joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b7b3
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
xorps xmm0, xmm0
mov dword [esp + 0x24], edx
mov dword [esp + 0x14], ecx
movlpd qword [esp + 0x18], xmm0
test edi, edi
jne 0x40b87f
mov esi, dword [esp + 0x30]
cmp esi, 0xffffffff
jae 0x40b87f
test edi, edi
jne 0x40b7f6
test esi, esi
jne 0x40b7f6
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
jmp 0x40b859
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
test edi, edi
jne 0x40b80f
cmp esi, 0xffffffff
ja 0x40b80f
mov eax, esi
mov dword [esp + 0x18], esi
jmp 0x40b816
or eax, 0xffffffff
mov dword [esp + 0x18], eax
and dword [esp + 0x30], 0
lea ecx, [esp + 0x30]
push 0
push ecx
mov ecx, dword [esp + 0x1c]
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40b85f
sub esi, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
sbb edi, 0
add ebp, dword [esp + 0x30]
adc ebx, 0
cmp dword [esp + 0x30], eax
jne 0x40b859
mov edx, dword [esp + 0x24]
test edi, edi
ja 0x40b80f
jb 0x40b859
test esi, esi
jne 0x40b7fe
mov eax, ebp
mov edx, ebx
jmp 0x40b88c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ecx, eax
call fcn.0040b030
test eax, eax
je 0x40b887
call esi
mov ecx, eax
call fcn.0040b030
mov ecx, eax
jmp 0x40b882
push 9
pop ecx
call fcn.00409769
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x40b894
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
xorps xmm0, xmm0
mov dword [esp + 0x24], edx
mov dword [esp + 0x14], ecx
movlpd qword [esp + 0x18], xmm0
test edi, edi
jne 0x40b960
mov esi, dword [esp + 0x30]
cmp esi, 0xffffffff
jae 0x40b960
test edi, edi
jne 0x40b8d7
test esi, esi
jne 0x40b8d7
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
jmp 0x40b93a
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
test edi, edi
jne 0x40b8f0
cmp esi, 0xffffffff
ja 0x40b8f0
mov eax, esi
mov dword [esp + 0x18], esi
jmp 0x40b8f7
or eax, 0xffffffff
mov dword [esp + 0x18], eax
and dword [esp + 0x30], 0
lea ecx, [esp + 0x30]
push 0
push ecx
mov ecx, dword [esp + 0x1c]
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b940
sub esi, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
sbb edi, 0
add ebp, dword [esp + 0x30]
adc ebx, 0
cmp dword [esp + 0x30], eax
jne 0x40b93a
mov edx, dword [esp + 0x24]
test edi, edi
ja 0x40b8f0
jb 0x40b93a
test esi, esi
jne 0x40b8df
mov eax, ebp
mov edx, ebx
jmp 0x40b96d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ecx, eax
call fcn.0040b030
test eax, eax
je 0x40b968
call esi
mov ecx, eax
call fcn.0040b030
mov ecx, eax
jmp 0x40b963
push 9
pop ecx
call fcn.00409769
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x40cf2d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
push 8
mov ecx, edx
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub esi, 1
jne 0x40cf35
mov dword [edx*4 + 0x608c40], ecx
inc edx
cmp edx, 0x100
jb 0x40cf30
mov esi, 0x800
jmp 0x40cf7d
mov ecx, dword [edx*4 + 0x608840]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x608c40]
mov dword [edx*4 + 0x608c40], ecx
inc edx
cmp edx, esi
jb 0x40cf61
mov dword [0x608c38], 0x40cfa0
call fcn.0040d1d8
pop esi
test eax, eax
jne 0x40cf9f
mov dword [0x608c38], 0x40d035
ret
Function at 0x40fc0f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x94
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x8c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0xac]
xor ebx, ebx
push edi
mov edi, dword [esp + 0xb4]
push ecx
push edx
mov edx, ecx
mov dword [esp + 0x28], esi
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
call fcn.00412fd6
pop ecx
pop ecx
test eax, eax
jne 0x40fd6b
mov ebp, dword [esp + 0xb8]
inc eax
mov dword [esp + 0x3c], edi
mov edi, dword [esp + 0xa8]
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov ebx, dword [esp + 0xac]
mov dword [esp + 0x50], ebp
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
and dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x40000
test ebx, ebx
ja 0x40fcb6
jb 0x40fcb2
cmp edi, 0x40000
jae 0x40fcb6
mov dword [esp + 0x10], edi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [esi]
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40fd60
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], eax
mov edx, ebp
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
call fcn.00412cbf
mov ecx, dword [esp + 0x28]
add esp, 0x10
sub dword [esp + 0x10], ecx
mov esi, eax
sub edi, ecx
sbb ebx, 0
test esi, esi
jne 0x40fd60
cmp dword [esp + 0x1c], 1
je 0x40fd53
cmp ebp, dword [esp + 0x4c]
jne 0x40fd2b
mov eax, edi
or eax, ebx
jne 0x40fd2b
cmp dword [esp + 0x1c], 4
je 0x40fd60
test ecx, ecx
jne 0x40fd39
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x4c]
je 0x40fd5d
mov eax, dword [esp + 0x20]
push ecx
push eax
call dword [eax + 4]
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40fd60
mov esi, dword [esp + 0x20]
jmp 0x40fc97
cmp ebp, dword [esp + 0x4c]
jne 0x40fd5d
or edi, ebx
je 0x40fd60
xor esi, esi
inc esi
lea ecx, [esp + 0x28]
call fcn.00412f69
mov eax, esi
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x94
ret
Function at 0x410c9d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebp, ecx
xor ebx, ebx
mov dword [esp + 0xc], ebp
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x410cbf
xor eax, eax
jmp 0x410dca
sub edx, 4
add edx, ebp
mov dword [esp + 0x10], edx
push edi
lea edi, [ebx + ebp]
jmp 0x410cd7
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x410cdb
inc edi
cmp edi, edx
jb 0x410cce
mov ecx, edi
sub ecx, ebx
mov ebx, edi
sub ecx, ebp
sub ebx, ebp
cmp edi, edx
jae 0x410db7
cmp ecx, 2
jbe 0x410d77
xor esi, esi
movzx ebp, byte [edi + 4]
lea eax, [ebp + 1]
test al, 0xfe
jne 0x410da8
movzx eax, byte [edi + 3]
add ebx, 5
shl ebp, 8
or ebp, eax
movzx eax, byte [edi + 2]
shl ebp, 8
or ebp, eax
movzx eax, byte [edi + 1]
shl ebp, 8
or ebp, eax
sub ebp, ebx
mov edx, ebp
test esi, esi
je 0x410d4c
and esi, 6
mov eax, ebp
shl esi, 2
mov ecx, esi
shr eax, cl
inc eax
test al, 0xfe
jne 0x410d4a
mov edx, 0x100
shl edx, cl
dec edx
xor edx, ebp
sub edx, ebx
xor esi, esi
mov ebp, dword [esp + 0x10]
mov eax, edx
shr eax, 8
mov byte [edi + 1], dl
mov byte [edi + 2], al
mov eax, edx
shr edx, 0x18
and dl, 1
shr eax, 0x10
neg dl
mov byte [edi + 3], al
mov byte [edi + 4], dl
mov edx, dword [esp + 0x14]
jmp 0x410cc9
shr esi, cl
test esi, esi
je 0x410cf8
cmp esi, 4
ja 0x410d9d
cmp esi, 3
je 0x410d9d
mov eax, esi
shr eax, 1
movzx eax, byte [eax + edi + 1]
inc eax
test al, 0xfe
jne 0x410cf8
or esi, 8
shr esi, 1
inc ebx
jmp 0x410cc9
mov ebp, dword [esp + 0x10]
or esi, 8
shr esi, 1
inc ebx
jmp 0x410cc9
xor eax, eax
shr esi, cl
cmp ecx, 2
pop edi
cmova esi, eax
mov eax, dword [esp + 0x1c]
mov dword [eax], esi
mov eax, ebx
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x414040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ecx
mov dword [esp + 4], edx
push ebx
push ebp
push esi
push edi
cmp ecx, 0x80
jae 0x414068
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x414107
lea eax, [ecx + 0x20]
mov dword [edx], eax
jmp 0x414109
mov eax, ecx
shr eax, 8
xor eax, ecx
cmp ecx, 0xffff
ja 0x414146
movzx edi, al
movzx ebx, cx
mov dword [esp + 0x10], ebx
xor ebx, ebx
mov esi, ebx
movzx ebp, byte [edi*8 + 0x560764]
test ebp, ebp
je 0x4140b1
mov eax, dword [edi*8 + 0x560760]
mov edx, dword [esp + 0x10]
cmp word [eax], dx
mov edx, dword [esp + 0x14]
je 0x414113
inc esi
add eax, 4
cmp esi, ebp
jl 0x41409c
mov esi, edi
mov eax, ebx
and esi, 0xf
movzx ebp, byte [esi*8 + 0x5619d4]
test ebp, ebp
je 0x4140e0
mov esi, dword [esi*8 + 0x5619d0]
mov edx, dword [esp + 0x10]
cmp word [esi], dx
mov edx, dword [esp + 0x14]
je 0x41411c
inc eax
add esi, 6
cmp eax, ebp
jl 0x4140cb
and edi, 3
movzx esi, byte [edi*8 + 0x561714]
test esi, esi
je 0x414107
mov eax, dword [edi*8 + 0x561710]
mov ebp, dword [esp + 0x10]
cmp word [eax], bp
je 0x41412e
inc ebx
add eax, 8
cmp ebx, esi
jl 0x4140fa
mov dword [edx], ecx
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
movzx eax, word [eax + 2]
jmp 0x414061
movzx eax, word [esi + 2]
mov dword [edx], eax
movzx eax, word [esi + 4]
mov dword [edx + 4], eax
push 2
pop eax
jmp 0x41410c
movzx ecx, word [eax + 2]
mov dword [edx], ecx
movzx ecx, word [eax + 4]
mov dword [edx + 4], ecx
movzx ecx, word [eax + 6]
mov dword [edx + 8], ecx
push 3
jmp 0x41412b
movzx eax, al
xor esi, esi
and eax, 0xf
movzx edi, byte [eax*8 + 0x5612d4]
test edi, edi
je 0x414107
mov eax, dword [eax*8 + 0x5612d0]
cmp dword [eax], ecx
je 0x41416f
inc esi
add eax, 8
cmp esi, edi
jl 0x414161
jmp 0x414107
mov eax, dword [eax + 4]
jmp 0x414061

Function at 0x415b75
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
movzx eax, dl
xor eax, esi
push 8
movzx edi, al
pop ebx
mov edx, edi
mov ecx, edi
shr edx, 1
mov eax, edx
mov edi, edx
xor eax, 0xedb88320
test cl, 1
cmovne edi, eax
sub ebx, 1
jne 0x415b85
shr esi, 8
xor esi, edi
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x415baa
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi]
call fcn.00415b75
mov ecx, dword [esi + 8]
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 4], eax
mov dl, byte [esi + 7]
call fcn.00415b75
mov dword [esi + 8], eax
pop esi
ret
Function at 0x415bd6
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
push dword [esp + 0x2c]
mov ebx, ecx
mov ebp, edx
push dword [esp + 0x2c]
push ebp
mov eax, dword [ebx + 4]
push eax
call dword [eax + 8]
mov ecx, dword [ebx]
add esp, 0x10
mov esi, eax
mov edi, edx
test byte [ecx + 0x2c], 1
je 0x415c6e
test edi, edi
jl 0x415c6e
jg 0x415c0a
test esi, esi
je 0x415c6e
xorps xmm0, xmm0
lea ecx, [ebx + 0x14]
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], eax
movzx eax, word [ecx + 8]
or eax, 2
mov ebx, eax
xor ebx, 1
imul ebx, eax
sar ebx, 8
xor bl, byte [ebp]
mov dl, bl
call fcn.00415baa
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
add eax, 1
mov byte [ebp], bl
adc ecx, 0
mov dword [esp + 0x10], eax
inc ebp
mov dword [esp + 0x18], ecx
cmp ecx, edi
mov ecx, dword [esp + 0x1c]
jl 0x415c2a
jg 0x415c6e
cmp eax, esi
jb 0x415c2a
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x415c7a
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebp
mov ebp, ecx
mov dword [esp + 8], edx
push esi
mov dword [esp + 0x10], ebp
mov eax, dword [ebp]
lea esi, [ebp + 0x14]
test byte [eax + 0x2c], 8
je 0x415c9d
mov eax, dword [eax + 0x50]
shr eax, 8
jmp 0x415ca1
movzx eax, byte [eax + 0x33]
push ebx
push edi
mov edi, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov dword [esi], 0x12345678
mov dword [esi + 4], 0x23456789
mov dword [esi + 8], 0x34567890
jmp 0x415ccb
mov dl, al
mov ecx, esi
call fcn.00415baa
inc edi
mov al, byte [edi]
test al, al
jne 0x415cc1
mov ebp, dword [esp + 0x14]
xor edi, edi
movzx eax, word [esi + 8]
mov ecx, esi
or eax, 2
mov ebx, eax
xor ebx, 1
imul ebx, eax
sar ebx, 8
xor bl, byte [edi + ebp]
mov dl, bl
call fcn.00415baa
inc edi
cmp edi, 0xc
jl 0x415cd7
cmp bl, byte [esp + 0x10]
mov ebp, dword [esp + 0x18]
pop edi
pop ebx
je 0x415d13
push 0x1c
pop ecx
call fcn.00409769
xor eax, eax
jmp 0x415d25
push 0xc
lea ecx, [ebp + 0x20]
push esi
push ecx
call fcn.0051c650
xor eax, eax
add esp, 0xc
inc eax
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x41d76b
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x198], eax
push esi
lea eax, [esp + 8]
mov esi, ecx
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x41d81f
mov ecx, dword [esp + 8]
cmp cl, 2
jne 0x41d7af
mov eax, ecx
shr eax, 8
test al, al
je 0x41d7bc
cmp cl, 1
jne 0x41d819
shr ecx, 8
cmp cl, 1
jne 0x41d819
push 0
xor edx, edx
mov ecx, esi
call fcn.00458723
push 0
mov edx, 0x6038e0
mov ecx, esi
call fcn.0045a5b0
mov edx, str._VERSION
mov ecx, esi
call fcn.00458389
mov edx, str.LuaSocket_3.1.0
mov ecx, esi
call fcn.00458389
mov eax, dword [esi + 0xc]
mov ecx, esi
push 2
sub eax, 0x20
push eax
push 0xfffffffffffffffd
pop edx
call fcn.00458a25
mov ecx, dword [esp + 0x1ac]
add esp, 0x10
xor eax, eax
inc eax
pop esi
xor ecx, esp
call fcn.0051b034
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov edx, str.unable_to_initialize_library
mov ecx, esi
call fcn.00458389
mov ecx, esi
call fcn.00459088
int3

Function at 0x41f876
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xdc
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0xd8], eax
push esi
lea eax, [esp + 4]
mov dword [esp + 4], 0x80
push eax
lea eax, [esp + 0xc]
mov esi, ecx
push eax
push dword [edx]
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jns 0x41f8d8
mov eax, dword [esi + 0xc]
mov byte [eax + 8], 0
add dword [esi + 0xc], 0x10
call fcn.0052d3fe
mov ecx, dword [eax]
call fcn.004206c0
mov edx, eax
mov ecx, esi
call fcn.00458389
push 2
jmp 0x41f97e
push 0xa
push 6
lea eax, [esp + 0x90]
push eax
push 0x41
lea eax, [esp + 0xa0]
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x41f915
mov ecx, dword [esi + 0xc]
mov byte [ecx + 8], 0
mov ecx, eax
add dword [esi + 0xc], 0x10
call fcn.0041d868
jmp 0x41f8c8
lea edx, [esp + 0x90]
mov ecx, esi
call fcn.00458389
push 0xa
lea eax, [esp + 0x8c]
push 0
push eax
call fcn.0052d243
mov ecx, dword [esi + 0xc]
add esp, 0xc
cdq
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], edx
mov byte [ecx + 8], 3
add dword [esi + 0xc], 0x10
sub eax, 0
je 0x41f970
dec eax
sub eax, 1
je 0x41f969
sub eax, 0x15
je 0x41f962
mov edx, str.unknown
jmp 0x41f975
mov edx, str.inet6
jmp 0x41f975
mov edx, str.inet
jmp 0x41f975
mov edx, str.unspec
mov ecx, esi
call fcn.00458389
push 3
mov ecx, dword [esp + 0xe0]
pop eax
pop esi
xor ecx, esp
call fcn.0051b034
mov esp, ebp
pop ebp
ret
Function at 0x41f992
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xdc
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0xd8], eax
push esi
lea eax, [esp + 4]
mov dword [esp + 4], 0x80
push eax
lea eax, [esp + 0xc]
mov esi, ecx
push eax
push dword [edx]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jns 0x41f9f4
mov eax, dword [esi + 0xc]
mov byte [eax + 8], 0
add dword [esi + 0xc], 0x10
call fcn.0052d3fe
mov ecx, dword [eax]
call fcn.004206c0
mov edx, eax
mov ecx, esi
call fcn.00458389
push 2
jmp 0x41fa9a
push 0xa
push 6
lea eax, [esp + 0x90]
push eax
push 0x41
lea eax, [esp + 0xa0]
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x41fa31
mov ecx, dword [esi + 0xc]
mov byte [ecx + 8], 0
mov ecx, eax
add dword [esi + 0xc], 0x10
call fcn.0041d868
jmp 0x41f9e4
lea edx, [esp + 0x90]
mov ecx, esi
call fcn.00458389
push 0xa
lea eax, [esp + 0x8c]
push 0
push eax
call fcn.0052d243
mov ecx, dword [esi + 0xc]
add esp, 0xc
cdq
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], edx
mov byte [ecx + 8], 3
add dword [esi + 0xc], 0x10
sub eax, 0
je 0x41fa8c
dec eax
sub eax, 1
je 0x41fa85
sub eax, 0x15
je 0x41fa7e
mov edx, str.unknown
jmp 0x41fa91
mov edx, str.inet6
jmp 0x41fa91
mov edx, str.inet
jmp 0x41fa91
mov edx, str.unspec
mov ecx, esi
call fcn.00458389
push 3
mov ecx, dword [esp + 0xe0]
pop eax
pop esi
xor ecx, esp
call fcn.0051b034
mov esp, ebp
pop ebp
ret
Function at 0x4202f1
Capabilities:
Get socket status

Disassembly:
sub esp, 0x330
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x32c], eax
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov ecx, dword [esp + 0x340]
mov ebx, edx
push edi
xor edi, edi
and dword [esp + 0x10], edi
and dword [esp + 0x14], edi
movsd xmm0, qword [ecx]
ucomisd xmm0, qword [0x5b1fd8]
lahf
test ah, 0x44
jnp 0x420406
xor edx, edx
inc edx
test dl, bl
je 0x420354
mov eax, dword [esi]
lea edi, [esp + 0x128]
mov dword [esp + 0x12c], eax
mov dword [esp + 0x128], edx
test bl, 2
je 0x420370
mov eax, dword [esi]
lea ebp, [esp + 0x230]
mov dword [esp + 0x234], eax
mov dword [esp + 0x230], edx
test bl, 6
je 0x420387
mov eax, dword [esi]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x20], edx
mov dword [esp + 0x10], eax
call fcn.00420c4d
movaps xmm1, xmm0
comisd xmm1, xmmword [0x5b1fd8]
jb 0x4203c3
cvttsd2si eax, xmm1
mov dword [esp + 0x18], eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, qword [0x5b20a0]
cvttsd2si eax, xmm1
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
jmp 0x4203c7
mov eax, dword [esp + 0x14]
push eax
push dword [esp + 0x14]
push ebp
push edi
push 0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x4203e3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x420409
test eax, eax
je 0x420406
cmp ebx, 6
jne 0x420402
lea eax, [esp + 0x20]
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
neg eax
sbb eax, eax
and eax, 0xfffffffe
jmp 0x420409
xor eax, eax
jmp 0x420409
or eax, 0xffffffff
mov ecx, dword [esp + 0x33c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x330
ret

Function at 0x42043c
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
cmp dword [esi], 0xffffffff
jne 0x420452
push 0xfffffffffffffffe
pop eax
jmp 0x4204d8
push dword [ebp + 8]
push edx
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x4204d8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x420476
cmp eax, 0x2734
jne 0x4204d8
mov ecx, dword [ebp + 0xc]
movsd xmm0, qword [ecx]
ucomisd xmm0, qword [0x5b1fd8]
lahf
test ah, 0x44
jp 0x420490
or eax, 0xffffffff
jmp 0x4204d8
push ecx
push 6
pop edx
mov ecx, esi
call fcn.004202f1
mov dword [ebp - 4], eax
pop ecx
cmp eax, 0xfffffffe
jne 0x4204d8
push 0xa
mov dword [ebp - 8], 4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x1007
push 0xffff
push dword [esi]
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp dword [ebp - 4], 0
push 0xfffffffffffffffd
pop eax
cmovg eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x4204db
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
and dword [esi], 0
cmp dword [edi], 0xffffffff
jne 0x420515
push 0xfffffffffffffffe
pop eax
jmp 0x42052d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x42052d
push dword [ebp + 0x18]
mov ecx, edi
push 2
pop edx
call fcn.004202f1
pop ecx
test eax, eax
jne 0x42052d
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x4204f6
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x420533
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, edx
push edi
mov edi, ecx
and dword [esi], 0
cmp dword [edi], 0xffffffff
jne 0x42056c
push 0xfffffffffffffffe
pop eax
jmp 0x420588
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x420588
push dword [ebp + 0x18]
mov ecx, edi
push 2
pop edx
call fcn.004202f1
pop ecx
test eax, eax
jne 0x420588
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push ebx
push dword [edi]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jle 0x42054d
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x421bda
Capabilities:
Convert ip address from string

Disassembly:
sub esp, 0x18
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x14], eax
push ebp
push esi
push edi
push 0x14
lea eax, [esp + 0x10]
mov edi, edx
push 0
push eax
mov esi, ecx
call fcn.0051c010
add esp, 0xc
mov ecx, esi
push 3
pop ebp
mov edx, ebp
call fcn.00457f85
push 5
pop edx
cmp eax, edx
jne 0x421ce0
push ebx
mov edx, str.multiaddr
mov ecx, esi
call fcn.00458389
mov edx, ebp
mov ecx, esi
call fcn.0045854f
or ebx, 0xffffffff
mov ecx, esi
mov edx, ebx
call fcn.00457fd5
mov ecx, esi
test eax, eax
je 0x421ced
lea eax, [esp + 0x10]
mov edx, ebx
push eax
push 0
call fcn.0045822c
pop ecx
push eax
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
mov ecx, esi
test eax, eax
jne 0x421c6b
push str.invalid_multiaddr_ip_address
jmp 0x421cf2
mov edx, str.interface
call fcn.00458389
mov edx, ebp
mov ecx, esi
call fcn.0045854f
mov edx, ebx
mov ecx, esi
call fcn.00457f85
test eax, eax
je 0x421cad
mov edx, ebx
mov ecx, esi
call fcn.00457fb4
mov edx, ebx
mov ecx, esi
test eax, eax
je 0x421cd9
push 0
call fcn.00458171
pop ecx
call fcn.0054ebd0
mov dword [esp + 0x20], eax
push 0x14
lea eax, [esp + 0x14]
mov edx, edi
push eax
push dword [esp + 0x38]
mov ecx, esi
push 0x29
call fcn.00421d49
mov ecx, dword [esp + 0x34]
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0051b034
add esp, 0x18
ret
push str.number_interface_field_expected
jmp 0x421cf4
call fcn.00457fac
push eax
mov ecx, esi
call fcn.004202bf
push str.string_multiaddr_field_expected
mov edx, ebp
call fcn.00459727
int3
Function at 0x421d49
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
push dword [ebp + 0x14]
mov esi, ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edx]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [esi + 0xc]
test eax, eax
jns 0x421d87
mov byte [ecx + 8], 0
mov edx, str.setsockopt_failed
add dword [esi + 0xc], 0x10
mov ecx, esi
call fcn.00458389
push 2
pop eax
jmp 0x421d9e
movsd xmm0, qword [0x5b2018]
xor eax, eax
movsd qword [ecx], xmm0
mov byte [ecx + 8], 0x13
add dword [esi + 0xc], 0x10
inc eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43129c
Capabilities:
Set thread local storage value

Disassembly:
push ecx
push esi
push edi
mov ecx, 0x60ac48
call fcn.0043f578
mov esi, eax
test esi, esi
jne 0x431307
call dword [0x605458]
mov esi, eax
push esi
push dword [0x60ac48]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x43130d
mov eax, dword [esi + 0xc]
mov edx, str._THREAD
mov ecx, esi
mov byte [eax + 8], 0x11
add dword [esi + 0xc], 0x10
call fcn.004588b6
mov edi, 0x60ac5c
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x60ac4c]
mov eax, dword [0x60ac50]
push edi
mov dword [eax + ecx*4], esi
inc ecx
mov dword [0x60ac4c], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ecx
ret
call fcn.00529b17
int3