joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435f2b
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4b5231
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x144
push esi
mov esi, ecx
push str.GLMessage
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_4
mov dword [esp + 0x10], 0
mov eax, dword [0x4dbff4]
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x13]
push ecx
push edx
mov ecx, 0x4dbff4
mov dword [esp + 0x15c], 0
call fcn.00438db0
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x435f85
mov dword [esp + 0x150], 0xffffffff
lea ecx, [esp + 0x14]
jmp 0x4360ee
push eax
mov ecx, esi
call fcn.00433190
test eax, eax
mov dword [esp + 0x150], 0xffffffff
lea ecx, [esp + 0x14]
je 0x4360ee
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x158]
lea ecx, [esp + 4]
push eax
call sub.MFC42.DLL_CString::CString_4
mov ecx, dword [esp + 4]
mov dword [esp + 0x150], 1
mov eax, dword [ecx - 8]
test eax, eax
jne 0x436005
mov edx, dword [0x4dbf64]
push str.Guest
push edx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x436005
push str._UserName:
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
push 0x4dbf64
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_2
push edi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_5
mov ecx, 7
mov esi, str.SoftwareGlobalLinkGLMessage
lea edi, [esp + 0x28]
lea eax, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x28]
push eax
push ecx
push bind
mov byte [esp + 0x160], 2
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
pop edi
jne 0x4360ac
lea edx, [esp + 0x1c]
lea eax, [esp + 0x44]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push eax
push ecx
push 0
push str.Path
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x43607d
mov byte [esp + 0x44], 0
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [esp + 0x44]
test al, al
je 0x4360ac
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::operator_1
push str.GLMessage.exe
lea ecx, [esp + 0xc]
call fcn.004550cc
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4360ce
mov edx, dword [esp + 4]
push 5
push 0
push edx
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 8]
mov byte [esp + 0x150], 1
call sub.MFC42.DLL_CString::CString
mov dword [esp + 0x150], 0xffffffff
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x148]
pop esi
mov dword fs:[0], ecx
add esp, 0x150
ret 4

Function at 0x436690
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
mov ecx, dword [ecx + 0xd0]
xor eax, eax
mov dword [esp], ecx
test edx, edx
lea edx, [esp]
setne al
push edx
push 0x42e420
mov dword [esp + 0xc], eax
call dword [sym.imp.USER32.dll_EnumWindows]
add esp, 8
ret 4
Function at 0x436c60
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b52fb
push eax
mov eax, 0x200c
mov dword fs:[0], esp
call fcn.004556f0
push esi
lea ecx, [esp + 4]
xor esi, esi
call sub.MFC42.DLL_CString::CString_5
push str.SoftwareGlobalLinkGame_
lea ecx, [esp + 8]
mov dword [esp + 0x201c], esi
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 0x2020]
lea ecx, [esp + 4]
push eax
call fcn.004550cc
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
push edx
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x436d0c
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push esi
push esi
push str.Version
push edx
mov dword [esp + 0x24], 0x2000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x436d01
lea eax, [esp + 0x10]
push eax
call fcn.00456320
add esp, 4
mov esi, eax
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 4]
mov dword [esp + 0x2018], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x2010]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2018
ret 4

Function at 0x438300
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push ebp
push esi
push edi
mov ebp, ecx
mov esi, 0x4c0650
mov eax, dword [0x4dc5a0]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x43834c
mov edx, dword [esi]
mov edi, dword [0x4dc5a4]
xor ecx, ecx
mov eax, 0x4c0650
cmp dword [eax], edx
je 0x43836e
add eax, 0x10
inc ecx
cmp eax, 0x4c06d0
jb 0x43832c
xor ecx, ecx
push edi
push 0
push ecx
push str.AdBarButtons
call ebx
test eax, eax
je 0x43835e
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
mov eax, dword [esi]
push ecx
push edx
push eax
mov ecx, ebp
call fcn.0042ee00
add esi, 0x10
cmp esi, 0x4c06d0
jb 0x438311
pop edi
pop esi
pop ebp
pop ebx
ret
shl ecx, 4
mov ecx, dword [ecx + 0x4c065c]
jmp 0x43833d

Function at 0x438e68
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b5467
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x20]
call sub.MFC42.DLL_CString::CString_5
xor edi, edi
lea ecx, [esi + 0x24]
mov dword [esp + 0x18], edi
call sub.MFC42.DLL_CString::CString_5
lea ecx, [esi + 0x28]
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CString::CString_5
lea ecx, [esi + 0x2c]
mov byte [esp + 0x18], 2
call sub.MFC42.DLL_CString::CString_5
mov al, byte [esp + 0xb]
mov dword [esi + 0x34], edi
mov byte [esi + 0x30], al
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
lea ecx, [esi + 0x44]
mov byte [esp + 0x18], 4
call sub.MFC42.DLL_CString::CString_5
mov ecx, dword [esp + 0x10]
mov dword [esi], 0x4c0dac
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x439af0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b5619
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x30]
lea esi, [ecx + 4]
push edi
push esi
call fcn.00439c10
add esp, 8
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_5
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0
call sub.MFC42.DLL_CString::CString_5
lea eax, [edi + 0x18]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::operator
lea ecx, [edi + 0x1c]
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
mov eax, dword [edi + 0x20]
mov edi, dword [edi + 0x90]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x28], 2
test eax, eax
je 0x439b7e
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 4]
cmp edx, eax
jne 0x439b85
mov ecx, esi
call fcn.0043a4e0
mov ecx, dword [esi + 0xc]
add ecx, 0xfffffff0
mov edi, ecx
mov dword [esi + 0xc], ecx
mov dword [esp + 0x30], edi
mov dword [esp + 8], edi
test edi, edi
mov byte [esp + 0x28], 3
je 0x439bcb
lea eax, [esp + 0xc]
push eax
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 4
push ecx
lea ecx, [edi + 4]
call sub.MFC42.DLL_CString::CString_3
mov edx, dword [esp + 0x14]
mov dword [edi + 8], edx
mov eax, dword [esp + 0x18]
mov dword [edi + 0xc], eax
inc dword [esi + 0x2c]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x43aa30
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4b573b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x248
push ebx
mov ebx, dword [esp + 0x25c]
push ebp
push esi
push edi
mov edi, ecx
push ebx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x260], 0
mov ecx, dword [eax - 8]
mov al, byte [ecx + eax - 1]
cmp al, 0x5c
je 0x43aa8a
push 0x4d6160
lea ecx, [esp + 0x14]
call fcn.004550cc
push str..OEM
lea ecx, [esp + 0x14]
call fcn.004550cc
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x43ab43
test byte [esp + 0x14], 0x10
je 0x43aada
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea edx, [esp + 0x14]
push edx
push ebp
call esi
test eax, eax
je 0x43aad3
test byte [esp + 0x14], 0x10
jne 0x43aac0
test byte [esp + 0x14], 0x10
jne 0x43ab3c
lea eax, [esp + 0x154]
push 0
push eax
push 0
lea ecx, [esp + 0x4c]
push 0
push ecx
call dword [sym.imp.MSVCRT.dll__splitpath]
add esp, 0x14
lea edx, [esp + 0x154]
mov ecx, edi
push edx
call sub.MFC42.DLL_CString::operator_1
lea esi, [edi + 4]
push ebx
mov ecx, esi
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esi]
mov ecx, dword [eax - 8]
cmp byte [eax + ecx - 1], 0x5c
je 0x43ab28
push 0x4d6160
mov ecx, esi
call fcn.004550cc
push edi
mov ecx, esi
call sub.MFC42.DLL_CString::operator_2
push 0x4d8260
mov ecx, esi
call fcn.004550cc
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [edi + 4]
lea esi, [edi + 4]
push eax
call fcn.00455aa0
add esp, 4
test eax, eax
jne 0x43ab86
push 0x4db920
mov ecx, edi
call sub.MFC42.DLL_CString::operator_1
push 0x4db920
mov ecx, esi
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov dword [esp + 0x260], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x43ab9f
lea ecx, [esp + 0x10]
mov dword [esp + 0x260], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x258]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x254
ret 4

Function at 0x43abc0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [ecx + 4]
sub esp, 0x104
lea ecx, [esp]
push esi
push eax
push 0x104
push ecx
push 0x4db920
push str.Force
push str.FloatWnd
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [sym.imp.MSVCRT.dll__stricmp]
lea edx, [esp + 4]
push str.OurFriend
push edx
call esi
add esp, 8
test eax, eax
je 0x43ac20
lea eax, [esp + 4]
push str.GLShow
push eax
call esi
add esp, 8
test eax, eax
je 0x43ac20
xor eax, eax
pop esi
add esp, 0x104
ret
mov eax, 1
pop esi
add esp, 0x104
ret

Function at 0x43ac30
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [ecx + 4]
sub esp, 0x104
lea ecx, [esp]
push eax
push 0x104
push ecx
push 0x4db920
push str.Force
push str.FloatWnd
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp]
push str.OurFriend
push edx
call dword [sym.imp.MSVCRT.dll__stricmp]
neg eax
sbb eax, eax
inc eax
add esp, 0x10c
ret
Function at 0x43eaa0
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x4b5a2a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov eax, dword [esi + 0xe0]
mov dword [esp + 0x10], 2
test eax, eax
je 0x43eadb
mov eax, dword [eax + 0x2c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, esi
call fcn.0043fb10
push esi
push str.CAdvertDownloadThread::CAdvertDownloadThread___this___lp
push esi
call fcn.004a5330
mov eax, dword [esi + 0x110]
add esp, 0xc
test eax, eax
je 0x43eb10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x43eb10
mov dword [esi + 0x110], 0
mov eax, dword [esi + 0x10c]
mov dword [esi + 0xfc], 0x4c11dc
test eax, eax
je 0x43eb2e
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
add esi, 0xe4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x43edf0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4b5a6a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x43ee60
push 0x2b0
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x43ee36
mov ecx, eax
call fcn.004597d0
jmp 0x43ee38
xor eax, eax
test eax, eax
mov dword [esp + 0x10], 0xffffffff
mov dword [esi + 0x30], eax
jne 0x43ee59
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
mov dword [eax + 0x64], 0
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x30]
push ebx
push 0
mov edx, dword [esi + eax*4]
mov eax, dword [esi + eax*4 + 0x14]
mov ebx, dword [ecx]
push eax
push edx
call dword [ebx + 0x50]
mov ecx, dword [esp + 0xc]
pop ebx
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x43f690
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4b5b90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov ecx, dword [ecx]
lea edx, [esp + 4]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 4]
mov dword [esp + 0x10], 0
push eax
call fcn.00455d60
add esp, 4
test eax, eax
jne 0x43f6f4
call fcn.0043fb00
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp]
call sub.MFC42.DLL_CString::CString_5
push 0
mov byte [esp + 0x14], 1
call dword [sym.imp.MSVCRT.dll_time]
mov ecx, dword [esp + 8]
add esp, 4
lea edx, [esp]
push eax
push ecx
push str._s_advert__0d.dat
push edx
call sub.MFC42.DLL_CString::Format_1
mov eax, dword [esp + 0x10]
add esp, 0x10
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x43f779
call fcn.0043fb00
lea ecx, [esp]
mov byte [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp]
mov byte [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4418d0
Capabilities:
Initialize winsock library

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi], 0x4c1348
mov eax, dword [0x4dc740]
cmp eax, ebx
jne 0x44195a
push 0x4dc5b0
push 0x101
mov dword [0x4dc740], 1
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x441920
push 0x1010
push str.Error
push str.Initial_Windows_Socket_Error
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x4dc744], ebx
jmp 0x441960
cmp word [0x4dc5b0], 0x101
je 0x44194e
push 0x1010
push str.Error
push str.Initial_Windows_Socket_negotiate_Socket_Version_1.1_Error
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x4dc744], ebx
call sub.WSOCK32.dll_WSACleanup
jmp 0x441960
mov dword [0x4dc744], 1
jmp 0x441960
inc dword [0x4dc740]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x14], ebx
mov byte [esi + 0x18], bl
mov word [esi + 0x30], bx
mov dword [esi + 0x34], ebx
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4419b0
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
mov dword [esi], 0x4c1348
cmp eax, 0xffffffff
je 0x4419c8
call fcn.00441b50
mov eax, dword [esi + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
cmp eax, edi
je 0x4419f6
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4419f6
mov eax, dword [esi + 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 8]
push ecx
call ebx
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x441a0a
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esi + 0x10]
push edx
call ebx
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x34], edi
mov eax, dword [0x4dc740]
mov ecx, eax
dec eax
cmp ecx, edi
mov dword [0x4dc740], eax
jg 0x441a34
cmp dword [0x4dc744], edi
je 0x441a34
call sub.WSOCK32.dll_WSACleanup
pop edi
pop esi
pop ebx
ret

Function at 0x441a40
Capabilities:
Create tcp socket

Disassembly:
mov eax, dword [0x4dc744]
push esi
test eax, eax
mov esi, ecx
je 0x441a88
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
test eax, eax
je 0x441a88
push 0
push 0
push 1
push 0
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [esi + 0x10], eax
jne 0x441a84
mov eax, dword [esi + 4]
push eax
call sub.WSOCK32.dll_closesocket
or eax, 0xffffffff
mov dword [esi + 4], eax
pop esi
ret
xor eax, eax
pop esi
ret
or eax, 0xffffffff
pop esi
ret
Function at 0x441ac1
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 8]
mov dword [esi + 0x34], ebx
cmp eax, ebx
je 0x441af6
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x441af6
mov eax, dword [esi + 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 8]
push ecx
call edi
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x441b0a
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esi + 0x10]
push edx
call edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov eax, dword [0x4dc744]
cmp eax, ebx
jne 0x441b23
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x441b31
pop edi
pop esi
xor eax, eax
pop ebx
ret
push eax
call sub.WSOCK32.dll_closesocket
mov dword [esi + 4], 0xffffffff
pop edi
pop esi
pop ebx
ret

Function at 0x441b50
Capabilities:
Set socket configuration
Terminate thread

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 8]
mov dword [esi + 0x34], ebx
cmp eax, ebx
je 0x441b87
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x441b87
mov eax, dword [esi + 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 8]
push ecx
call edi
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x441b9b
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esi + 0x10]
push edx
call edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov eax, dword [0x4dc744]
cmp eax, ebx
jne 0x441bb5
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x441bc4
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
lea ecx, [esp + 0xc]
push 4
push ecx
push 0x80
push 0xffff
push eax
mov word [esp + 0x20], 1
mov word [esp + 0x22], bx
call sub.WSOCK32.dll_setsockopt
cmp eax, ebx
jne 0x441bfb
mov edx, dword [esi + 4]
push edx
call sub.WSOCK32.dll_closesocket
mov dword [esi + 4], 0xffffffff
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x441dd0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x318
mov eax, dword [0x4dc744]
push ebx
push esi
push edi
test eax, eax
mov dword [esp + 0xc], ecx
jne 0x441df5
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x318
ret 0x10
mov ecx, dword [ecx + 4]
cmp ecx, 0xffffffff
jne 0x441e0b
pop edi
pop esi
or eax, ecx
pop ebx
add esp, 0x318
ret 0x10
push ebp
mov ebp, dword [esp + 0x338]
test ebp, ebp
je 0x441e40
mov eax, 0x10624dd3
imul ebp
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x14], edx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, ebp
shl edx, 3
sub eax, edx
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x32c]
mov edi, dword [esp + 0x330]
mov esi, edx
mov ebx, dword [esp + 0x334]
neg esi
sbb esi, esi
lea eax, [esp + 0x1c]
and esi, eax
lea eax, [esp + 0x120]
neg edi
sbb edi, edi
and edi, eax
lea eax, [esp + 0x224]
neg ebx
sbb ebx, ebx
and ebx, eax
test esi, esi
je 0x441e85
mov dword [esi], 0
test edi, edi
je 0x441e8f
mov dword [edi], 0
test ebx, ebx
je 0x441e99
mov dword [ebx], 0
test esi, esi
je 0x441ead
mov eax, dword [esi]
cmp eax, 0x40
jae 0x441ead
mov dword [esi + eax*4 + 4], ecx
mov eax, dword [esi]
inc eax
mov dword [esi], eax
test edi, edi
je 0x441ec8
mov eax, dword [edi]
cmp eax, 0x40
jae 0x441ec8
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + 4]
mov dword [edi + eax*4 + 4], ecx
mov eax, dword [edi]
inc eax
mov dword [edi], eax
test ebx, ebx
je 0x441ee3
mov eax, dword [ebx]
cmp eax, 0x40
jae 0x441ee3
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + 4]
mov dword [ebx + eax*4 + 4], ecx
mov eax, dword [ebx]
inc eax
mov dword [ebx], eax
test edx, edx
je 0x441eed
mov dword [edx], 0
mov eax, dword [esp + 0x330]
test eax, eax
je 0x441efe
mov dword [eax], 0
mov eax, dword [esp + 0x334]
test eax, eax
je 0x441f0f
mov dword [eax], 0
test ebp, ebp
pop ebp
je 0x441f1b
lea edx, [esp + 0x10]
push edx
jmp 0x441f1d
push 0
push ebx
push edi
push esi
push 0
call sub.WSOCK32.dll_select
test eax, eax
jne 0x441f3c
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x318
ret 0x10
cmp eax, 0xffffffff
jne 0x441f4f
pop edi
pop esi
or eax, eax
pop ebx
add esp, 0x318
ret 0x10
test esi, esi
je 0x441f74
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 4]
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x441f78
mov ecx, dword [esp + 0x328]
mov dword [ecx], 1
jmp 0x441f78
mov esi, dword [esp + 0xc]
test edi, edi
je 0x441f97
mov edx, dword [esi + 4]
push edi
push edx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x441f97
mov eax, dword [esp + 0x32c]
mov dword [eax], 1
test ebx, ebx
je 0x441fb6
mov ecx, dword [esi + 4]
push ebx
push ecx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x441fb6
mov edx, dword [esp + 0x330]
mov dword [edx], 1
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x318
ret 0x10