joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40842e
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret

Function at 0x40874c
Capabilities:
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp ebx, 0x8004
mov esi, ecx
mov dword [ebp - 4], edi
jne 0x408773
mov dword [ebp + 8], 0x14
jmp 0x408782
cmp ebx, 0x8003
jne 0x408782
mov dword [ebp + 8], 0x10
push 0x100
lea eax, [ebp - 0x104]
push edi
push eax
call fcn.004721c0
mov eax, dword [esi + 0x104]
add esp, 0xc
cmp eax, edi
je 0x408810
add esi, 0x108
push esi
push edi
push edi
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x408810
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x408804
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x104]
push eax
push 2
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x408804
cmp dword [ebp + 0x14], edi
mov dword [ebp - 4], 1
je 0x408804
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x14]
call fcn.00472430
add esp, 0xc
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [esi], edi
jmp 0x408849
sub ebx, 0x8003
je 0x40882c
dec ebx
jne 0x408849
push dword [ebp + 0x14]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00408853
jmp 0x40883b
push dword [ebp + 0x14]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00408902
add esp, 0x10
test al, al
je 0x408849
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x41565b
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4de32c
call fcn.00471fb4
sub esp, 0x11c
push ebx
push esi
xor ebx, ebx
push edi
push ebx
mov esi, ecx
push ebx
push 0x14b
push dword [esi + 0x288]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0xffffffffffffffff
lea ecx, [esi + 0x2b4]
push ebx
call fcn.004ce546
mov dword [ebp - 0x14], ebx
mov eax, dword [0x51f320]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ebx
push str.LoginUserName_d
push eax
call fcn.004ccbe3
mov ax, word [0x527a20]
add esp, 0xc
mov word [ebp - 0x128], ax
xor eax, eax
push 0x40
lea edi, [ebp - 0x126]
pop ecx
mov dword [ebp - 0x20], 0x104
rep stosd dword es:[edi], eax
push 1
lea ecx, [ebp - 0x10]
stosw word es:[edi], ax
pop eax
mov dword [ebp - 0x10], ebx
push ecx
push eax
push ebx
push str.SoftwarePPStream_recent_
push bind
mov dword [ebp - 0x24], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41579a
cmp dword [ebp - 0x10], ebx
je 0x41579a
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x415788
lea eax, [ebp - 0x128]
push eax
call fcn.004723b0
test eax, eax
pop ecx
jbe 0x415788
lea eax, [ebp - 0x128]
lea ecx, [ebp - 0x1c]
push eax
call fcn.004d2cf7
mov eax, dword [esi + 0x2bc]
lea ecx, [esi + 0x2b4]
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 1
push edx
push eax
call fcn.004ce6bb
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 8], ebx
je 0x41577d
push eax
push ebx
push 0x143
push dword [esi + 0x288]
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.004d2c89
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004d2c89
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xa
jl 0x415696
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4157c2
Capabilities:
Set registry value

Disassembly:
mov eax, 0x4de348
call fcn.00471fb4
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
cmp dword [esi + 0x2bc], ebx
jle 0x4158a9
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push 0x20006
push ebx
push str.SoftwarePPStream_recent_
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x415896
cmp dword [ebp - 0x10], ebx
je 0x415896
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
lea ecx, [esi + 0x2b4]
push eax
call fcn.00425552
mov eax, dword [0x51f320]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 1
push str.LoginUserName_d
push eax
call fcn.004ccbe3
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
add esp, 0xc
lea ecx, [ebp - 0x18]
mov eax, dword [eax - 8]
push eax
push ebx
call fcn.004d30b9
push eax
push 1
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.004d3108
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], bl
call fcn.004d2c89
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004d2c89
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi + 0x2bc]
jl 0x4157e5
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4172ca
Capabilities:
Check os version

Disassembly:
mov eax, 0x4de62c
call fcn.00471fb4
sub esp, 0xa0
push esi
mov esi, 0x9c
push esi
lea eax, [ebp - 0xac]
push 0
push eax
call fcn.004721c0
add esp, 0xc
lea eax, [ebp - 0xac]
mov dword [ebp - 0xac], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
jne 0x417322
lea eax, [ebp - 0xac]
mov dword [ebp - 0xac], 0x94
push eax
call esi
test eax, eax
je 0x41737f
cmp dword [ebp - 0xa8], 5
jne 0x41737f
cmp dword [ebp - 0xa4], 1
jne 0x41737f
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x10]
push eax
call fcn.004d2cf7
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004d318b
push str.service_pack_2
push dword [ebp - 0x10]
call fcn.004736d4
pop ecx
test eax, eax
pop ecx
jne 0x417373
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004d2c89
push 1
pop eax
jmp 0x417381
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004d2c89
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x417e21
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x417e44
xor eax, eax
leave
ret
lea eax, [ebp - 4]
push esi
and byte [ebp - 0x108], 0
push eax
lea eax, [ebp - 0x108]
xor esi, esi
push eax
push 0x527a08
push dword [ebp + 8]
mov dword [ebp - 4], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
call fcn.00478520
pop ecx
test eax, eax
pop ecx
jne 0x417e86
push 1
pop esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x418a63
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4de75c
call fcn.00471fb4
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004d92e7
mov esi, dword [eax + 8]
test esi, esi
je 0x418b7f
mov eax, dword [ebp + 8]
push 6
shr eax, 4
inc eax
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x418b7f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push esi
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [ebp - 0x10], 0
mov esi, eax
je 0x418b7f
lea edi, [esi + 2]
lea eax, [edi + edi]
push eax
call fcn.004d31ed
push edi
xor edi, edi
mov ebx, eax
push edi
push ebx
call fcn.004721c0
add esp, 0x10
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, edi
je 0x418b78
mov ecx, dword [ebp + 8]
and ecx, 0xf
jbe 0x418afe
movzx edx, word [eax]
dec ecx
lea eax, [eax + edx*2 + 2]
jne 0x418af4
movzx ecx, word [eax]
cmp ecx, esi
jl 0x418b07
mov ecx, esi
add eax, 2
push ecx
push eax
push ebx
call fcn.00473a7e
mov al, byte [ebp + 0xb]
add esp, 0xc
lea ecx, [ebp - 0x20]
mov word [ebx + esi*2], di
push edi
mov byte [ebp - 0x20], al
call fcn.00404133
lea eax, [ebp - 0x20]
mov dword [ebp - 4], edi
push eax
push 0xffffffffffffffff
push ebx
push 0x3a8
call fcn.004189fa
lea eax, [ebp - 0x20]
push eax
call fcn.0041889a
mov esi, eax
mov eax, dword [ebp - 0x1c]
add esp, 0x14
cmp eax, edi
jne 0x418b56
mov eax, 0x4e9d18
mov ecx, dword [ebp + 0xc]
push eax
call fcn.004d2e12
push ebx
call fcn.004d3216
or dword [ebp - 4], 0xffffffff
pop ecx
push 1
lea ecx, [ebp - 0x20]
call fcn.00404133
mov eax, esi
jmp 0x418b81
push ebx
call fcn.004d3216
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x418d14
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
mov eax, 0x4de780
call fcn.00471fb4
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x18], esi
cmp dword [esi + 4], 0xffffffff
jne 0x418e82
xor ebx, ebx
push ebx
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x418d4e
xor eax, eax
jmp 0x418e87
push edi
lea ecx, [ebp - 0x1c]
push 4
push ecx
push 0x1006
push 0xffff
push eax
mov dword [ebp - 0x1c], 0x2710
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.004d2cf7
mov eax, dword [0x51f320]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], eax
mov edi, dword [ebp + 0xc]
mov byte [ebp - 4], 1
cmp di, bx
jne 0x418dfa
push 0x3a
lea ecx, [ebp - 0x10]
call fcn.004d3150
mov esi, eax
cmp esi, ebx
jle 0x418dec
push esi
lea eax, [ebp + 0xc]
push ebx
push eax
lea ecx, [ebp - 0x10]
call fcn.004cc6b1
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004d2dc2
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.004d2c89
inc esi
lea eax, [ebp + 8]
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.004cc68e
push dword [ebp + 8]
call fcn.00472836
pop ecx
mov edi, eax
lea ecx, [ebp + 8]
call fcn.004d2c89
mov esi, dword [ebp - 0x18]
jmp 0x418e06
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
call fcn.004d2dc2
jmp 0x418de7
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
call fcn.004d2dc2
cmp di, bx
jne 0x418e0e
push 0x50
pop edi
push edi
mov word [ebp - 0x2c], 2
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [ebp - 0x14]
mov word [ebp - 0x2a], ax
pop edi
movsx eax, byte [ecx]
cmp eax, 0x2f
jle 0x418e3c
cmp eax, 0x3a
jge 0x418e3c
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x28], eax
jmp 0x418e53
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
je 0x418e50
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x418e37
mov dword [ebp - 0x28], ebx
lea eax, [ebp - 0x2c]
push 0x10
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
mov esi, eax
lea ecx, [ebp - 0x14]
neg esi
sbb esi, esi
mov byte [ebp - 4], bl
inc esi
call fcn.004d2c89
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004d2c89
jmp 0x418e85
push 1
pop esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x418ec1
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
mov eax, 0x4de79c
call fcn.00471fb4
sub esp, 0x810
mov eax, dword [0x51f320]
push ebx
push edi
xor edi, edi
mov ebx, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x10], edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], 0x50
je 0x418f35
push edi
push dword [ebp + 0x10]
call fcn.00418d14
test eax, eax
je 0x41903e
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.004d2e12
cmp dword [ebp + 0xc], edi
je 0x418f87
push dword [ebp + 0xc]
lea eax, [ebp - 0x81c]
push dword [ebp - 0x10]
push str.POST__s_HTTP_1.1_r_n_s_r_n
push eax
call fcn.0047291d
add esp, 0x10
jmp 0x418f9e
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.004d8961
test eax, eax
je 0x418f14
cmp dword [ebp + 8], 3
jne 0x418f68
push dword [ebp - 0x1c]
mov ecx, ebx
push dword [ebp - 0x14]
call fcn.00418d14
test eax, eax
jne 0x418f14
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004d2c89
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004d2c89
xor eax, eax
jmp 0x419058
push dword [ebp - 0x10]
lea eax, [ebp - 0x81c]
push str.POST__s_HTTP_1.1_r_n_r_n
push eax
call fcn.0047291d
add esp, 0xc
lea eax, [ebp - 0x81c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [sym.imp.WS2_32.dll_send]
cmp eax, edi
mov dword [ebp + 0x10], eax
jle 0x418fe5
mov eax, 0x1000
cmp dword [ebp + 0x10], eax
jg 0x418fc6
mov eax, dword [ebp + 0x10]
push 0
push eax
lea eax, [ebp + edi - 0x81c]
push eax
push dword [ebx + 4]
call esi
test eax, eax
jl 0x418fe5
sub dword [ebp + 0x10], eax
add edi, eax
cmp dword [ebp + 0x10], 0
jg 0x418fb9
mov eax, dword [ebp + 0x18]
xor edi, edi
test eax, eax
mov dword [ebp + 0x10], eax
jle 0x41901b
mov eax, 0x1000
cmp dword [ebp + 0x10], eax
jg 0x418ffe
mov eax, dword [ebp + 0x10]
push 0
push eax
mov eax, dword [ebp + 0x14]
add eax, edi
push eax
push dword [ebx + 4]
call esi
test eax, eax
jl 0x41901b
sub dword [ebp + 0x10], eax
add edi, eax
cmp dword [ebp + 0x10], 0
jg 0x418ff1
cmp dword [ebp + 0x10], 0
pop esi
jne 0x41903b
mov ecx, ebx
call fcn.004191cd
cmp eax, 0x64
mov dword [ebp - 0x18], eax
jne 0x41903b
mov ecx, ebx
call fcn.004191cd
mov dword [ebp - 0x18], eax
mov edi, dword [ebp - 0x18]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004d2c89
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004d2c89
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x14
Function at 0x419068
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
mov eax, 0x4de7b8
call fcn.00471fb4
sub esp, 0x810
mov eax, dword [0x51f320]
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x10], esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], 0x50
je 0x4190dc
push esi
push dword [ebp + 0x10]
call fcn.00418d14
test eax, eax
je 0x4191a3
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.004d2e12
cmp dword [ebp + 0xc], esi
je 0x41912e
push dword [ebp + 0xc]
lea eax, [ebp - 0x81c]
push dword [ebp - 0x10]
push str.GET__s_HTTP_1.1_r_n_s_r_n
push eax
call fcn.0047291d
add esp, 0x10
jmp 0x419145
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.004d8961
test eax, eax
je 0x4190bb
cmp dword [ebp + 0x10], 3
jne 0x41910f
push dword [ebp - 0x1c]
mov ecx, edi
push dword [ebp - 0x14]
call fcn.00418d14
test eax, eax
jne 0x4190bb
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004d2c89
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004d2c89
xor eax, eax
jmp 0x4191bd
push dword [ebp - 0x10]
lea eax, [ebp - 0x81c]
push str.GET__s_HTTP_1.1_r_n_r_n
push eax
call fcn.0047291d
add esp, 0xc
lea eax, [ebp - 0x81c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
test ebx, ebx
jle 0x419184
mov eax, 0x1000
cmp ebx, eax
jg 0x419164
mov eax, ebx
push 0
push eax
lea eax, [ebp + esi - 0x81c]
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jl 0x419182
add esi, eax
sub ebx, eax
jmp 0x419155
test ebx, ebx
pop ebx
jne 0x4191a0
mov ecx, edi
call fcn.004191cd
cmp eax, 0x64
mov dword [ebp - 0x18], eax
jne 0x4191a0
mov ecx, edi
call fcn.004191cd
mov dword [ebp - 0x18], eax
mov esi, dword [ebp - 0x18]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004d2c89
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004d2c89
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x41bf13
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
mov esi, ecx
lea ecx, [ebp - 4]
push edi
lea eax, [esi + 0x28]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x41c00d
push ebx
lea ebx, [edi + 1]
push ebx
call fcn.004d31ed
push ebx
push 0
push eax
mov dword [esi], eax
call fcn.004721c0
add esp, 0x10
lea eax, [esi + 0x28]
push dword [esi]
push edi
push dword [ebp - 4]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
pop ebx
je 0x41c00d
lea eax, [ebp - 0x38]
mov ecx, esi
push eax
call fcn.0041c047
test eax, eax
je 0x41c00d
mov eax, dword [ebp - 0x30]
mov ecx, eax
mov word [esi + 0xa], ax
mov eax, dword [ebp - 0x2c]
shr ecx, 0x10
mov word [esi + 8], cx
mov ecx, eax
shr ecx, 0x10
mov word [esi + 0xe], ax
mov eax, dword [ebp - 0x28]
mov word [esi + 0xc], cx
mov ecx, eax
shr ecx, 0x10
mov word [esi + 0x12], ax
mov eax, dword [ebp - 0x24]
mov word [esi + 0x10], cx
mov ecx, eax
mov word [esi + 0x16], ax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x24], eax
lea eax, [esi + 0x230]
shr ecx, 0x10
mov word [esi + 0x14], cx
push eax
push 0x51af88
mov ecx, esi
call fcn.0041c087
lea eax, [esi + 0x640]
mov ecx, esi
push eax
push 0x51af78
call fcn.0041c087
lea eax, [esi + 0x438]
mov ecx, esi
push eax
push 0x51af6c
call fcn.0041c087
push 1
pop eax
jmp 0x41c00f
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x41c800
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov byte [ebp - 1], bl
cmp dword [esi + 0x4c], ebx
je 0x41c832
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x64
push dword [esi + 0x4c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41c82d
mov byte [ebp - 1], 1
cmp dword [esi + 0x4c], ebx
jne 0x41c836
mov byte [ebp - 1], 1
cmp byte [ebp - 1], bl
je 0x41c856
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push esi
push 0x41dd3a
push ebx
push ebx
call fcn.00473165
add esp, 0x18
mov dword [esi + 0x4c], eax
pop esi
pop ebx
leave
ret
Function at 0x41c85a
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov eax, 0x4deb00
call fcn.00471fb4
sub esp, 0x58
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0xc], bl
je 0x41c879
xor eax, eax
jmp 0x41c9a7
push edi
mov edi, 0x527a08
lea ecx, [esi + 0xc4]
push edi
call fcn.004d2e12
lea ecx, [esi + 0xc8]
push edi
call fcn.004d2e12
lea ecx, [ebp - 0x64]
call fcn.00428064
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], ebx
call fcn.004281b7
test eax, eax
je 0x41c8bd
lea eax, [ebp - 0x38]
lea ecx, [esi + 0xc4]
push eax
call fcn.004d2dc2
lea ecx, [ebp - 0x64]
call fcn.0042823d
test eax, eax
je 0x41c8d8
lea eax, [ebp - 0x38]
lea ecx, [esi + 0xc8]
push eax
call fcn.004d2dc2
push ebx
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
lea ecx, [ebp - 0x10]
push 4
push ecx
push 0x1006
push 0xffff
push eax
mov dword [esi + 8], eax
mov dword [ebp - 0x10], 0xbb8
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [ebp - 0x24]
pop edi
push edi
push ebx
push eax
call fcn.004721c0
add esp, 0xc
mov word [ebp - 0x24], 2
push 0x76c
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x24]
push edi
push eax
push dword [esi + 8]
mov dword [ebp - 0x20], ebx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x41c977
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
call esi
push eax
push str.Error_in_bind:
push 0x52a720
call fcn.0041e2ec
pop ecx
pop ecx
mov ecx, eax
call fcn.0041e06a
mov esi, eax
push 0xa
mov ecx, esi
call fcn.0041e191
mov ecx, esi
call fcn.004858a4
jmp 0x41c998
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_getsockname]
push 1
mov ecx, esi
pop ebx
mov byte [esi + 0xc], bl
call fcn.0041c800
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.00428110
mov eax, ebx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41c868
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov eax, 0x4deb00
call fcn.00471fb4
sub esp, 0x58
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0xc], bl
je 0x41c879
xor eax, eax
jmp 0x41c9a7
push edi
mov edi, 0x527a08
lea ecx, [esi + 0xc4]
push edi
call fcn.004d2e12
lea ecx, [esi + 0xc8]
push edi
call fcn.004d2e12
lea ecx, [ebp - 0x64]
call fcn.00428064
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], ebx
call fcn.004281b7
test eax, eax
je 0x41c8bd
lea eax, [ebp - 0x38]
lea ecx, [esi + 0xc4]
push eax
call fcn.004d2dc2
lea ecx, [ebp - 0x64]
call fcn.0042823d
test eax, eax
je 0x41c8d8
lea eax, [ebp - 0x38]
lea ecx, [esi + 0xc8]
push eax
call fcn.004d2dc2
push ebx
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
lea ecx, [ebp - 0x10]
push 4
push ecx
push 0x1006
push 0xffff
push eax
mov dword [esi + 8], eax
mov dword [ebp - 0x10], 0xbb8
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [ebp - 0x24]
pop edi
push edi
push ebx
push eax
call fcn.004721c0
add esp, 0xc
mov word [ebp - 0x24], 2
push 0x76c
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x24]
push edi
push eax
push dword [esi + 8]
mov dword [ebp - 0x20], ebx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x41c977
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
call esi
push eax
push str.Error_in_bind:
push 0x52a720
call fcn.0041e2ec
pop ecx
pop ecx
mov ecx, eax
call fcn.0041e06a
mov esi, eax
push 0xa
mov ecx, esi
call fcn.0041e191
mov ecx, esi
call fcn.004858a4
jmp 0x41c998
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_getsockname]
push 1
mov ecx, esi
pop ebx
mov byte [esi + 0xc], bl
call fcn.0041c800
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.00428110
mov eax, ebx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret