcn.004050f0
call fcn.00406bf0
push 0x42f3e0
push str.127.0.0.1
call fcn.00407270
add esp, 8
push 0x42f39c
push str.10.0.2.0
call fcn.00407270
add esp, 8
push 2
call dword [sym.imp.WS2_32.dll_htonl]
or eax, dword [0x42f39c]
mov dword [0x42f3a4], eax
push 0xf
call dword [sym.imp.WS2_32.dll_htonl]
or eax, dword [0x42f39c]
mov dword [0x42f3ec], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004149ef
mov esp, ebp
pop ebp
ret
Function at 0x40dbe0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x42d084]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x42f5cc]
and eax, 1
je 0x40dc22
push str.sosendto
push 0x4271c8
mov ecx, dword [0x42f5c8]
push ecx
call fcn.00414be4
add esp, 0xc
mov edx, dword [0x42f5c8]
push edx
call fcn.00414b88
add esp, 4
mov eax, dword [0x42f5cc]
and eax, 1
je 0x40dc74
mov ecx, dword [0x42f5c8]
push ecx
push 0x20
call fcn.00415811
add esp, 8
mov edx, dword [ebp + 8]
push edx
push 0x4271d0
mov eax, dword [0x42f5c8]
push eax
call fcn.00414be4
add esp, 0xc
mov ecx, dword [0x42f5c8]
push ecx
push 0xa
call fcn.00415811
add esp, 8
mov edx, dword [0x42f5c8]
push edx
call fcn.00414b88
add esp, 4
mov eax, dword [0x42f5cc]
and eax, 1
je 0x40dcc6
mov ecx, dword [0x42f5c8]
push ecx
push 0x20
call fcn.00415811
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
push 0x4271dc
mov eax, dword [0x42f5c8]
push eax
call fcn.00414be4
add esp, 0xc
mov ecx, dword [0x42f5c8]
push ecx
push 0xa
call fcn.00415811
add esp, 8
mov edx, dword [0x42f5c8]
push edx
call fcn.00414b88
add esp, 4
mov eax, 2
mov word [ebp - 0x18], ax
push 0xffffff00
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [ebp + 8]
and eax, dword [ecx + 0x18]
cmp eax, dword [0x42f39c]
jne 0x40dd20
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
and eax, 0xff
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
je 0x40dd05
jmp 0x40dd15
call fcn.0040bcc0
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
jmp 0x40dd1e
mov edx, dword [0x42f3e0]
mov dword [ebp - 0x14], edx
jmp 0x40dd29
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 8]
mov ax, word [edx + 0x20]
mov word [ebp - 0x16], ax
mov ecx, dword [0x42f5cc]
and ecx, 2
je 0x40dd7b
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
movzx eax, word [ebp - 0x16]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
push ecx
push str._sendto__ing__addr.sin_port_d__addr.sin_addr.s_addr_.16s_n
mov edx, dword [0x42f5c8]
push edx
call fcn.00414be4
add esp, 0x10
mov eax, dword [0x42f5c8]
push eax
call fcn.00414b88
add esp, 4
push 0x10
lea ecx, [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x20]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x40ddac
or eax, 0xffffffff
jmp 0x40ddd1
mov edx, dword [ebp + 8]
cmp dword [edx + 0x2f], 0
je 0x40ddc5
mov eax, dword [0x42f398]
add eax, 0x3a980
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x2f], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x27], 4
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004149ef
mov esp, ebp
pop ebp
ret
Function at 0x411fb0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x42d084]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov eax, dword [0x42f5cc]
and eax, 1
je 0x411ff9
push str.tcp_fconnect
push 0x426a04
mov ecx, dword [0x42f5c8]
push ecx
call fcn.00414be4
add esp, 0xc
mov edx, dword [0x42f5c8]
push edx
call fcn.00414b88
add esp, 4
mov eax, dword [0x42f5cc]
and eax, 1
je 0x41204b
mov ecx, dword [0x42f5c8]
push ecx
push 0x20
call fcn.00415811
add esp, 8
mov edx, dword [ebp + 8]
push edx
push 0x426a0c
mov eax, dword [0x42f5c8]
push eax
call fcn.00414be4
add esp, 0xc
mov ecx, dword [0x42f5c8]
push ecx
push 0xa
call fcn.00415811
add esp, 8
mov edx, dword [0x42f5c8]
push edx
call fcn.00414b88
add esp, 4
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jl 0x41219a
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004073d0
add esp, 4
mov dword [ebp - 0xc], 1
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0xffff
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 0xc], 1
push 4
lea edx, [ebp - 0xc]
push edx
push 0x100
push 0xffff
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, 2
mov word [ebp - 0x20], cx
push 0xffffff00
call dword [sym.imp.WS2_32.dll_htonl]
mov edx, dword [ebp + 8]
and eax, dword [edx + 0x18]
cmp eax, dword [0x42f39c]
jne 0x412120
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.WS2_32.dll_ntohl]
and eax, 0xff
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
je 0x412106
jmp 0x412116
call fcn.0040bcc0
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], edx
jmp 0x41211e
mov eax, dword [0x42f3e0]
mov dword [ebp - 0x1c], eax
jmp 0x412129
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x20]
mov word [ebp - 0x1e], cx
mov edx, dword [0x42f5cc]
and edx, 2
je 0x41217b
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
movzx ecx, word [ebp - 0x1e]
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
movzx edx, ax
push edx
push str._connect__ing__addr.sin_port_d__addr.sin_addr.s_addr_.16s_n
mov eax, dword [0x42f5c8]
push eax
call fcn.00414be4
add esp, 0x10
mov ecx, dword [0x42f5c8]
push ecx
call fcn.00414b88
add esp, 4
push 0x10
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040e1c0
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004149ef
mov esp, ebp
pop ebp
ret