joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d990
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x28]
mov esi, eax
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x38]
push ecx
push edx
push ebx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x34], esi
mov edi, 1
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40da06
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
pop edi
pop esi
pop ebx
je 0x40da26
mov edx, dword [esp + 0x24]
cmp edx, dword [esp]
jne 0x40da26
mov eax, 1
add esp, 0x18
ret
xor eax, eax
add esp, 0x18
ret

Function at 0x40da30
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x28]
mov esi, eax
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x38]
push ecx
push edx
push ebx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x34], esi
mov edi, 1
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40daa6
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
pop edi
pop esi
pop ebx
je 0x40dac6
mov edx, dword [esp + 0x24]
cmp edx, dword [esp]
jne 0x40dac6
mov eax, 1
add esp, 0x18
ret
xor eax, eax
add esp, 0x18
ret
Function at 0x40e120
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x40e12b
not eax
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x40e15f
mov edx, dword [esp + 4]
push esi
push edi
lea esp, [esp]
movzx edi, byte [edx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x4bd8f8]
dec ecx
inc edx
test ecx, ecx
jne 0x40e140
pop edi
pop esi
not eax
ret
Function at 0x40f030
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push esi
xor esi, esi
cmp eax, esi
jne 0x40f041
xor al, al
pop esi
pop ecx
ret
push ebp
mov ebp, dword [esp + 0x18]
cmp ebp, esi
jne 0x40f05d
push str.Download_new_input_err
call fcn.004168b0
add esp, 4
pop ebp
xor al, al
pop esi
pop ecx
ret
cmp dword [eax + 0x24], esi
jne 0x40f129
cmp dword [ebp + 8], esi
jne 0x40f129
push 8
call fcn.0042ec63
add esp, 4
cmp eax, esi
je 0x40f084
mov dword [eax], esi
mov dword [eax + 4], esi
mov esi, eax
push ebx
push edi
push 0x2d4
push str...p2psrc_srcdown.cpp
push esi
push str.__new:_0x_x__file:__s:_u
call fcn.004166d0
mov edi, dword [esp + 0x28]
add esp, 0x10
lea ebx, [edi + 0xa1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
push 0
push esi
mov dword [esi + 4], eax
mov dword [esi], edi
mov dword [eax + 0x24], ebp
mov eax, dword [esi + 4]
mov ecx, dword [ebp]
push 0x40e270
push 0
push 0
mov dword [eax + 4], ecx
call fcn.00466665
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x24]
mov dword [edx + 0x18], eax
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x24]
push 0x2da
push str...p2psrc_srcdown.cpp
lea eax, [esp + 0x30]
push eax
mov eax, dword [edx + 0x18]
push eax
push str.__thrd:_0x_x:0x_x__file:__s:_u
call fcn.00416770
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x24]
mov eax, dword [edx + 0x18]
add esp, 0x2c
push eax
mov ecx, edi
call fcn.0040e1b0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
pop ebp
mov al, 1
pop esi
pop ecx
ret
push 0x49d2f0
call fcn.004168b0
add esp, 4
pop ebp
xor al, al
pop esi
pop ecx
ret
Function at 0x40f140
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
push esi
test ebp, ebp
je 0x40f2b0
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40f2b0
push edi
mov edi, dword [esp + 0x14]
cmp byte [edi + 0xba0], 0
jne 0x40f189
cmp dword [esi], 0
je 0x40f189
push str.no_use_res
call fcn.004168b0
add esp, 4
pop edi
mov dword [esi + 0x18], 0
pop esi
mov al, 1
pop ebp
pop ecx
ret
push ebx
lea ebx, [edi + 0xa1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 0x24]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x40f1f1
cmp dword [esi + 0x18], 0
je 0x40f1f1
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esi + 0x18]
push eax
mov ecx, edi
call fcn.0040e1e0
mov byte [esp + 0x1c], al
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp byte [esp + 0x1c], 0
jne 0x40f1ea
push str.erase_thread_err
call fcn.004168b0
add esp, 4
pop ebx
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret
mov dword [esi + 0x18], 0
push 8
call fcn.0042ec63
xor esi, esi
add esp, 4
cmp eax, esi
je 0x40f208
mov dword [eax], esi
mov dword [eax + 4], esi
mov esi, eax
push 0x305
push str...p2psrc_srcdown.cpp
push esi
push str.__new:_0x_x__file:__s:_u
call fcn.004166d0
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x20]
mov dword [esi + 4], ebp
mov dword [esi], edi
mov dword [ebp + 0x24], eax
mov edx, dword [eax]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x40e270
push 0
push 0
mov dword [ecx + 4], edx
call fcn.00466665
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x24]
mov dword [edx + 0x18], eax
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x24]
push 0x30b
push str...p2psrc_srcdown.cpp
lea eax, [esp + 0x30]
push eax
mov eax, dword [edx + 0x18]
push eax
push str.__thrd:_0x_x:0x_x__file:__s:_u
call fcn.00416770
mov eax, dword [edi + 0xa88]
add esp, 0x2c
cmp eax, 0x40
jge 0x40f2a1
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x24]
mov ecx, dword [edx + 0x18]
mov dword [edi + eax*4 + 0xa8c], ecx
inc dword [edi + 0xa88]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
pop edi
pop esi
mov al, 1
pop ebp
pop ecx
ret
push str.Download_rep_input_err
call fcn.004168b0
add esp, 4
pop esi
xor al, al
pop ebp
pop ecx
ret
Function at 0x415630
Capabilities:
Create thread

Disassembly:
sub esp, 8
cmp dword [0x4bdcfc], 0
jne 0x41567b
push 0x4bdd04
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x4bdcfc], 0
jne 0x41565e
cmp dword [0x4bdd00], 0
je 0x41565e
call fcn.00415820
push 0x4bdd04
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x4bdcfc], 0
jne 0x41567b
mov eax, 0xffffff3a
add esp, 8
ret
mov eax, dword [0x4bdcf8]
mov ecx, 0x49c858
add eax, 0x56
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4156a8
test dl, dl
je 0x4156a4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4156a8
add eax, 2
add ecx, 2
test dl, dl
jne 0x415688
xor eax, eax
jmp 0x4156ad
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4156b5
add esp, 8
ret
mov ecx, dword [esp + 0x10]
push esi
lea eax, [esp + 8]
push eax
push 0
push ecx
push 0x4155e0
push 0
push 0
call fcn.00466665
push 0x1cb
push str...p2psrc_srcinterface.cpp
lea edx, [esp + 0x28]
push edx
mov esi, eax
push esi
push str.__thrd:_0x_x:0x_x__file:__s:_u
call fcn.00416770
add esp, 0x2c
cmp dword [esp + 0x10], 0
je 0x41573f
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x415713
mov dword [esp + 4], eax
push 0x1d2
push str...p2psrc_srcinterface.cpp
push esi
push str.__handle_cls:_0x_x__file:__s:_u
call fcn.00416770
add esp, 0x10
test esi, esi
je 0x415736
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret
push 0x1d5
push str...p2psrc_srcinterface.cpp
push esi
push str.__handle_cls:_0x_x__file:__s:_u
call fcn.00416770
add esp, 0x10
test esi, esi
je 0x415762
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x415820
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x495fee
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x4bc4a0]
xor eax, esp
mov dword [esp + 0x198], eax
push esi
mov eax, dword [0x4bc4a0]
xor eax, esp
push eax
lea eax, [esp + 0x1a4]
mov dword fs:[0], eax
push 0
call fcn.00466966
push eax
call fcn.0046862c
add esp, 8
call fcn.0040de10
call fcn.0040e090
call fcn.0042d150
call fcn.0042d320
lea eax, [esp + 0x10]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x415897
xor eax, eax
jmp 0x415a27
mov ecx, dword [0x4bdcf8]
add ecx, 0x35
push ecx
call fcn.0040dad0
mov edx, dword [0x4bdcf8]
add edx, 0x56
push edx
call fcn.00418060
add esp, 8
test eax, eax
jne 0x4158e0
mov eax, dword [0x4bdcf8]
mov ecx, dword [0x49c858]
add eax, 0x56
mov dword [eax], ecx
mov edx, dword [0x49c85c]
mov dword [eax + 4], edx
mov cx, word [0x49c860]
mov word [eax + 8], cx
mov edx, dword [0x4bdcf8]
add edx, 0x6a
push edx
call fcn.0041dd00
push 0x88
call fcn.0042ec63
add esp, 8
mov dword [esp + 0xc], eax
mov dword [esp + 0x1ac], 0
test eax, eax
je 0x415918
mov ecx, eax
call fcn.00423430
jmp 0x41591a
xor eax, eax
mov ecx, dword [0x4bdcf8]
mov dword [ecx + 0x280], eax
mov edx, dword [0x4bdcf8]
mov eax, dword [edx + 0x280]
push 0x86
push str...p2psrc_srcinterface.cpp
push eax
push str.__new:_0x_x__file:__s:_u
mov dword [esp + 0x1bc], 0xffffffff
call fcn.004166d0
mov eax, dword [0x4bdcf8]
add esp, 0x10
cmp dword [eax + 0x280], 0
je 0x4159b4
mov ecx, dword [eax + 0x280]
call fcn.004247d0
test eax, eax
jne 0x4159b4
mov ecx, dword [0x4bdcf8]
push 0x8b
push str...p2psrc_srcinterface.cpp
push ecx
push str.__del:_0x_x__file:__s:_u
call fcn.004166d0
mov ecx, dword [0x4bdcf8]
add esp, 0x10
test ecx, ecx
je 0x4159b4
mov esi, ecx
call fcn.004298c0
push esi
call fcn.0042ec92
add esp, 4
mov dword [0x4bdcf8], 0
mov dword [0x4bdcfc], 1
call fcn.00429e60
push 1
push 0
call fcn.00415630
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x41dc60
push 0
push 0
call fcn.00466665
push 0x99
mov esi, eax
push str...p2psrc_srcinterface.cpp
lea eax, [esp + 0x30]
push eax
push esi
push str.__thrd:_0x_x:0x_x__file:__s:_u
call fcn.00416770
push 0x9a
push str...p2psrc_srcinterface.cpp
push esi
push str.__handle_cls:_0x_x__file:__s:_u
call fcn.00416770
add esp, 0x44
test esi, esi
je 0x415a22
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0x1a4]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.00466555
add esp, 0x1a8
ret
Function at 0x416600
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ecx
cmp byte [0x4bde3c], 0
jne 0x416617
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop ecx
ret
cmp byte [0x4bdd38], 0
je 0x4166c4
push esi
push edi
push 0x4bdd20
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push 0x4bdd38
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x416677
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push 0x4bdd38
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4166b7
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x10]
mov eax, edx
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x416690
push 0
lea ecx, [esp + 0xc]
push ecx
sub eax, edi
push eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4bdd20
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ecx
ret

Function at 0x416a80
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x4177e0
Capabilities:
Create thread
Resolve dns
Terminate thread

Disassembly:
sub esp, 0x8c
mov eax, dword [0x4bc4a0]
xor eax, esp
mov dword [esp + 0x88], eax
push edi
mov edi, dword [esp + 0x94]
lea edx, [esp + 9]
mov byte [esp + 8], 0
mov byte [esp + 9], 0
mov eax, edi
sub edx, edi
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x417810
push esi
lea eax, [esp + 8]
push eax
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x4177c0
push 0
push 0
call fcn.00466665
add esp, 0x18
mov esi, eax
push 0x9c4
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x417860
push str.gethostbyname_timeout
call fcn.004168b0
add esp, 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0xc], 0
pop esi
je 0x41788c
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
pop edi
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00466555
add esp, 0x8c
ret
mov ecx, dword [esp + 0x8c]
pop edi
xor ecx, esp
xor eax, eax
call fcn.00466555
add esp, 0x8c
ret
Function at 0x4178b0
Capabilities:
Connect socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x4bc4a0]
xor eax, esp
mov dword [esp + 0x130], eax
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, 2
push ecx
mov word [esp + 0x130], ax
call dword [sym.imp.WS2_32.dll_htons]
mov ebx, dword [sym.imp.WS2_32.dll_inet_addr]
push edi
mov word [esp + 0x132], ax
call ebx
push edi
cmp eax, 0xffffffff
jne 0x417923
call fcn.004177e0
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x417a48
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0x130], ecx
jmp 0x41792e
call ebx
mov dword [esp + 0x130], eax
xor ebx, ebx
mov dword [esp + 0x14], 1
mov dword [esp + 0xc], ebx
lea ebx, [ebx]
mov edx, dword [ebp + 0x14]
cmp dword [edx], ebx
jne 0x417a07
push ebx
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x417a48
lea ecx, [esp + 0x14]
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x417a48
mov eax, dword [esi]
push 0x10
lea edx, [esp + 0x130]
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
xor edi, edi
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], ebx
jne 0x4179cb
mov edx, dword [esi]
mov eax, 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push ebx
lea ecx, [esp + 0x28]
push ecx
push ebx
push ebx
mov dword [esp + 0x38], edx
mov dword [esp + 0x30], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x417a07
inc edi
cmp edi, 5
jl 0x417990
mov edx, dword [esi]
push 0x8e
push str...p2psrc_src_net.cpp
push edx
push str.__sock_cls:_0x_x__file:__s:_u
call fcn.00416770
mov eax, dword [esi]
add esp, 0x10
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esp + 0xc]
mov dword [esi], ebx
cmp eax, 2
je 0x417a48
inc eax
cmp eax, 3
mov dword [esp + 0xc], eax
jl 0x417940
mov edx, dword [esi]
lea ecx, [esp + 0x10]
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x417a60
mov eax, dword [esi]
push 0x98
push str...p2psrc_src_net.cpp
push eax
push str.__sock_cls:_0x_x__file:__s:_u
call fcn.00416770
mov ecx, dword [esi]
add esp, 0x10
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.00466555
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00466555
mov esp, ebp
pop ebp
ret
Function at 0x417a80
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x417b4e
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x417b4e
xor ebx, ebx
cmp dword [eax], ebx
jne 0x417b45
mov eax, dword [ebp + 0x10]
sub eax, ebx
test eax, eax
jle 0x417b45
mov edi, eax
cmp edi, 0x100
jle 0x417aca
mov edi, 0x100
xor esi, esi
lea esp, [esp]
mov eax, dword [ebp + 0x18]
cmp dword [eax], 0
jne 0x417b45
mov ecx, dword [ebp + 8]
mov eax, 1
lea edx, [esp + 0x10]
push edx
push 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x20]
push eax
push 0
push 0
mov dword [esp + 0x30], ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x417b1d
inc esi
cmp esi, 0xa
jl 0x417ad0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edi
lea eax, [ebx + edx]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x417b45
mov edx, dword [ebp + 0x18]
add ebx, eax
cmp dword [edx], 0
je 0x417aae
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417b90
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x417c78
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x417c78
cmp dword [eax], 0
mov dword [esp + 0xc], 0
jne 0x417c6d
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
sub eax, dword [esp + 0xc]
test eax, eax
jle 0x417c6d
mov edi, eax
cmp edi, 0x100
jle 0x417be6
mov edi, 0x100
xor esi, esi
mov eax, dword [ebp + 0x18]
cmp dword [eax], 0
jne 0x417c6d
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
lea edx, [esp + 0x24]
mov eax, 1
push edx
push 0
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x417c34
inc esi
cmp esi, 0x3c
jl 0x417be8
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov ecx, dword [esp + 0xc]
push eax
push edi
add ecx, edx
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x417c6d
mov ecx, dword [ebp + 0x1c]
add dword [esp + 0xc], eax
test ecx, ecx
je 0x417c61
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov eax, dword [ebp + 0x18]
cmp dword [eax], 0
je 0x417bc8
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417c90
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
sub esp, 0x114
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
je 0x417d21
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x417d21
mov ecx, dword [ebp + 0x10]
push ecx
push edi
push eax
call fcn.00466720
add esp, 0xc
mov dword [esp + 0xc], edi
cmp dword [esi], edi
jne 0x417d21
mov ebx, dword [ebp + 8]
jmp 0x417cd0
mov edx, dword [esp + 0xc]
cmp edx, dword [ebp + 0x10]
jge 0x417d21
xor esi, esi
jmp 0x417ce0
mov eax, dword [ebp + 0x18]
cmp dword [eax], 0
jne 0x417d21
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
lea edx, [esp + 0x24]
mov eax, 1
push edx
push 0
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x417d2a
inc esi
cmp esi, 0x3c
jl 0x417ce0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x14]
mov eax, dword [esp + 0xc]
mov ecx, dword [ebp + 0xc]
push edx
push 1
lea esi, [eax + ecx]
push esi
push ebx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
jne 0x417d21
cmp edi, 3
ja case.default.0x417d4c
jmp dword [edi*4 + 0x417d98]
cmp byte [esi], 0xd
jne case.default.0x417d4c
inc edi
jmp 0x417d72
xor eax, eax
cmp byte [esi], 0xa
setne al
dec eax
and eax, 2
mov edi, eax
jmp 0x417d72
cmp byte [esi], 0xa
je 0x417d8b
xor edi, edi
mov ecx, dword [ebp + 0x18]
inc dword [esp + 0xc]
cmp dword [ecx], 0
je 0x417cd0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417db0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
sub esp, 0x114
push ebx
push esi
push edi
test eax, eax
je 0x417ebc
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x417ebc
mov ecx, dword [ebp + 0x10]
push ecx
xor ebx, ebx
push ebx
push eax
call fcn.00466720
add esp, 0xc
cmp dword [esi], ebx
jne 0x417eb3
lea ecx, [ecx]
mov eax, dword [ebp + 0x10]
sub eax, ebx
test eax, eax
jle 0x417eb3
cmp eax, 0x100
mov dword [esp + 0xc], eax
jle 0x417e10
mov dword [esp + 0xc], 0x100
xor edi, edi
mov edx, dword [ebp + 0x18]
cmp dword [edx], 0
jne 0x417eb3
mov esi, dword [ebp + 8]
mov eax, 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
push 0
mov dword [esp + 0x30], esi
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x417e63
inc edi
cmp edi, 0x3c
jl 0x417e12
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x14]
mov eax, dword [esp + 0xc]
mov ecx, dword [ebp + 0xc]
push edx
push eax
lea edx, [ebx + ecx]
push edx
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jle 0x417eb3
mov eax, dword [ebp + 0xc]
lea edi, [ebx + esi]
push edi
push str._r_n_r_n
push eax
call fcn.0040d4a0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x417eb1
mov ecx, dword [ebp + 0x18]
cmp dword [ecx], 0
mov ebx, edi
je 0x417df0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add ebx, esi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417ed0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x417fb5
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x417fb5
cmp dword [eax], 0
mov dword [esp + 0xc], 0
jne 0x417faa
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
sub eax, dword [esp + 0xc]
test eax, eax
jle 0x417faa
mov edi, eax
cmp edi, 0x100
jle 0x417f26
mov edi, 0x100
xor esi, esi
cmp dword [ebp + 0x1c], esi
jle 0x417faa
lea ecx, [ecx]
mov eax, dword [ebp + 0x18]
cmp dword [eax], 0
jne 0x417faa
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
lea edx, [esp + 0x24]
mov eax, 1
push edx
push 0
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x417f7c
inc esi
cmp esi, dword [ebp + 0x1c]
jl 0x417f30
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov ecx, dword [esp + 0xc]
push eax
push edi
add ecx, edx
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x417faa
add dword [esp + 0xc], eax
cmp eax, edi
jne 0x417faa
mov eax, dword [ebp + 0x18]
cmp dword [eax], 0
je 0x417f08
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret