joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426520
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44af98
push eax
mov eax, 0x123c
mov dword fs:[0], esp
call fcn.0043aa10
push esi
push edi
mov edi, ecx
lea ecx, [edi + 0x1c]
call fcn.00402140
mov esi, dword [ebp + 8]
test esi, esi
jne 0x42656c
pop edi
mov eax, 0x80004005
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x248], ax
lea eax, [ebp - 0x246]
push eax
call fcn.00434de0
xor eax, eax
push 0xffe
push eax
mov word [ebp - 0x1248], ax
lea eax, [ebp - 0x1246]
push eax
call fcn.00434de0
push 0x3c
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.00434de0
lea eax, [ebp - 0x248]
mov dword [ebp - 0x38], eax
add esp, 0x24
lea eax, [ebp - 0x1248]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x48]
push eax
push 0
push esi
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x34], 0x100
mov dword [ebp - 0x18], 0x800
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
je 0x426555
xor eax, eax
cmp ax, word [ebp - 0x1248]
jne 0x42660b
mov dword [ebp - 0x1248], 0x2f
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
mov dword [ebp - 4], 0
call fcn.00427e20
mov esi, dword [ebp + 8]
push 0
push 0
test al, al
je 0x42663e
push esi
push 3
jmp 0x426642
push 0
push 0
push 0x458e94
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov ecx, eax
mov dword [edi + 8], eax
test ecx, ecx
je 0x426665
push 4
lea eax, [edi + 4]
push eax
push 3
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp word [ebp - 0x30], 0
mov eax, dword [ebp - 0x3c]
jne 0x426687
cmp eax, 1
jne 0x426679
lea ecx, [eax + 0x4f]
jmp 0x426683
cmp eax, 2
jne 0x426687
mov ecx, 0x1bb
mov word [ebp - 0x30], cx
mov edx, dword [ebp - 0x38]
mov dword [edi + 0x34], eax
lea eax, [edi + 0x14]
test edx, edx
jne 0x426698
xor ecx, ecx
jmp 0x4266b3
mov ecx, edx
push ebx
lea ebx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4266a0
sub ecx, ebx
sar ecx, 1
lea eax, [edi + 0x14]
pop ebx
push ecx
push edx
mov ecx, eax
call fcn.00402300
push 0
push dword [ebp - 0x30]
push dword [ebp - 0x38]
push dword [edi + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [edi + 0xc], eax
test eax, eax
je 0x4266f4
push dword [ebp - 0x1c]
lea ecx, [edi + 0x18]
call fcn.004023c0
mov eax, dword [edi + 4]
push eax
push eax
push eax
push 0
push dword [edi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
xor edi, edi
jmp 0x4266f9
mov edi, 0x80004005
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42671a
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4267e0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x10]
test eax, eax
jne 0x4267f3
mov eax, 0x80004005
pop ebp
ret 0xc
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0xffff
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
pop ebp
ret 0xc

Function at 0x426890
Capabilities:
Prepare http request
Receive http response
Set http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
jne 0x4268ab
mov eax, 0x80070006
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4268c0
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov dword [esi + 0x10], 0
push edi
push 0x800040
push 0
push 0
push 0
push dword [esi + 0x18]
push dword [ebp + 8]
push dword [esi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
push 4
lea ecx, [ebp - 8]
push ecx
push 0x58
push eax
mov dword [esi + 0x10], eax
mov dword [ebp - 8], 0
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov ecx, dword [esi + 0x1c]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
cmp dword [ecx - 0xc], 0
je 0x426918
push 0x20000000
push 0xffffffffffffffff
push ecx
push dword [esi + 0x10]
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
je 0x426939
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esi + 0x10]
call edi
mov edi, eax
test edi, edi
jne 0x4269c2
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2f8f
jne 0x4269ec
push dword [esi + 0x10]
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
push 0x800040
push 0
push 0
push 0
push dword [esi + 0x18]
push dword [ebp + 8]
push dword [esi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0x1f
push eax
mov dword [esi + 0x10], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
call dword [sym.imp.WINHTTP.dll_WinHttpQueryOption]
test eax, eax
je 0x4269ab
or dword [ebp - 4], 0x3300
push 4
lea eax, [ebp - 4]
push eax
push 0x1f
push dword [esi + 0x10]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esi + 0x10]
call edi
mov edi, eax
test edi, edi
je 0x4269ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
je 0x4269ec
push 0
push dword [esi + 0x10]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x4269ec
mov ecx, esi
call fcn.00426b40
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
mov eax, 0x80070006
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x426a00
Capabilities:
Prepare http request
Receive http response
Set http header

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
je 0x426ab0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x426a26
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov dword [esi + 0x10], 0
push 0x40
push 0
push 0
push 0
push dword [esi + 0x18]
push dword [ebp + 8]
push dword [esi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [esi + 0x10], eax
test eax, eax
je 0x426ab0
push 4
lea ecx, [ebp - 4]
push ecx
push 0x58
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [esi + 0x1c]
cmp dword [eax - 0xc], 0
je 0x426a78
push 0x20000000
push 0xffffffffffffffff
push eax
push dword [esi + 0x10]
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
je 0x426ab0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esi + 0x10]
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x426ab0
push 0
push dword [esi + 0x10]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x426ab0
mov ecx, esi
call fcn.00426b40
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x426b40
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
push esi
push edi
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x108], ax
lea eax, [ebp - 0x106]
push eax
mov esi, ecx
mov dword [ebp - 8], 0x40
call fcn.00434de0
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
add esp, 0xc
lea eax, [ebp - 8]
push 0
push eax
lea eax, [ebp - 0x108]
push eax
push 0
push 5
push dword [esi + 0x10]
call edi
test eax, eax
je 0x426ba1
lea eax, [ebp - 0x108]
push eax
call fcn.00433058
add esp, 4
mov dword [esi + 0x20], eax
xor eax, eax
push 0x3e
push eax
mov word [ebp - 0x48], ax
lea eax, [ebp - 0x46]
push eax
call fcn.00434de0
add esp, 0xc
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0x13
push dword [esi + 0x10]
mov dword [ebp - 4], 0x20
call edi
test eax, eax
je 0x426be3
lea eax, [ebp - 0x48]
push eax
call fcn.00433058
add esp, 4
mov dword [esi + 0x24], eax
xor eax, eax
push 0x3e
push eax
mov word [ebp - 0x88], ax
lea eax, [ebp - 0x86]
push eax
call fcn.00434de0
add esp, 0xc
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x88]
push eax
push 0
push 0x1d
push dword [esi + 0x10]
mov dword [ebp - 4], 0x20
call edi
test eax, eax
je 0x426c3c
push str.gzip
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x426c3c
mov dword [esi + 0x2c], 1
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x188], ax
lea eax, [ebp - 0x186]
push eax
call fcn.00434de0
add esp, 0xc
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x188]
push eax
push 0
push 1
push dword [esi + 0x10]
mov dword [ebp - 4], 0x40
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x426cd0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0043aa10
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
test eax, eax
je 0x426d48
push 0
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x1004]
push ecx
push 0
push 0x21
push eax
mov dword [ebp - 4], 0x800
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x426d48
cmp word [ebp - 0x1004], 0x2f
lea eax, [ebp - 0x1004]
push eax
jne 0x426d37
push dword [esi + 0x14]
push str.http:___s_s
push dword [ebp + 8]
call fcn.0040be40
add esp, 0x10
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
call fcn.004023c0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x426db0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x128
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x10]
test eax, eax
je 0x426f20
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
push 0
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x4000000a
push eax
mov dword [esp + 0x24], 0x10
call edi
test eax, eax
je 0x426e13
push dword [ebp + 8]
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x426f20
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
xor eax, eax
push 0xfe
push eax
mov word [esp + 0x38], ax
lea eax, [esp + 0x3a]
push eax
call fcn.00434de0
add esp, 0xc
lea eax, [esp + 0xc]
push 0
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0x31
push dword [esi + 0x10]
mov dword [esp + 0x24], 0x100
call edi
test eax, eax
je 0x426f20
push str.max_age
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x426e6b
add eax, 0x10
jne 0x426e8c
push str.s_maxage
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x426f20
add eax, 0x12
je 0x426f20
lea ecx, [esp + 0x10]
push ecx
xorps xmm0, xmm0
push str._lld
push eax
movlpd qword [esp + 0x1c], xmm0
call fcn.0043447c
add esp, 0xc
test eax, eax
je 0x426f20
mov eax, dword [esp + 0x10]
or eax, dword [esp + 0x14]
je 0x426f20
push 0
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x40000009
push dword [esi + 0x10]
mov dword [esp + 0x24], 0x10
call edi
test eax, eax
je 0x426f20
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
push 0
push 0x989680
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.00442990
add esi, eax
mov eax, dword [ebp + 8]
adc edi, edx
test eax, eax
je 0x426f20
mov dword [eax], esi
mov dword [eax + 4], edi
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x426f30
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
xor eax, eax
push esi
mov esi, dword [ecx + 0x10]
test esi, esi
je 0x426fa9
push 0x7e
push eax
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push eax
mov dword [ebp - 4], 0x40
call fcn.00434de0
add esp, 0xc
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x84]
push eax
push 0
push 0x3f
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x426fa7
push str.chunked
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x426fa7
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x427710
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x42771b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00427730
Function at 0x427e20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push str.ProxyEnable
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 4
mov dword [ebp - 4], 4
call edi
cmp dword [ebp - 0xc], 0
jne 0x427e6e
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, esi
mov dword [ebp - 4], 0x208
mov dword [ebp - 8], 1
call fcn.00428020
push eax
lea eax, [ebp - 8]
push eax
push str.ProxyServer
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
call edi
mov edi, eax
mov eax, dword [esi]
test eax, eax
jne 0x427eae
xor ecx, ecx
jmp 0x427ec0
push dword [eax - 8]
push eax
call fcn.004336a3
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x427ef4
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x427ef4
mov dword [eax - 0xc], ecx
mov eax, dword [esi]
xor edx, edx
mov word [eax + ecx*2], dx
test edi, edi
jne 0x427ee9
mov eax, dword [esi]
cmp dword [eax - 0xc], edx
jne 0x427ee7
pop esi
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
test edi, edi
pop esi
sete al
pop edi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004022e0
int3

Function at 0x428120
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0xffffffff
je 0x42812e
mov eax, dword [esi]
call dword [eax + 0x10]
push 0
push 1
push 2
mov word [esi + 0x14], 0
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x42814f
mov eax, 0x80004005
pop esi
ret
mov eax, dword [esi]
push 0x2710
mov ecx, esi
call dword [eax + 0x34]
neg eax
sbb eax, eax
and eax, 0x80004005
pop esi
ret

Function at 0x4281d0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp byte [edi + 0x15], 0
je 0x4281e6
mov eax, 0x80004004
pop edi
pop ebp
ret 4
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x42824e
cmp byte [esi], 0
je 0x42824e
push esi
lea ecx, [edi + 0xc]
call fcn.0041cbe0
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [edi + 8], eax
cmp eax, 0xffffffff
jne 0x428246
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x428221
pop esi
mov eax, 0x80004005
pop edi
pop ebp
ret 4
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
push eax
mov dword [edi + 8], eax
call dword [sym.imp.WS2_32.dll_htonl]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
test eax, eax
je 0x428246
push eax
lea ecx, [edi + 0x10]
call fcn.0041cbe0
pop esi
xor eax, eax
pop edi
pop ebp
ret 4
pop esi
mov eax, 0x80070057
pop edi
pop ebp
ret 4
Function at 0x428260
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x428285
cmp byte [ecx], 0
je 0x428285
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 8]
test eax, eax
jne 0x428308
cmp dword [esi + 4], 0xffffffff
jne 0x428296
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
test eax, eax
jne 0x428308
cmp byte [esi + 0x15], 0
je 0x4282a8
mov eax, 0x80004004
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi]
push dword [ebp + 0xc]
mov ecx, esi
call dword [eax + 0x34]
mov eax, dword [esi + 8]
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, 2
mov word [ebp - 0x10], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x428302
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x428302
cmp eax, 0x2734
je 0x428302
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov byte [esi + 0x14], 1
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x428380
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, ecx
xor ebx, ebx
xor esi, esi
mov dword [ebp - 4], eax
test edi, edi
je 0x4283ea
cmp byte [eax + 0x15], 0
jne 0x4283df
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [ebp + 0xc], eax
mov edx, dword [ecx]
mov eax, edi
sub eax, esi
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call dword [edx + 0x20]
test eax, eax
jle 0x4283c6
add esi, eax
cmp esi, edi
je 0x4283ea
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0xc]
add ebx, eax
cmp ebx, dword [ebp + 0x10]
jge 0x4283ea
cmp esi, edi
jae 0x4283ea
mov eax, dword [ebp - 4]
jmp 0x428397
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x428440
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, ecx
xor esi, esi
xor ebx, ebx
mov dword [ebp - 4], eax
test edi, edi
je 0x4284aa
cmp byte [eax + 0x15], 0
jne 0x42849f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [ebp + 0xc], eax
mov edx, dword [ecx]
mov eax, edi
sub eax, esi
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call dword [edx + 0x1c]
test eax, eax
jle 0x428486
add esi, eax
cmp esi, edi
je 0x4284aa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0xc]
add ebx, eax
cmp ebx, dword [ebp + 0x10]
jge 0x42849f
cmp esi, edi
jae 0x4284aa
mov eax, dword [ebp - 4]
jmp 0x428457
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x428510
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 4], 0xffffffff
je 0x428522
mov eax, dword [esi]
call dword [eax + 0x10]
push 0
push 1
push 2
mov word [esi + 0x14], 0
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x428568
lea ecx, [ebp - 4]
push ecx
push 0x8004667e
push eax
mov dword [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x428572
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x428580
Capabilities:
Check for time delay via gettickcount
Connect socket
Get socket status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
push edi
test ecx, ecx
je 0x4285ad
cmp byte [ecx], 0
je 0x4285ad
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 8]
test eax, eax
jne 0x4286fd
cmp dword [esi + 4], 0xffffffff
jne 0x4285c2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
test eax, eax
jne 0x4286fd
cmp byte [esi + 0x15], 0
jne 0x4286f8
mov eax, dword [esi + 8]
push dword [ebp + 8]
mov dword [esp + 0x20], eax
mov eax, 2
mov word [esp + 0x1c], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x1a], ax
push 0x10
lea eax, [esp + 0x1c]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x428622
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x428622
cmp eax, 0x2734
je 0x428622
mov eax, 0x80004005
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
mov dword [esp + 0xc], eax
cmp byte [esi + 0x15], 0
jne 0x4286f8
mov eax, dword [esi + 4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x134], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x134]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push 0
mov dword [esp + 0x3c], 1
mov dword [esp + 0x144], 1
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x2dc6c0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x428614
test eax, eax
je 0x4286ba
lea eax, [esp + 0x28]
push eax
push dword [esi + 4]
call ebx
test eax, eax
jne 0x4286e9
lea eax, [esp + 0x130]
push eax
push dword [esi + 4]
call ebx
test eax, eax
jne 0x428614
jmp 0x4286c0
cmp byte [esi + 0x15], 0
jne 0x4286f8
cmp edi, 0xffffffff
je 0x428635
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0xc]
cmp edi, eax
jg 0x428635
mov eax, 0x8001011f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov byte [esi + 0x14], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x80004004
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x428710
Capabilities:
Check for time delay via gettickcount
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
mov esi, ecx
cmp dword [esi + 4], 0xffffffff
je 0x428812
cmp byte [esi + 0x14], 0
je 0x428812
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [ebp + 0x10]
mov ebx, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
mov dword [ebp - 4], eax
cmp byte [esi + 0x15], 0
jne 0x4287de
mov eax, dword [esi + 4]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
lea eax, [ebp - 0x110]
push eax
push 0
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x214], 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x2dc6c0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x4287de
test eax, eax
je 0x4287c4
lea eax, [ebp - 0x110]
push eax
push dword [esi + 4]
call ebx
test eax, eax
jne 0x4287e9
lea eax, [ebp - 0x214]
push eax
push dword [esi + 4]
call ebx
test eax, eax
jne 0x4287de
cmp edi, 0xffffffff
je 0x428744
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp edi, eax
jg 0x428744
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
cmp byte [esi + 0x15], 0
jne 0x4287de
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_recv]
xor ecx, ecx
test eax, eax
pop edi
cmovg ecx, eax
pop ebx
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x428870
Capabilities:
Check for time delay via gettickcount
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
mov esi, ecx
cmp dword [esi + 4], 0xffffffff
je 0x428972
cmp byte [esi + 0x14], 0
je 0x428972
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [ebp + 0x10]
mov ebx, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
mov dword [ebp - 4], eax
cmp byte [esi + 0x15], 0
jne 0x42893e
mov eax, dword [esi + 4]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x214], 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x2dc6c0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x42893e
test eax, eax
je 0x428924
lea eax, [ebp - 0x110]
push eax
push dword [esi + 4]
call ebx
test eax, eax
jne 0x428949
lea eax, [ebp - 0x214]
push eax
push dword [esi + 4]
call ebx
test eax, eax
jne 0x42893e
cmp edi, 0xffffffff
je 0x4288a4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp edi, eax
jg 0x4288a4
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
cmp byte [esi + 0x15], 0
jne 0x42893e
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_send]
xor ecx, ecx
test eax, eax
pop edi
cmovg ecx, eax
pop ebx
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc