joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4065d3
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov eax, 0x428d14
call fcn.00428180
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x14]
xor esi, esi
mov dword [ebp - 0x14], esi
cmp dword [eax - 8], esi
jne 0x4065f6
push 0xa
jmp 0x4065f7
push eax
movzx eax, word [ebp + 0xc]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, esi
mov dword [ebp + 0xc], eax
je 0x406665
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x406665
lea eax, [ebp - 0x14]
push esi
push eax
push ebx
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, esi
push edi
jne 0x40667f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00427e82
xor eax, eax
jmp 0x406696
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00427e82
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x4066a5
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push esi
xor esi, esi
push eax
push 0x20006
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4066e3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4066d8
push 1
pop esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4066e6
push 1
pop esi
mov eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x406b1e
Capabilities:
Create process on windows
Create process suspended
Get comspec environment variable
Query environment variable
Resume thread

Disassembly:
mov eax, 0x428d90
call fcn.00428180
sub esp, 0x464
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x268]
push esi
xor edi, edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x406c12
lea eax, [ebp - 0x164]
push esi
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x406c12
push 0x44
lea eax, [ebp - 0x60]
pop esi
push esi
push edi
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x1c]
push edi
push eax
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x34], 1
mov word [ebp - 0x30], di
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0x164]
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x470]
push str._s__c_rd__s_s_q
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push edi
push edi
push 4
push edi
push edi
lea eax, [ebp - 0x470]
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x406bde
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x406c02
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push eax
call esi
push 0x40
push dword [ebp - 0x1c]
call esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00427e82
mov eax, edi
jmp 0x406c20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00427e82
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x406c68
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x428dac
call fcn.00428180
mov eax, 0x119c
call fcn.00428370
push ebx
push esi
push edi
mov esi, ecx
call fcn.004085ef
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_1
push dword [esi + 0xc4]
lea eax, [ebp - 0x10]
xor ebx, ebx
push str._sPackageSetupBroker.exe
push eax
mov dword [ebp - 4], ebx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea eax, [ebp - 0x1a8]
xor edi, edi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x406ccd
test byte [ebp - 0x1a8], 0x10
jne 0x406ccd
push 1
pop edi
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp edi, ebx
je 0x406db3
push 0x44
lea eax, [ebp - 0x68]
pop edi
push edi
push ebx
push eax
call sub.MSVCRT.dll_memset
push 1
mov dword [ebp - 0x68], edi
pop eax
mov dword [ebp - 0x3c], eax
mov word [ebp - 0x38], ax
push 0x10
lea eax, [ebp - 0x24]
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0x1000
lea eax, [ebp - 0x11a8]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x24
lea eax, [ebp - 0x11a8]
push dword [ebp - 0x10]
push 0x42fd4c
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov esi, dword [esi + 0xc4]
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x11a8]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x406d87
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x14]
push str.CreateProcess_failed___d__
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00427e82
jmp 0x406dbf
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x20]
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00427e82
push 1
pop eax
jmp 0x406dcd
push ebx
push ebx
push 0x42fd18
call sub.MFC42.DLL_AfxMessageBox
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00427e82
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x407853
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov eax, 0x428f3c
call fcn.00428180
sub esp, 0x58
push ebx
push esi
push 0x44
xor ebx, ebx
pop esi
lea eax, [ebp - 0x64]
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x20]
push ebx
push eax
mov dword [ebp - 0x64], esi
call sub.MSVCRT.dll_memset
add esp, 0x18
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_1
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
push eax
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], bl
call fcn.00427e82
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::MakeLower
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x64]
mov eax, dword [eax - 8]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, ebx
je 0x407928
push 0x2bf20
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
mov dword [ebp + 0xc], ebx
jne 0x407914
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x407928
push 1
pop esi
jmp 0x407928
cmp eax, 0x102
jne 0x407928
push 1
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor esi, esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::ReleaseBuffer
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00427e82
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x407e2e
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov eax, 0x428fe0
call fcn.00428180
sub esp, 0xc
push ebx
xor ebx, ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x10]
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push eax
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::Format
pop ecx
lea eax, [ebp - 0x18]
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x407ea1
mov eax, dword [ebp + 8]
push dword [eax - 8]
push eax
push 1
push ebx
push str.EDPDeploy
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00427e82
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00427e82
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4083de
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, 0x4290ac
call fcn.00428180
sub esp, 0x218
push esi
lea eax, [ebp - 0x224]
push edi
push eax
mov esi, ecx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x24]
call sub.MFC42.DLL_CException::CException
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_1
and dword [ebp - 0x1c], 0
or dword [ebp - 0x18], 0xffffffff
mov edi, 0x42a5e4
push 0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
mov dword [ebp - 0x24], edi
call sub.MFC42.DLL_CString::operator
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 2
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x10]
push str._sEDP.log
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esi + 0x19c]
lea edx, [ebp - 0x24]
lea ecx, [esi + 0x19c]
push edx
push 0x1021
push dword [ebp - 0x10]
call dword [eax + 0x28]
test eax, eax
jne 0x408491
and dword [esi + 0x1ac], eax
jmp 0x40849b
mov dword [esi + 0x1ac], 1
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00427e82
mov dword [ebp - 0x24], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 4
call fcn.00427e82
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x408638
Capabilities:
Get disk size
Query environment variable

Disassembly:
mov eax, 0x4290f8
call fcn.00428180
sub esp, 0x28
push ebx
push esi
push edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x1c], 1
call sub.MFC42.DLL_CString::CString_1
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ebx, ebx
push ebx
mov edi, str.SystemRoot
push ebx
push edi
mov dword [ebp - 4], ebx
call esi
cmp eax, ebx
jle 0x408698
lea ebx, [eax + 1]
push ebx
call sub.MFC42.DLL_operatornew
pop ecx
mov dword [ebp - 0x14], eax
push ebx
push eax
push edi
call esi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator
push dword [ebp - 0x14]
call sub.MFC42.DLL_operatordelete
pop ecx
xor ebx, ebx
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], ebx
je 0x4086e8
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
fild qword [ebp - 0x18]
shl eax, 2
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
fmul dword [0x42a61c]
fiadd dword [ebp - 0x18]
fmul dword [0x42a618]
fcomp dword [0x42a614]
fnstsw ax
sahf
jae 0x4086e8
mov dword [ebp - 0x1c], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00427e82
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x408706
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x42910c
call fcn.00428180
sub esp, 0x14
push esi
lea ecx, [ebp - 0x10]
xor esi, esi
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x10]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotFixUpdate_Rollup_1
push eax
mov dword [ebp - 4], esi
call sub.MFC42.DLL_CString::Format
pop ecx
lea eax, [ebp - 0x14]
pop ecx
push eax
push dword [ebp - 0x10]
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x408781
push 4
pop eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push str.Installed
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408778
cmp dword [ebp - 0x20], 1
jne 0x408778
push 1
pop esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00427e82
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4092b0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4092ea
mov ax, word [esp]
cmp al, 2
jne 0x4092e4
xor ecx, ecx
mov cl, ah
cmp cl, al
jne 0x4092e4
xor eax, eax
add esp, 0x190
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
add esp, 0x190
ret
Function at 0x413220
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0xc]
push 0
push ecx
mov eax, dword [edi + eax*4 + 0xd4]
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
cmp esi, 0xffffffff
jne 0x413275
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x41325d
pop edi
xor eax, eax
pop esi
ret
push eax
push edi
call fcn.00426750
push eax
mov eax, dword [edi]
push str.Send_failure:__s
push eax
call fcn.00413050
add esp, 0x14
mov eax, esi
pop edi
pop esi
ret

Function at 0x413490
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x4134c0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0x39
dec eax
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x413720
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x138]
test eax, eax
je 0x41374d
mov ecx, dword [esi + 0xdc]
mov edx, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
push ecx
push edx
push esi
call eax
add esp, 0x14
pop esi
ret
mov eax, dword [esp + 0xc]
test eax, eax
jl 0x41378f
cmp eax, 2
jg 0x41378f
mov ecx, dword [esi + 0xd8]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fwrite]
push ecx
push 1
lea edx, [eax + eax*2 + 0x42aaa8]
push 2
push edx
call edi
mov eax, dword [esi + 0xd8]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push eax
push 1
push ecx
push edx
call edi
add esp, 0x20
pop edi
xor eax, eax
pop esi
ret
Function at 0x413ef0
Capabilities:
Set socket configuration

Disassembly:
mov edx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 4
mov esi, dword [edi]
xor eax, eax
push ecx
push 1
mov al, byte [esi + 0x276]
push 6
push edx
mov dword [esp + 0x20], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x413f3d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.00426750
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.00412fe0
add esp, 0x14
pop edi
pop esi
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.00412fe0
add esp, 8
pop edi
pop esi
ret
Function at 0x415a40
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ecx, dword [edi]
mov esi, dword [edi + 0x2d0]
mov dword [esp + 0x14], ecx
mov eax, dword [ecx + 0x16c]
test eax, eax
jne 0x415a6d
mov eax, dword [ecx + 0x168]
test eax, eax
jne 0x415a6d
mov eax, 0x493e0
push eax
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x10]
mov ebp, eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [esi + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call ebx
mov eax, dword [esi + 0x14]
mov dword [esi + 0x10], 0
push eax
call ebx
test ebp, ebp
mov dword [esi + 0x14], 0
mov bl, 1
jne 0x415ac9
mov ecx, dword [esi]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x415b21
mov edx, dword [esi]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ebp, [esi + 8]
mov byte [edi + 0x2c8], bl
mov dword [ebp], 0xffffffff
mov eax, dword [esp + 0x18]
test eax, eax
je 0x415ae9
mov edx, dword [edi + 0x2c4]
mov dword [eax], edx
mov eax, dword [edi + 0x2c4]
xor esi, esi
test eax, eax
jne 0x415bd4
mov ebp, dword [ebp]
cmp ebp, 0x1b
jne 0x415b3d
push ebp
mov esi, ebp
call fcn.00426430
push eax
mov eax, dword [esp + 0x1c]
push str.Could_not_resolve_host:__s
push eax
call fcn.00413050
add esp, 0x10
jmp 0x415bd4
mov eax, dword [edi + 0x2cc]
push eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [esi]
lea ebp, [esi + 8]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x415ad9
mov al, byte [edi + 0x2c8]
test al, al
je 0x415ba5
mov al, byte [edi + 0x12b]
mov ecx, dword [edi + 0x2cc]
test al, al
push ecx
push edi
je 0x415b7f
call fcn.00426750
mov edx, dword [edi + 0xa0]
push eax
mov eax, dword [esp + 0x20]
push edx
push str.Could_not_resolve_proxy:__s___s
push eax
call fcn.00413050
add esp, 0x18
mov esi, 5
jmp 0x415bd4
call fcn.00426750
mov edx, dword [edi + 0x8c]
push eax
mov eax, dword [esp + 0x20]
push edx
push str.Could_not_resolve_host:__s___s
push eax
call fcn.00413050
add esp, 0x18
mov esi, 6
jmp 0x415bd4
cmp ebp, 0xffffffff
je 0x415bb6
cmp dword [edi + 0x2cc], 0x2afc
jne 0x415bcf
mov ecx, dword [edi + 0x8c]
mov edx, dword [esp + 0x14]
push ecx
push str.Resolving_host_timed_out:__s
push edx
call fcn.00413050
add esp, 0xc
mov esi, 0x1c
lea eax, [edi + 0x2bc]
push eax
call fcn.00415960
mov eax, dword [edi + 0x2c4]
add esp, 4
test eax, eax
jne 0x415bf3
mov byte [edi + 0x128], bl
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x415ca0
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0x14]
push ecx
push esi
mov ebx, dword [edi]
push 2
mov dword [eax], 0
call fcn.00426c50
add esp, 0xc
test eax, eax
jle 0x415ce6
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push edx
push esi
push eax
push 2
call fcn.004158b0
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
mov ebp, dword [esp + 0x1c]
push 0
push ebp
push esi
push edi
call fcn.00415d70
add esp, 0x10
test al, al
je 0x415d0c
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [ecx], 1
xor eax, eax
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
call fcn.00426750
push eax
push esi
push str.init_resolve_thread___failed_for__s___s_n
push ebx
call fcn.00412fe0
add esp, 0x18
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x415d59
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.00426750
push eax
push ebp
push esi
push str.gethostbyname_2__failed_for__s:_d___s_n
push ebx
call fcn.00412fe0
add esp, 0x1c
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
push ebp
push eax
call fcn.00415790
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x415d70
Capabilities:
Create thread

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push 1
push 0x24
call dword [0x4303cc]
mov esi, eax
xor ebx, ebx
add esp, 8
cmp esi, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
jne 0x415da6
push 0xc
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
mov edi, dword [esp + 0x1c]
mov eax, dword [edi + 0x2bc]
lea ebp, [edi + 0x2bc]
push eax
mov dword [esp + 0x20], ebp
call fcn.0040a440
mov ecx, dword [esp + 0x24]
push ecx
call dword [0x4303c8]
add esp, 8
cmp eax, ebx
mov dword [ebp], eax
jne 0x415df1
push esi
call dword [0x4303c0]
add esp, 4
push 0xc
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x24]
push ebx
push 1
mov dword [edi + 0x2c0], edx
mov byte [edi + 0x2c8], bl
mov dword [edi + 0x2cc], ebx
mov dword [edi + 0x2c4], ebx
mov dword [edi + 0x2d0], esi
push ebx
mov dword [esi + 0xc], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [esi + 0x10], eax
jne 0x415e2e
push ebp
jmp 0x415e81
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push ebx
push 1
push ebx
call ebp
cmp eax, ebx
mov dword [esi + 0x14], eax
je 0x415e7c
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [esi + 0x1c], eax
jne 0x415e59
mov ecx, dword [esp + 0x1c]
push ecx
jmp 0x415e81
push ebx
push ebx
push 1
push ebx
call ebp
cmp eax, ebx
mov dword [esi + 0x20], eax
jne 0x415e6e
mov edx, dword [esp + 0x1c]
push edx
jmp 0x415e81
push ebx
push ebx
push 1
push ebx
call ebp
cmp eax, ebx
mov dword [esi + 0x18], eax
jne 0x415e9b
mov eax, dword [esp + 0x1c]
push eax
call fcn.00415960
add esp, 4
push 0xb
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
lea ecx, [esi + 4]
push ecx
push ebx
push edi
push 0x415f10
push ebx
push ebx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
cmp eax, ebx
mov dword [esi], eax
jne 0x415edd
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, dword [eax]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x1c]
push eax
call fcn.00415960
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 0xffffffffffffffff
lea edx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov ecx, dword [esi + 0x18]
push ebx
push edx
push 2
mov dword [esp + 0x24], ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push ebx
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0xc], eax
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret