joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466150
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x5d5286], 0
je 0x46616a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x466170
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x5d5286], 0
je 0x46618b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x466ff0
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x46700a
mov ecx, 0x14
jmp 0x467013
shl ecx, 2
add ecx, 0xe10
mov dword [0x5d53a4], ecx
ret
Function at 0x49a500
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5d53a4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49a6ea
sub esp, 0x48
mov eax, dword [0x5ac35c]
mov ecx, dword [esp + 0x50]
movzx edx, word [ecx + 0xa]
movzx ebx, word [ecx + 0xc]
movzx ebp, word [ecx + 2]
movzx esi, word [ecx + 8]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], ebp
mov dword [esp + 8], 1
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call sym.time.Date
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.0046693e
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.0046693e
call sym.time.Time.abs
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x93a80
call sym.runtime.uint64mod
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
lea eax, [ebp + edx]
sar eax, 0x10
sar ebp, 0x1f
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x49a5d7
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x49a5f1
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x49a668
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x49a63e
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x49a63a
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x49a633
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x49a640
mov ebx, 0x1d
jmp 0x49a65e
mov ebp, eax
jmp 0x49a640
mov ebp, eax
cmp ebp, 0xd
jae 0x49a6dd
lea eax, [ebp - 1]
lea edx, [0x5a37c0]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x49a6d3
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x49a668
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x49a69a
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x49a6a2
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
mov dword [esp + 0x54], eax
add esp, 0x48
ret
mov ecx, 0xd
call sym.runtime.panicIndex
mov eax, ebp
mov ecx, 0xd
call sym.runtime.panicIndex
nop
call sym.runtime.morestack_noctxt
jmp sym.time.pseudoUnix
Function at 0x4ad720
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5d53a4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ad7c1
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [esp + 0x18]
cmp dword [edx], ecx
jne 0x4ad7b7
movzx ecx, byte [eax + 4]
cmp byte [edx + 4], cl
jne 0x4ad7b7
movzx ecx, byte [eax + 5]
cmp byte [edx + 5], cl
jne 0x4ad7b7
movzx ecx, byte [eax + 6]
cmp byte [edx + 6], cl
jne 0x4ad7b7
movzx ecx, byte [eax + 7]
cmp byte [edx + 7], cl
jne 0x4ad7b7
movzx ecx, byte [eax + 8]
cmp byte [edx + 8], cl
jne 0x4ad7b7
movzx ecx, byte [eax + 9]
cmp byte [edx + 9], cl
jne 0x4ad7b7
movzx ecx, byte [eax + 0xa]
cmp byte [edx + 0xa], cl
jne 0x4ad7b7
movzx ecx, byte [eax + 0xb]
cmp byte [edx + 0xb], cl
jne 0x4ad7b7
movzx ecx, byte [eax + 0xc]
cmp byte [edx + 0xc], cl
jne 0x4ad7b7
add eax, 0x10
mov dword [esp], eax
lea eax, [edx + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x4c
call sym.runtime.memequal
movzx eax, byte [esp + 0xc]
jmp 0x4ad7b9
xor eax, eax
mov byte [esp + 0x1c], al
add esp, 0x10
ret
call sym.runtime.morestack_noctxt
jmp sym.type:.eq.fmt.fmt
Function at 0x4b6ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x5d53a4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b6bd1
sub esp, 0x1c
mov ecx, dword [esp + 0x20]
test byte [ecx], al
mov edx, dword [esp + 0x24]
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x18], ecx
xor eax, eax
jmp 0x4b6b1c
mov ebx, dword [esp + 0xc]
inc ebx
mov ecx, dword [esp + 0x18]
mov eax, ebx
cmp eax, 4
jge 0x4b6b55
mov dword [esp + 0xc], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call sym.sync_atomic.LoadUint64
mov eax, dword [esp + 0x24]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x28]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x4b6b11
mov byte [esp + 0x2c], 1
add esp, 0x1c
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x4b6b5f
inc eax
cmp eax, 4
jge 0x4b6b74
mov dword [esp + 0x14], eax
lea ebx, [ecx + eax*8]
mov ebp, dword [ebx]
mov ebx, dword [ebx + 4]
xor esi, esi
jmp 0x4b6bca
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call sym.sync_atomic.StoreUint64
mov byte [esp + 0x2c], 0
add esp, 0x1c
ret
mov edi, ebp
and edi, 0xff
xor edx, edi
shr ebp, 8
mov edi, ebx
shl edi, 0x18
mov dword [esp + 0x10], edi
mov eax, edx
mov edi, 0x1b3
mul edi
inc esi
mov edi, dword [esp + 0x10]
or ebp, edi
shr ebx, 8
mov edx, eax
mov eax, dword [esp + 0x14]
cmp esi, 8
jl 0x4b6b9b
jmp 0x4b6b5e
call sym.runtime.morestack_noctxt
jmp sym.internal_bisect._dedup_.seenLossy
Function at 0x407a9c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x407aab
pop dword [ebp - 0x30]
mov eax, 0x8d6c9a96
sub eax, 0x8d2c1feb
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x8c95a42a
sub dword [ebp - 0x40], 0x3e435edf
mov dword [ebp - 0x3c], 0xf9a4700
add dword [ebp - 0x3c], 0x22990545
mov dword [ebp - 0x38], 0xe4a9d3d4
add dword [ebp - 0x38], 0x67a2705a
mov dword [ebp - 0x34], 0x2409ac42
sub dword [ebp - 0x34], 0x2409ac42
lea eax, [ebp - 0x40]
push eax
mov eax, 0xba276b9f
sub eax, 0xb9e6cb93
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x69ebb269
add dword [ebp - 0x40], 0xa86b6ed
mov dword [ebp - 0x3c], 0x2dcf7fa1
sub dword [ebp - 0x3c], 0xec631e2c
mov dword [ebp - 0x38], 0xba6d9306
add dword [ebp - 0x38], 0xa901d966
mov dword [ebp - 0x34], 0x911ffe4
sub dword [ebp - 0x34], 0x911ffe4
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x36747
push 0
call eax
mov ecx, 0x98fbb95d
sub ecx, 0x98fb7adc
xor edi, edi
add edi, eax
mov esi, 0x16d87034
sub esi, 0x1694b234
add esi, dword [ebp - 0x30]
mov ebx, 0x4f1cf415
add ebx, 0xa38b03c0
mov edx, dword [esi]
sub dword [ebp - 0x2c], edx
add edx, ebx
xor dword [ebp - 0x10], edi
mov dword [edi], edx
sub dword [ebp - 0x28], 0x5deea1ff
add edi, 0x897d286f
sub edi, 0x897d286b
add esi, 4
loop 0x407bca
add eax, 0xecd7
mov ebx, eax
add eax, 0x6052ff66
add eax, 0x9fad009f
mov ecx, 0xbb78c45c
sub ecx, 0xbb38c45c
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x40993f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x409997
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x409997
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x409997
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x4099c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x409a2e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409a25
cmp dword [ebp - 0xc], 4
jne 0x409a25
cmp dword [ebp - 0x10], edi
je 0x409a25
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x58dab8], edi
xor eax, eax
jmp 0x409a56
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x58dab8], edi
jge 0x409a51
mov dword [0x58dab8], edi
call fcn.0040999b
test eax, eax
je 0x409a51
emms
mov dword [0x58dab8], 1
mov eax, dword [0x58dab8]
pop edi
leave
ret

Function at 0x409b36
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x409b6d
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x409b8f
cmp dword [ebp - 0x20], 4
ja 0x409b99
jne 0x409b89
cmp dword [ebp - 0x1c], 0xa
jb 0x409b89
cmp word [ebp - 0x18], 0x55d
jae 0x409b99
mov byte [ebp + 0x73], 1
jmp 0x409b99
cmp dword [ebp - 0x14], 2
jne 0x409baf
test bl, bl
je 0x409bca
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x409bba
dec eax
je 0x409bb3
sub eax, 3
jne 0x409baf
cmp byte [ebp + 0x73], 0
je 0x409bdb
xor eax, eax
jmp 0x409be3
call fcn.00409a59
jmp 0x409be3
cmp byte [ebp + 0x73], 0
jne 0x409baf
call fcn.00409a91
and eax, 4
jmp 0x409be3
cmp dword [ebp + 0x7c], 0xa
je 0x409bdb
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x409be3
call fcn.00409a91
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x40cd85
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x98
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0x78], esi
push edi
mov edi, ecx
jne 0x40cda6
mov eax, 0x8876086c
jmp 0x40ce88
cmp dword [ebp + 0x7c], esi
je 0x40ce20
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x18], 2
je 0x40ce00
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push esi
call ebx
mov dword [ebp + 0x6c], eax
add eax, 3
and eax, 0xfffffffc
call fcn.004b35c0
mov dword [ebp + 0x7c], esp
push esi
push esi
push dword [ebp + 0x6c]
push dword [ebp + 0x7c]
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push esi
call ebx
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x78], eax
mov dword [ebp + 0x7c], esi
cmp dword [ebp + 0x7c], esi
je 0x40ce20
push esi
push 0x10000000
push 3
push esi
push 1
push accept
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x40ce39
push esi
push 0x10000000
push 3
push esi
push 1
push accept
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [edi], eax
je 0x40ce79
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
je 0x40ce79
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [edi + 8], eax
je 0x40ce79
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi + 0xc], eax
jne 0x40ce86
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x88760b59
jmp 0x40ce88
xor eax, eax
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8
Function at 0x431199
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4311a7
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x43127b
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x55c8e0]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x55c8e0]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x55c8e0]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x55c8e0]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x55c8e0]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x55c8e0]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x55c8e0]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x55c8e0]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x4311c4
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x43129b
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x55c8e0]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x431281
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x43cc40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x5914c0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x408], eax
mov ecx, dword [ebp - 0x408]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x404]
push eax
call fcn.0043cbe0
add esp, 0xc
mov dword [ebp - 0x408], 0
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b2e95
mov esp, ebp
pop ebp
ret

Function at 0x43cfa0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x43cfc8
xor al, al
jmp 0x43d00a
mov ecx, 1
imul edx, ecx, 0
add edx, dword [ebp + 8]
push edx
push 0x20
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x43cff4
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
jmp 0x43d00a
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
jne 0x43d008
xor al, al
jmp 0x43d00a
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x441140
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x57a010]
mov ecx, 4
mul ecx
push esi
mov ecx, 0xffffffff
mov dword [ebp - 4], 0
cmovb eax, ecx
push edi
push eax
call fcn.004b31f7
mov ecx, dword [0x57a010]
shl ecx, 2
push ecx
push 0
push eax
mov dword [0x5936f0], eax
call fcn.004dedd0
xor esi, esi
add esp, 0x10
cmp dword [0x57a010], esi
jle 0x4411c4
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x4415d0
push 0x10000
push 0
call edi
mov ecx, dword [0x5936f0]
mov dword [ecx + esi*4], eax
mov eax, dword [0x5936f0]
cmp dword [eax + esi*4], 0
je 0x4411cc
inc esi
cmp esi, dword [0x57a010]
jl 0x441191
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x441410
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x28], 0
jg 0x44151c
push ebx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x18]
sub eax, 2
je 0x4414a9
sub eax, 1
je 0x441460
sub eax, 1
jne 0x44151a
mov ecx, dword [esi + 0x10]
push dword [edi + 0x1c]
push dword [esi + 4]
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
test al, al
jne 0x441513
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
pop edi
pop ebx
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 0x10]
push 0
push dword [edi + 0x1c]
mov eax, dword [ecx]
push dword [esi + 4]
mov eax, dword [eax + 4]
call eax
test al, al
jne 0x44147f
push dword [edi + 0x1c]
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, esi
call fcn.00441ca0
test al, al
jne 0x44151a
push str.HandleGoodIoCompletions__:_setup_new_accept_failed
call fcn.004423f0
mov eax, dword [esi]
add esp, 4
mov ecx, esi
call dword [eax + 8]
pop edi
pop ebx
pop esi
pop ebp
ret 0x10
mov ebx, dword [ebp + 0x14]
nop dword [eax]
push 0
push ebx
push dword [ebp + 0x10]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
je 0x4414ff
test edi, edi
je 0x4414e7
push edi
push dword [ebp + 0x10]
mov ecx, esi
call fcn.004417f0
cmp edi, ebx
je 0x4414b0
mov ecx, esi
call fcn.00441980
pop edi
pop ebx
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x44151a
mov eax, dword [ecx]
push 0
push dword [esi + 4]
call dword [eax + 0xc]
pop edi
pop ebx
pop esi
pop ebp
ret 0x10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.HandleGoodIoCompletions__:_recv_failed:_error_code:__d
call fcn.004423f0
add esp, 8
mov ecx, esi
call fcn.00441980
pop edi
pop ebx
pop esi
pop ebp
ret 0x10
Function at 0x441980
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
push ebx
push 0x57a02c
call edi
push 0x57a02c
call edi
mov eax, dword [0x57a018]
cmp eax, dword [0x57a01c]
push 0x57a02c
sete bl
call esi
test bl, bl
je 0x4419f1
push 0x57a02c
call esi
push 0x3e8
call fcn.004411e0
add esp, 4
jmp 0x4419b4
mov ecx, dword [0x57a01c]
mov eax, dword [0x57a014]
pop ebx
mov edi, dword [eax + ecx*4]
inc ecx
mov dword [0x57a01c], ecx
cmp ecx, dword [0x57a024]
jl 0x441a19
mov eax, dword [0x57a020]
mov dword [0x57a01c], eax
push 0x57a02c
call esi
push dword [edi + 0x20]
call fcn.004b3200
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [edi + 0x18], 2
mov dword [edi + 0x14], ecx
mov dword [edi + 0x1c], 0xffffffff
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
test ecx, ecx
je 0x441a5e
mov eax, dword [ecx + 4]
mov dword [edi + 0x28], eax
push 0
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x441adc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x441adc
push eax
push str.RegisterRecv__:_registration_failed:_error_code:__d
call fcn.004423f0
push dword [edi + 0x20]
call fcn.004b3200
add esp, 0xc
mov dword [edi + 0x18], 0
mov ecx, 0x57a014
mov dword [edi + 0x14], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
push edi
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
call fcn.004418f0
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x441b30
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
call fcn.004b31f7
push esi
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
push eax
mov dword [ebp - 0x10], esi
call fcn.004de850
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [eax + eax]
push 0x57a02c
call edi
push 0x57a02c
call edi
mov eax, dword [0x57a018]
cmp eax, dword [0x57a01c]
push 0x57a02c
sete bl
call esi
test bl, bl
je 0x441bad
push 0x57a02c
call esi
push 0x3e8
call fcn.004411e0
add esp, 4
jmp 0x441b70
mov ecx, dword [0x57a01c]
mov eax, dword [0x57a014]
mov ebx, dword [eax + ecx*4]
inc ecx
mov dword [0x57a01c], ecx
cmp ecx, dword [0x57a024]
jl 0x441bd4
mov eax, dword [0x57a020]
mov dword [0x57a01c], eax
push 0x57a02c
call esi
push dword [ebx + 0x20]
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
call fcn.004b3200
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [ebx + 0x18], 1
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x28], 0
test ecx, ecx
je 0x441c17
mov eax, dword [ecx + 4]
mov dword [ebx + 0x28], eax
push 0
push ebx
push 0
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x441c8c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x441c8c
push dword [ebx + 0x20]
call fcn.004b3200
add esp, 4
mov dword [ebx + 0x18], 0
mov ecx, 0x57a014
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
push ebx
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
call fcn.004418f0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8