joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4190c0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a3e38
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x601018]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ebx, [esi + 0x38e4]
push ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
mov dword [esp + 0x38], edi
push edi
mov dword [esi + 0xd9d4], edi
call dword [sym.imp.MSVCR100.dll__time64]
add esp, 4
push eax
call dword [sym.imp.MSVCR100.dll_srand]
mov dword [esi + 0x38e0], edi
add esp, 4
lea edi, [esi + 0xd938]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x28]
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esp + 0x14], 0
jne 0x4191ed
cmp dword [esi + 0xdb10], 0
je 0x4191a6
cmp dword [esi + 0xdb14], 0
je 0x4191a6
push 0
lea edx, [esi + 0x43c]
lea ebx, [esi + 0x10]
lea ecx, [esi + 0xd9fc]
call fcn.0042c010
push esi
call fcn.00419d80
push esi
call fcn.0041a090
call fcn.00419010
xor eax, eax
mov dword [esi + 0xdb04], eax
mov dword [esi + 0xdb08], eax
mov dword [esi + 0xdb10], eax
mov dword [esi + 0xdb14], eax
mov byte [esi + 0xdb18], al
jmp 0x4191c4
mov eax, dword [esi + 0xd9f8]
test eax, eax
jne 0x41921b
cmp dword [esi + 0xd9e0], eax
jbe 0x419213
mov eax, esi
call fcn.0041a000
call fcn.00419010
lea ebx, [esi + 0xd938]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [ebx + 0x28]
lea eax, [esi + 0xd938]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x41914b
mov ebx, dword [esp + 0x20]
push esi
call fcn.00418630
push esi
call fcn.00419d80
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x4192a8
cmp dword [esi + 0xd9e0], 1
jae 0x4192a8
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [esp + 0x24]
push ecx
call ebx
test eax, eax
jne 0x419241
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea edx, [esp + 0x14]
push edx
call ebx
test eax, eax
jne 0x419258
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
jmp 0x419260
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
sub ecx, dword [esi + 0xd9e8]
mov edx, dword [0x61023c]
sbb eax, dword [esi + 0xd9ec]
push edx
mov edx, dword [0x610238]
push edx
push eax
push ecx
call fcn.00596bf0
mov ebx, eax
mov eax, dword [esi + 0x187c]
mov ecx, edx
cdq
cmp ecx, edx
jl 0x4192a8
jg 0x419296
cmp ebx, eax
jbe 0x4192a8
mov ecx, esi
call fcn.00418ed0
push esi
call fcn.00419d80
jmp 0x4191c4
cmp dword [esi + 0xd9f8], 0
je 0x4191bf
cmp dword [esi + 0xdb10], 0
je 0x4192cb
cmp dword [esi + 0xdb14], 0
jne 0x4191bf
mov ecx, esi
call fcn.00418700
jmp 0x4191c4
Function at 0x41fc00
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5977b9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x601018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [edi + 4], vtable.PoolBase.0
mov dword [edi + 8], vtable.HeartBase.0
lea esi, [edi + 0x10]
mov dword [edi], vtable.ThreadComponent.0
mov dword [edi + 4], vtable.ThreadComponent.1.0
mov dword [edi + 8], vtable.ThreadComponent.2.0
call fcn.0042af70
lea esi, [edi + 0xc64]
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push ebx
push ebx
push ebx
push ebx
mov dword [edi + 0xc80], esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0xc7c], eax
push ebx
push ebx
push ebx
push ebx
mov dword [edi + 0xc88], esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0xc84], eax
lea esi, [edi + 0xc90]
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x41fca9
mov dword [esi], ebx
mov dword [esi + 4], ebx
lea esi, [edi + 0xc98]
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x41fcbf
mov dword [esi], ebx
mov dword [esi + 4], ebx
lea esi, [edi + 0xcc0]
mov dword [ebp - 0x14], esi
mov dword [esi], ebx
push 8
mov byte [ebp - 4], 7
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
cmp eax, ebx
je 0x41fd8f
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
push 0x404
mov dword [eax], esi
lea ecx, [edi + 0x438]
push ebx
push ecx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
mov dword [edi + 0xc40], eax
mov dword [edi + 0xc44], eax
mov dword [edi + 0xc48], eax
mov dword [edi + 0xc4c], eax
mov dword [edi + 0xc50], eax
mov dword [edi + 0xc54], eax
mov dword [edi + 0xc58], eax
mov dword [edi + 0xc5c], eax
mov dword [edi + 0xc60], eax
mov dword [edi + 0xca0], eax
mov dword [edi + 0xca4], eax
mov dword [edi + 0xca8], eax
mov dword [edi + 0xcac], eax
mov dword [edi + 0xcb0], eax
mov dword [edi + 0xcb4], eax
mov dword [edi + 0xcb8], eax
mov dword [edi + 0xcbc], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x5f190c
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
int3
Function at 0x41fe70
Capabilities:
Create thread

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 0xc60]
cmp eax, 1
jge 0x41fe80
xor eax, eax
push esi
push eax
push 0x41fb90
call dword [sym.imp.MSVCR100.dll__beginthread]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x41fec4
call dword [sym.imp.MSVCR100.dll__errno]
mov eax, dword [eax]
test eax, eax
je 0x41fec4
push ebx
push eax
push str.unable_to_create_new_thread__error___d_
lea ecx, [esi + 0x43c]
push 0x11686
add esi, 0x10
push esi
xor ebx, ebx
call fcn.0042c130
add esp, 0x10
pop ebx
pop esi
ret
inc dword [esi + 0xcb4]
pop esi
ret

Function at 0x420100
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [esi + 0x438]
push edi
lea eax, [esi + 0x840]
push eax
call fcn.00402a60
test eax, eax
je 0x42013b
push 0
push 0x6061f0
push 0x606148
push 0
push eax
call sub.MSVCR100.dll___RTDynamicCast
add esp, 0x14
mov dword [esi + 0x83c], eax
jmp 0x420145
mov dword [esi + 0x83c], 0
mov ecx, dword [esi + 0x83c]
mov dword [esi + 0x14], ecx
lea edx, [esi + 0x10]
push str.start
mov ecx, 1
lea ebx, [esi + 0x43c]
call fcn.0042b270
add esp, 4
cmp dword [esi + 0xc4c], 0
mov dword [ebp - 4], 0
jle 0x4201e4
lea esp, [esp]
mov eax, dword [esi + 0xc60]
cmp eax, 1
jge 0x42018d
xor eax, eax
push esi
push eax
push 0x41fb90
call dword [sym.imp.MSVCR100.dll__beginthread]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4201cf
call dword [sym.imp.MSVCR100.dll__errno]
mov eax, dword [eax]
test eax, eax
je 0x4201cf
push eax
push str.unable_to_create_new_thread__error___d_
lea eax, [esi + 0x10]
push 0x11686
push eax
lea ecx, [esi + 0x43c]
xor ebx, ebx
call fcn.0042c130
add esp, 0x10
jmp 0x4201d5
inc dword [esi + 0xcb4]
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0xc4c]
jl 0x420180
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420710
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
inc dword [ebx + 0xca0]
push esi
push edi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x42073c
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x28], eax
lea eax, [ebx + 0xcc0]
lea edi, [esp + 0x18]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
call fcn.004208e0
mov eax, dword [ebx + 0xcd0]
cmp dword [ebx + 0xcac], eax
jge 0x420774
mov dword [ebx + 0xcac], eax
mov eax, dword [ebx + 0xcb4]
cmp dword [ebx + 0xcb8], eax
jne 0x4207f9
cmp eax, dword [ebx + 0xc48]
jge 0x4207f9
lea esi, [ebx + 0xc90]
call fcn.00503930
mov edi, eax
mov eax, dword [ebx + 0xc50]
mov ecx, edx
cdq
cmp ecx, edx
jl 0x4207f9
jg 0x4207aa
cmp edi, eax
jbe 0x4207f9
mov eax, ebx
call fcn.0041fe70
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x4207c4
xor ecx, ecx
jmp 0x4207cc
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [ebx + 0xcb4]
push edx
mov edx, dword [ebp + 8]
mov dword [esi], ecx
push str.increased_running_threads_to___d_
add ebx, 0x43c
add edx, 0x10
mov ecx, 1
mov dword [esi + 4], eax
call fcn.0042b270
mov ebx, dword [ebp + 8]
add esp, 8
mov eax, dword [ebx + 0xc7c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x425b40
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd4c
mov eax, dword [0x601018]
xor eax, esp
mov dword [esp + 0xd48], eax
mov eax, dword [0x60dd60]
push ebx
push esi
push edi
mov esi, ecx
test eax, eax
je 0x425b6f
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add esi, 0x185c
push esi
mov dword [esp + 0x10], esi
push str._sloader.new
mov esi, 0x400
lea edi, [esp + 0x958]
call fcn.00401880
mov eax, edi
add esp, 8
test eax, eax
je 0x425c9d
cmp byte [esp + 0x950], 0
je 0x425c9d
lea ecx, [esp + 0x10]
push ecx
mov edx, edi
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x425bca
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x425c9d
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
push eax
call ebx
mov eax, dword [esp + 0xc]
push eax
push str._sloader.old
lea edi, [esp + 0x158]
call fcn.00401880
mov ecx, edi
add esp, 8
test ecx, ecx
je 0x425c25
cmp byte [esp + 0x150], 0
je 0x425c25
lea edx, [esp + 0x10]
push edx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x425c14
push eax
call ebx
jmp 0x425c25
push eax
call ebx
lea ecx, [esp + 0x150]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0xc]
push edx
push str._sloader.exe
lea edi, [esp + 0x558]
call fcn.00401880
mov esi, dword [sym.imp.MSVCR100.dll_rename]
mov eax, edi
add esp, 8
test eax, eax
je 0x425c88
cmp byte [esp + 0x550], 0
je 0x425c88
lea ecx, [esp + 0x10]
push ecx
mov edx, edi
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x425c6c
push eax
call ebx
jmp 0x425c88
push eax
call ebx
lea eax, [esp + 0x150]
push eax
lea ecx, [esp + 0x554]
push ecx
call esi
add esp, 8
test eax, eax
jne 0x425c9d
lea edx, [esp + 0x550]
push edx
lea eax, [esp + 0x954]
push eax
call esi
add esp, 8
mov eax, dword [0x60dd60]
test eax, eax
je 0x425cad
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0xd54]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00596083
mov esp, ebp
pop ebp
ret
Function at 0x4270f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ab5e
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [edi + 0x844], 0
je 0x427135
mov dword [edi + 0x1050], 0x610240
jmp 0x42725e
mov esi, dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
push 0x2c
call esi
add esp, 4
mov dword [ebp - 0x414], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x42715b
push eax
call fcn.00504360
jmp 0x42715d
xor eax, eax
mov dword [ebp - 4], 0xffffffff
cmp dword [edi + 0x83c], 0
mov dword [edi + 0x1050], eax
je 0x4271a9
push 8
call esi
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4271a1
mov eax, dword [edi + 0x1050]
mov dword [ebx], vtable.LogImplementation.0
mov dword [ebx + 4], eax
test eax, eax
je 0x427199
push ebx
call fcn.00504490
mov dword [ebx], vtable.LogScreen.0
jmp 0x4271a3
xor ebx, ebx
mov dword [edi + 0x1054], ebx
cmp byte [edi + 0xc48], 0
je 0x42725e
push 0
lea ebx, [edi + 0x848]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test ebx, ebx
jne 0x4271cf
call dword [sym.imp.MSVCR100.dll_abort]
lea eax, [ebp - 0x410]
mov ecx, eax
sub ebx, ecx
lea esp, [esp]
mov cl, byte [ebx + eax]
test cl, cl
je 0x4271f1
mov byte [eax], cl
inc eax
lea edx, [ebp - 0x11]
cmp eax, edx
jb 0x4271e0
mov byte [eax], 0
push 0x400
lea ebx, [edi + 0xc48]
lea eax, [ebp - 0x410]
call fcn.00401570
push 0x478
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
add esp, 8
mov dword [ebp - 0x414], esi
mov dword [ebp - 4], 1
test esi, esi
je 0x42724f
sub esp, 0x1c
lea eax, [ebp - 0x410]
mov ecx, esp
mov dword [ebp - 0x418], esp
call fcn.00402e20
mov eax, dword [edi + 0x1050]
push eax
call fcn.00504a20
jmp 0x427251
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0x1058], eax
push 0
push 0x6061f0
push 0x606148
push 0
push edi
call sub.MSVCR100.dll___RTDynamicCast
push str.start
lea ebx, [edi + 0x434]
lea edx, [edi + 8]
mov ecx, 1
mov dword [edi + 0x1048], eax
mov dword [edi + 0xc], eax
call fcn.0042b270
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596083
mov esp, ebp
pop ebp
ret
Function at 0x42c390
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x540
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 4], eax
test edx, edx
je 0x42c4db
cmp byte [edx], 0
je 0x42c4db
lea eax, [ebp - 0x404]
mov ecx, eax
sub edx, ecx
mov edi, edi
mov cl, byte [edx + eax]
test cl, cl
je 0x42c3d1
mov byte [eax], cl
inc eax
lea ecx, [ebp - 5]
cmp eax, ecx
jb 0x42c3c0
mov byte [eax], 0
cmp byte [ebp - 0x404], 0
lea eax, [ebp - 0x404]
je 0x42c3f2
cmp byte [ebp - 0x403], 0x3a
jne 0x42c3f2
lea eax, [ebp - 0x402]
cmp byte [eax], 0x5c
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_strchr]
jne 0x42c429
cmp byte [eax + 1], 0x5c
jne 0x42c423
add eax, 2
cmp byte [eax], 0
je 0x42c423
push 0x5c
push eax
call ebx
inc eax
add esp, 8
cmp byte [eax], 0
je 0x42c423
push 0x5c
push eax
call ebx
add esp, 8
inc eax
cmp byte [eax], 0x5c
jne 0x42c429
inc eax
cmp byte [eax], 0
push esi
push edi
je 0x42c473
push 0x5c
push eax
call ebx
mov esi, eax
add esp, 8
test esi, esi
je 0x42c441
mov byte [esi], 0
push 0
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x42c464
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0xb7
jne 0x42c486
test esi, esi
je 0x42c473
lea eax, [esi + 1]
mov byte [esi], 0x5c
cmp byte [eax], 0
jne 0x42c430
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00596083
mov esp, ebp
pop ebp
ret
push str.unable_to_create_directory
mov eax, 0xafc9
lea ecx, [ebp - 0x540]
call fcn.005064b0
mov esi, eax
lea eax, [ebp - 0x404]
push eax
push str.directory
push str._s___s_
call fcn.00506600
add esp, 0xc
mov ecx, esi
call fcn.005067d0
lea esi, [ebp - 0x540]
call fcn.00506520
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00596083
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00596083
mov esp, ebp
pop ebp
ret
Function at 0x42ece0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
lea edi, [esi + 8]
push edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ebx, ebx
test eax, eax
jne 0x42ecfd
mov dword [edi], ebx
mov dword [edi + 4], ebx
push 0x18
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x42ed1b
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp - 4]
jmp 0x42ed1d
xor eax, eax
mov dword [esi + 0x10], eax
lea eax, [ebp - 8]
push eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x42ed4c
mov dword [edi], eax
mov dword [edi + 4], ebx
pop edi
mov eax, esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edi], eax
mov dword [edi + 4], ebx
pop edi
mov eax, esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430f70
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a2ed8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x601018]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea eax, [esi + 0xc2c]
mov dword [esp + 0x18], eax
mov eax, dword [eax]
test eax, eax
je 0x430fb9
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x38], 0
mov eax, dword [esi + 0xc34]
mov esi, dword [eax]
cmp esi, eax
je 0x4310c1
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esi + 0x10]
lea eax, [esp + 0x24]
push eax
call ebx
test eax, eax
jne 0x430fed
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x1c]
push ecx
call ebx
test eax, eax
jne 0x431004
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
jmp 0x43100c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
sub ecx, dword [edi + 8]
mov edx, dword [0x61023c]
sbb eax, dword [edi + 0xc]
push edx
mov edx, dword [0x610238]
push edx
push eax
push ecx
call fcn.00596bf0
mov ebx, eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x408]
mov ecx, edx
cdq
cmp ecx, edx
jl 0x43104c
jg 0x431040
cmp ebx, eax
jbe 0x43104c
cmp dword [edi], 0
mov dword [edi + 4], 1
je 0x4310a4
cmp byte [esi + 0x15], 0
jne 0x431092
mov eax, dword [esi + 8]
cmp byte [eax + 0x15], 0
jne 0x431071
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x15], 0
jne 0x431092
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x15], 0
je 0x431065
jmp 0x431092
mov eax, dword [esi + 4]
cmp byte [eax + 0x15], 0
jne 0x431090
lea ebx, [ebx]
cmp esi, dword [eax + 8]
jne 0x431090
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], 0
je 0x431080
mov esi, eax
mov ecx, dword [esp + 0x14]
cmp esi, dword [ecx + 0xc34]
jne 0x430fd1
jmp 0x4310c1
push esi
mov esi, dword [esp + 0x18]
lea edx, [esp + 0x18]
push edx
lea eax, [esi + 0xc30]
push eax
call fcn.004a2050
mov eax, esi
call fcn.00430bf0
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
test eax, eax
je 0x4310d2
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433140
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, edx
push edi
mov edi, dword [ebp + 8]
test esi, esi
jne 0x433170
mov eax, 0x7532
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00596083
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov eax, 2
push ecx
mov word [ebp - 0x18], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x16], ax
mov al, byte [esi]
test al, al
je 0x433217
cmp al, 0x2a
je 0x433217
cmp al, 0x30
jl 0x4331b0
cmp al, 0x39
jg 0x4331b0
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x14], eax
jmp 0x43321e
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
jne 0x4331c7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x433228
cmp word [esi + 0xa], 4
je 0x4331e3
mov eax, 0x7531
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00596083
mov esp, ebp
pop ebp
ret
mov esi, dword [esi + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x433226
lea esp, [esp]
mov edx, dword [eax]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], edx
call fcn.00435940
mov eax, dword [esi + 4]
add esi, 4
test eax, eax
jne 0x4331f0
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00596083
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x18]
call fcn.00435940
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.00596083
mov esp, ebp
pop ebp
ret

Function at 0x433ee0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
test ecx, ecx
jle 0x433f57
cmp dword [esi + 8], 0
jle 0x433f2c
mov eax, 0x431bde83
imul ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 8], eax
imul eax, eax, 0xf4240
sub ecx, eax
mov dword [ebp - 4], ecx
lea eax, [ebp - 8]
push eax
lea ecx, [esi + 0x2018]
push ecx
mov ecx, dword [esi + 0xc]
lea edx, [esi + 0x1014]
push edx
lea eax, [esi + 0x10]
push eax
inc ecx
push ecx
jmp 0x433f76
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
lea ecx, [edx + eax + 1]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esi], 0
mov dword [esi + 4], 0x7530
mov esp, ebp
pop ebp
ret
cmp dword [esi + 8], 0
push 0
jle 0x433f40
lea edx, [esi + 0x2018]
push edx
mov edx, dword [esi + 0xc]
lea eax, [esi + 0x1014]
push eax
lea ecx, [esi + 0x10]
push ecx
inc edx
push edx
call dword [sym.imp.WS2_32.dll_select]
mov dword [esi], eax
test eax, eax
jle 0x433f8d
mov dword [esi + 4], 0
mov esp, ebp
pop ebp
ret
jne 0x433f9a
mov dword [esi + 4], 0x7530
mov esp, ebp
pop ebp
ret
cmp eax, 0xffffffff
jne 0x433fb2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov esp, ebp
pop ebp
ret