joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462640
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6430d0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6ddc7c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x384]
push eax
lea ecx, [ebp - 0x50]
call fcn.004561f0
mov dword [ebp - 4], 0
cmp dword [esi + 0x360], 2
jne 0x462691
xor esi, esi
jmp 0x462778
xor eax, eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
call fcn.0046d120
add eax, 0x28
cmp dword [eax + 0x14], 8
jb 0x4626aa
mov eax, dword [eax]
push 2
push eax
lea eax, [ebp - 0x18]
push 3
push eax
call fcn.00620abb
add esp, 0x10
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
call fcn.00600820
mov edx, dword [esi + 0x35c]
mov ecx, dword [esi + 0x358]
movsd qword [ebp - 0x58], xmm0
call fcn.00600820
mulsd xmm0, qword [0x6bd748]
comisd xmm0, xmmword [ebp - 0x58]
jbe 0x46270c
mov esi, 0x64
jmp 0x462778
call fcn.0046d120
add eax, 0x28
lea ecx, [ebp - 0x38]
push eax
call fcn.004561f0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x38]
cmp dword [ebp - 0x24], 8
lea ecx, [ebp - 0x50]
cmovae edx, dword [ebp - 0x38]
cmp dword [ebp - 0x3c], 8
cmovae ecx, dword [ebp - 0x50]
push ecx
call fcn.0046adc0
mov edx, dword [ebp - 0x24]
add esp, 4
mov esi, eax
cmp edx, 8
jb 0x462778
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46276e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4627ca
push edx
push ecx
call fcn.005ff7fe
add esp, 8
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x4627ae
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4627a4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4627cf
push edx
push ecx
call fcn.005ff7fe
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret
call fcn.0061f5be
call fcn.0061f5be
int3
Function at 0x465790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6435eb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0xb8
mov eax, dword [0x6ddc7c]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov edi, dword [ebx + 0xc]
mov dword [ebp - 0x38], edi
mov dword [ebp - 4], 0
cmp dword [edi], 0xc8
je 0x4657fe
lea ecx, [ebp - 0x38]
call fcn.004524e0
mov eax, 0x80004005
jmp 0x465966
push 0x74
lea eax, [ebp - 0xc8]
mov byte [ebp - 4], 1
push 0
push eax
call fcn.00617280
add esp, 0xc
lea ecx, [ebp - 0xc8]
call fcn.0056da80
xorps xmm0, xmm0
mov byte [ebp - 4], 2
push 0
lea ecx, [ebp - 0x50]
movq qword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x50], xmm0
call fcn.00568580
mov byte [ebp - 4], 3
cmp dword [edi + 0x14], 0
je 0x46593b
push 0
lea eax, [ebp - 0x50]
push eax
lea eax, [edi + 4]
push eax
lea ecx, [ebp - 0xc8]
call fcn.0056f3d0
test al, al
je 0x46593b
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x74617473
push eax
lea ecx, [ebp - 0x50]
mov word [ebp - 0x20], 0x7375
mov byte [ebp - 0x1e], 0
call fcn.005690e0
mov ecx, eax
call fcn.0056c680
test al, al
jne 0x46593b
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x50]
call fcn.005690e0
mov ecx, eax
call fcn.0056ab80
cmp eax, 1
jne 0x46593b
push dword [esi + 0x278]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xea
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0x268]
test eax, eax
je 0x4658eb
push 0
push 0
push 0x5c8
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [esi + 0x268], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x61746164
push eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 0x28], 0
call fcn.005690e0
mov edi, eax
call fcn.004b3ce0
push edi
mov ecx, eax
call fcn.004b3db0
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x6564726f
push eax
lea ecx, [ebp - 0x50]
mov word [ebp - 0x30], 0x72
call fcn.005690e0
push eax
mov ecx, esi
call fcn.00464900
push 2
mov ecx, esi
call fcn.00467e70
lea ecx, [ebp - 0x50]
call fcn.00568a20
lea ecx, [ebp - 0xc8]
call fcn.0045ba50
jmp 0x46595c
lea ecx, [ebp - 0x38]
call fcn.004524e0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005ff7bd
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x469b00
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [0x6ddc7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 8]
test eax, eax
je 0x469cc1
cmp dword [eax + 4], 0
je 0x469cc1
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00617280
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.0046d120
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x838]
mov dword [ebp - 0x838], 0
push eax
push 0x69e45c
push 1
push 0
push 0x69e47c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x469cbb
mov ecx, dword [ebp - 0x838]
test ecx, ecx
je 0x469cbb
mov eax, dword [ecx]
lea edx, [ebp - 0x210]
push edx
push ecx
call dword [eax + 0x50]
push 0x20a
lea eax, [ebp - 0x41c]
push 0
push eax
call fcn.00617280
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push 0x105
push eax
call fcn.006210ee
add esp, 0x18
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [ebp - 0x838]
lea edx, [ebp - 0x41c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x838]
lea edx, [ebp - 0x83c]
push edx
mov dword [ebp - 0x83c], 0
push 0x69e46c
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
js 0x469caf
cmp dword [ebp - 0x83c], 0
je 0x469caf
push 0x20a
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00617280
add esp, 0xc
lea eax, [ebp - 0x628]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x20a
lea eax, [ebp - 0x834]
push 0
push eax
call fcn.00617280
push 0x6b3f68
lea eax, [ebp - 0x628]
push eax
push str._s_s
push 0xffffffffffffffff
lea eax, [ebp - 0x834]
push 0x104
push eax
call fcn.0044cce0
mov eax, dword [ebp - 0x83c]
lea edx, [ebp - 0x834]
add esp, 0x24
mov ecx, dword [eax]
push 0
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x83c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x838]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret
Function at 0x46a0a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x643d18
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6ddc7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
push 0x40
call fcn.005ff7ce
mov esi, eax
mov dword [ebp - 4], 0
lea ecx, [esi + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ecx
add esp, 4
mov dword [esi], vtable.._AV___Func_impl_no_alloc_V__WeakCallback_V___Binder_U_Unforced_std__AAP8CMarchMainWnd__AEXV__basic_string__WU__char_traits__W_std__V__allocator__W_2__2_PAX_ZABQAV3_ABV42_AAPAX_std___nbase__X__V_std__.0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x46a107
lock inc dword [eax + 8]
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
add ecx, 8
mov byte [ebp - 4], 1
movq xmm0, qword [edi + 8]
lea ebx, [ecx + 0xc]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], ebx
movq qword [ecx], xmm0
mov eax, dword [edi + 0x10]
mov dword [ecx + 8], eax
lea ecx, [ebx + 4]
mov eax, dword [edi + 0x14]
mov dword [ebx], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 0x1c], ecx
call fcn.004561f0
mov eax, dword [edi + 0x30]
mov dword [ebx + 0x1c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46a7b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x6ddc7c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x105
lea eax, [ebp - 0x10c]
mov ebx, ecx
push 0
push eax
call fcn.00617280
add esp, 0xc
xor eax, eax
mov cl, byte [eax + 0x6eb6a0]
lea eax, [eax + 1]
mov byte [ebp + eax - 0x10d], cl
test cl, cl
jne 0x46a7e0
mov esi, ebx
mov al, byte [ebx]
inc ebx
test al, al
jne 0x46a7f6
lea edi, [ebp - 0x10c]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x46a806
mov ecx, ebx
lea eax, [ebp - 0x10c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00620dda
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret
Function at 0x46b4f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x643e20
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x6ddc7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0
push dword [esi + 0x264]
call dword [sym.imp.USER32.dll_EnableWindow]
push 6
xor eax, eax
mov dword [ebp - 0x2c], 0
push str.lbtext
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
call fcn.0044e410
push 0
push 0x6e0740
push 0x6e0770
push 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.004be150
push eax
call fcn.00619886
mov dword [ebp - 4], 0xffffffff
add esp, 0x14
mov edx, dword [ebp - 0x28]
mov edi, eax
cmp edx, 8
jb 0x46b5ba
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46b5b0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46b6b2
push edx
push ecx
call fcn.005ff7fe
add esp, 8
test edi, edi
je 0x46b65f
mov ecx, ebx
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46b5e0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x24]
call fcn.0044e410
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 1
push eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x128]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x46b64b
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46b641
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46b6b7
push edx
push ecx
call fcn.005ff7fe
add esp, 8
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov ecx, esi
call fcn.004bb5f0
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
cmp eax, vtable.CMarchMsgDlg.2.0
jne 0x46b6bc
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46b69e
push 1
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0061f5be
call fcn.0061f5be
push 1
push 1
mov ecx, esi
call edx
jmp 0x46b69e
Function at 0x4730f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [0x6eba40]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47311a
mov ecx, dword [eax + 4]
mov edx, dword [ebp + 8]
push ecx
push dword [ebp - 4]
call fcn.004871b0
add esp, 8
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
xor ecx, ecx
push ecx
push dword [ebp - 4]
call fcn.004871b0
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x473130
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [0x6eba40]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x473149
mov esi, dword [eax + 4]
jmp 0x47314b
xor esi, esi
mov eax, dword [ebp + 0xc]
cmp eax, 0x3fc
ja 0x47316c
test esi, esi
je 0x47316c
xor edx, edx
nop dword [eax + eax]
cmp dword [esi + edx*4], 0
je 0x47317a
inc edx
cmp edx, 2
jl 0x473160
push dword [ebp + 8]
call fcn.005ffcaf
add esp, 4
pop esi
pop ebp
ret
mov ecx, dword [ebp + 8]
mov al, byte [ecx + eax]
mov byte [ecx], al
mov dword [esi + edx*4], ecx
pop esi
pop ebp
ret

Function at 0x4736d0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x6ddc7c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0
mov eax, dword [esi + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x6eb9d8
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov ecx, dword [esi + 4]
push 0
push ecx
test eax, eax
je 0x473734
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret
push fcn.00450c50
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret
Function at 0x473ca0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x644c79
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x18
mov eax, dword [0x6ddc7c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [ebx + 8]
mov dword [ebp - 0x24], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.asio::detail::win_iocp_io_context.0
mov dword [esi + 0x14], 0
lea edi, [esi + 0x18]
mov dword [esi + 0x1c], 0
mov dword [edi], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x38]
mov dword [esi + 0x34], 0
call fcn.00473260
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x60], 0
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [esi + 0x14], eax
test eax, eax
jne 0x473dcd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x6eb97c]
cmp eax, dword [ecx + 4]
jg 0x473e74
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x6eb958
test edi, edi
jne 0x473ec1
lea edi, [esi + 0x18]
cmp byte [ebx + 0x10], 0
je 0x473e52
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0xc
call fcn.005ff7ce
mov edi, eax
add esp, 4
mov dword [ebp - 0x20], edi
mov byte [ebp - 4], 7
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
push 0x10
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.005ff7ce
add esp, 4
mov dword [ebp - 0x18], eax
xorps xmm0, xmm0
mov ecx, edi
movups xmmword [eax], xmm0
push 0
push eax
mov dword [eax], vtable.asio::detail::win_thread::func_struct_asio::detail::win_iocp_io_context::thread_function_.0
mov dword [eax + 0xc], esi
call fcn.00473760
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x473e4f
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc
push dword [ebp - 0x20]
call fcn.005ff7fe
add esp, 8
mov dword [esi + 0x60], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005ff7bd
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
push 0x6eb97c
call fcn.005ffe54
add esp, 4
cmp dword [0x6eb97c], 0xffffffff
jne 0x473db8
push 0x650420
mov dword [0x6eb95c], 0x6eb958
mov dword [0x6eb958], 0x6ac23c
call fcn.005ffc91
add esp, 4
push 0x6eb97c
call fcn.005ffe0a
add esp, 4
jmp 0x473db8
mov edx, str.iocp
lea ecx, [ebp - 0x1c]
call fcn.0044fae0
int3
Function at 0x474330
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x644ce0
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x6ddc7c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
lea eax, [esi + 0x18]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test eax, eax
jne 0x4743aa
mov ecx, esi
call fcn.00474530
push 0x6eb974
push 0x450a50
push 0x6eb9ac
call fcn.005fbcbd
add esp, 0xc
test eax, eax
je 0x4744ba
mov dword [ebx], 0
xor eax, eax
mov dword [ebx + 4], 0x6eb974
jmp 0x47449c
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.005fd046
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
add esp, 4
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x54], xmm0
movups xmmword [ebp - 0x44], xmm0
mov ecx, esi
mov dword [ebp - 4], 1
push dword [0x6eba40]
neg ecx
movq qword [ebp - 0x20], xmm0
lea eax, [esi + 0x14]
mov dword [ebp - 0x18], 0
sbb ecx, ecx
and ecx, eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x6eba40]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 2
push eax
push ecx
mov ecx, esi
xor edi, edi
call fcn.00474800
test eax, eax
je 0x47445c
nop word [eax + eax]
cmp edi, 0xffffffff
lea eax, [edi + 1]
push ebx
cmove eax, edi
mov edi, eax
lea eax, [ebp - 0x54]
push eax
push ecx
mov ecx, esi
call fcn.00474800
test eax, eax
jne 0x474440
push dword [ebp - 0x18]
push dword [0x6eba40]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor esi, esi
nop dword [eax]
mov eax, dword [ebp + esi*4 - 0x54]
test eax, eax
je 0x474481
push eax
call fcn.005ffcaf
add esp, 4
inc esi
cmp esi, 0xa
jl 0x474470
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 3
push eax
call fcn.005fd080
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret 4
call fcn.0061f60e
int3
Function at 0x4752a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6ddc7c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 0x14], esi
push edi
mov edi, dword [ebp + 0xc]
cmp ebx, 0xffffffff
je 0x4753ad
cmp byte [ebp + 8], 0
je 0x47530d
test byte [esi], 8
je 0x47530d
xor eax, eax
lea ecx, [ebp - 0x10]
xorps xmm0, xmm0
mov dword [ebp - 8], eax
movlpd qword [ebp - 0x10], xmm0
call fcn.0044f190
or byte [esi], 8
lea eax, [ebp - 8]
push 4
push eax
push 0x80
push 0xffff
push ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea ecx, [ebp - 0x10]
setne dl
call fcn.00475220
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
mov ecx, edi
test esi, esi
setne dl
call fcn.00475220
test esi, esi
je 0x47539a
mov edx, 0x2733
lea ecx, [ebp - 0x10]
call fcn.00472df0
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
cmp eax, dword [ecx + 4]
jne 0x475347
cmp dword [edi], edx
je 0x475368
mov edx, 0x4d5
lea ecx, [ebp - 0x10]
call fcn.00472df0
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
cmp eax, dword [ecx + 4]
jne 0x47539a
cmp dword [edi], edx
jne 0x47539a
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x8004667e
push ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp - 0x14]
push ebx
and byte [eax], 0xfc
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
mov ecx, edi
test esi, esi
setne dl
call fcn.00475220
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret

Function at 0x4753c0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, edx
push edi
mov edi, ecx
mov eax, dword [esi]
cmp eax, 0x4cf
jg 0x4753f8
je 0x4753f1
cmp eax, 0x79
je 0x4753ea
cmp eax, 0x4c9
jne 0x475416
mov edx, 0x274d
jmp 0x475404
mov edx, 0x274c
jmp 0x475404
mov edx, 0x2743
jmp 0x475404
cmp eax, 0x4d0
jne 0x475416
mov edx, 0x2751
lea ecx, [ebp - 8]
call fcn.00472df0
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
cmp dword [esi], 0
jne 0x47545e
cmp edi, 0xffffffff
jne 0x47543d
mov edx, 0x2719
lea ecx, [ebp - 8]
call fcn.00472df0
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x7010
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
mov ecx, esi
setne dl
call fcn.00475220
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x475500
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x6ddc7c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push 1
push 0
push 0
push dword [ebp + 8]
push edx
push ebx
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov edi, eax
mov ecx, esi
cmp edi, 0xffffffff
sete dl
call fcn.00475220
cmp edi, 0xffffffff
jne 0x475550
or eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret
cmp ebx, 0x17
jne 0x47556d
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x1b
push 0x29
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret

Function at 0x475610
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, edx
push edi
cmp ecx, 0xffffffff
jne 0x475644
mov edx, 0x2719
lea ecx, [ebp - 0xc]
call fcn.00472df0
mov edx, dword [ebp + 0x10]
mov ecx, dword [eax]
mov dword [edx], ecx
mov eax, dword [eax + 4]
mov dword [edx + 4], eax
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
push ebx
push 0x8004667e
push ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov ecx, dword [ebp + 0x10]
mov edi, eax
test edi, edi
sets dl
call fcn.00475220
test edi, edi
js 0x475681
cmp dword [ebx], 0
mov cl, byte [esi]
je 0x47567c
or cl, 1
mov eax, edi
mov byte [esi], cl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
and cl, 0xfc
mov byte [esi], cl
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret