joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c152
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x1a0
mov ebx, dword [ebp + 0x14]
mov esi, 0x519174
push esi
call fcn.0044caa0
add esp, 4
lea edi, [esp + 0xe8]
push esi
call fcn.0044caa0
add esp, 4
mov edx, dword [ebp + 0xc]
mov ecx, 0x10
xor eax, eax
mov esi, edx
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xe8]
mov esi, edx
mov dword [ecx + 0x44], eax
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x48], edx
lea edx, [esp + 0x98]
mov ecx, 0x10
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0xc]
mov dword [edx + 0x44], eax
mov dword [edx + 0x40], eax
mov esi, dword [ecx + 0x50]
mov dword [edx + 0x48], ecx
mov edx, ecx
cmp esi, ebx
jae 0x44c1f0
lea edi, [esp + 0x150]
push ebx
push dword [ebp + 0x10]
push edx
push edi
call fcn.0044b15a
add esp, 0x10
mov eax, dword [edi + 0x40]
mov ebx, dword [eax + 0x48]
cmp ebx, 0x41
jae 0x44c375
mov edx, dword [ebp + 0xc]
jmp 0x44c1f3
mov edi, dword [ebp + 0x10]
movaps xmm0, xmmword [str.6666666666666666called__Option::unwrap____on_a__None__valuecalled__Result::unwrap____on_an__Err__value]
cmp esi, 0x81
movaps xmmword [esp + 0x80], xmm0
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
jae 0x44c342
cmp esi, ebx
cmovb ebx, esi
test ebx, ebx
je 0x44c248
xor eax, eax
mov cl, byte [edi + eax]
xor byte [esp + eax + 0x10], cl
inc eax
cmp ebx, eax
jne 0x44c23c
test esi, esi
je 0x44c31e
lea eax, [esp + 0x10]
push 1
push eax
lea eax, [esp + 0xa0]
push eax
call dword [edx + 0x40]
add esp, 0xc
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xdc]
add eax, 1
adc ecx, 0
jb 0x44c334
mov dword [esp + 0xd8], eax
xor eax, eax
mov dword [esp + 0xdc], ecx
xor byte [esp + eax + 0x10], 0x6a
inc eax
cmp esi, eax
jne 0x44c28f
mov ecx, dword [esp + 0x130]
mov edi, dword [ecx + 0x50]
test edi, edi
je 0x44c31e
mov eax, esi
xor edx, edx
div edi
mov dword [esp + 0xc], esi
mov ebx, eax
imul eax, edi
cmp eax, esi
mov dword [esp + 8], eax
jne 0x44c34f
cmp edi, esi
ja 0x44c2fb
push ebx
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xf0]
push eax
call dword [ecx + 0x40]
add esp, 0xc
mov eax, dword [esp + 0x12c]
add ebx, dword [esp + 0x128]
adc eax, 0
jb 0x44c334
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], eax
push 0xa0
lea eax, [esp + 0x9c]
push eax
mov esi, dword [ebp + 8]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4d4c3c
push 0x19
push 0x4d4c50
call fcn.004b47c0
add esp, 0xc
ud2
push 0x4d4c6c
push 0x2b
push 0x4d47f0
jmp 0x44c32a
push 0x4d4d1c
push 0x80
push esi
jmp 0x44c37d
lea eax, [esp + 0x138]
xor esi, esi
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
mov dword [eax], esi
push 0x4d4c7c
push eax
push ecx
push edx
push esi
call fcn.004b2c8e
add esp, 0x14
ud2
push 0x4d4c8c
push 0x40
push ebx
call fcn.004b4c10
jmp 0x44c32f
Function at 0x44d0a3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
test byte [0x5195f3], 1
je 0x44d0df
mov eax, dword [0x5195f4]
and eax, 2
je 0x44d0df
lea eax, [ecx + 0x20]
push ebx
push edi
push eax
push ecx
call fcn.004520b0
add esp, 0x10
jmp 0x44d1cb
mov eax, dword [ecx + 0x24]
mov esi, dword [ecx]
test ebx, 0xfffffff0
mov dword [esp + 0x20], eax
mov eax, ecx
bswap esi
mov ecx, dword [ecx + 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp + 8]
mov dword [esp + 4], esi
bswap ecx
mov eax, dword [eax + 0xc]
bswap edx
mov dword [esp + 0xc], edx
bswap eax
mov dword [esp + 8], eax
mov dword [esp + 0x14], esi
mov esi, dword [ebp + 8]
mov dword [esp + 0x10], ecx
mov esi, dword [esi + 0x20]
mov dword [esp + 0x1c], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 0x2c]
mov dword [esp + 0x18], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 0x28]
je 0x44d19c
mov dword [esp + 4], esi
mov esi, dword [esp + 0x18]
and ebx, 0xfffffff0
add edi, 8
neg ebx
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [esp + 0x1c]
bswap eax
bswap ecx
xor dword [esp + 8], ecx
mov ecx, dword [edi - 4]
xor dword [esp + 0xc], eax
mov eax, dword [edi - 8]
bswap eax
bswap ecx
xor dword [esp + 0x10], ecx
xor dword [esp + 0x14], eax
lea ecx, [esp + 8]
push esi
push dword [esp + 8]
push dword [esp + 0x28]
call fcn.0044cd60
add esp, 0xc
add edi, 0x10
add ebx, 0x10
jne 0x44d144
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [esp + 8]
mov esi, dword [esp + 4]
bswap edx
bswap eax
bswap ecx
movd xmm0, eax
movd xmm1, edx
mov eax, dword [ebp + 8]
punpckldq xmm1, xmm0
movd xmm0, ecx
bswap esi
movd xmm2, esi
punpckldq xmm2, xmm0
punpcklqdq xmm2, xmm1
movdqa xmmword [eax], xmm2
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44d1d3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
movq xmm0, qword [eax]
movq xmm1, qword [eax + 8]
mov eax, 0xfffffff0
movq qword [esp + 0x10], xmm1
movq qword [esp + 8], xmm0
mov ecx, dword [esp + eax + 0x18]
mov edx, dword [esp + eax + 0x1c]
xor dword [edi + eax + 0x10], ecx
xor dword [edi + eax + 0x14], edx
add eax, 8
jne 0x44d1ff
test byte [0x5195f3], 1
je 0x44d236
mov eax, dword [0x5195f4]
and eax, 2
je 0x44d236
lea eax, [edi + 0x20]
push eax
push edi
call fcn.00451fe0
add esp, 8
jmp 0x44d2ab
mov ecx, dword [edi + 8]
lea esi, [esp + 8]
mov eax, dword [edi + 0x24]
mov edx, dword [edi + 0x20]
mov ebx, dword [edi + 0x28]
bswap ecx
mov dword [esp + 4], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 0xc]
bswap ecx
mov dword [esi], ecx
mov ecx, dword [edi]
bswap ecx
mov dword [esi + 0xc], ecx
mov ecx, dword [edi + 4]
bswap ecx
mov dword [esi + 8], ecx
mov ecx, esi
push eax
push ebx
push dword [esp + 0xc]
call fcn.0044cd60
add esp, 0xc
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0xc]
mov edx, dword [esi]
mov esi, dword [esi + 4]
bswap eax
bswap ecx
bswap esi
bswap edx
movd xmm0, edx
movd xmm1, esi
movd xmm3, ecx
movd xmm2, eax
punpckldq xmm1, xmm0
punpckldq xmm2, xmm3
punpcklqdq xmm2, xmm1
movdqa xmmword [edi], xmm2
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x44d2b3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edx, dword [0x5195f4]
xor eax, eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
bt edx, 9
setae al
or eax, 2
xor ecx, ecx
inc ecx
bt edx, 0x19
cmovae ecx, eax
mov eax, dword [ebp + 0x10]
cmp ecx, 1
movups xmm0, xmmword [eax + 4]
mov eax, dword [eax]
mov eax, dword [eax]
je 0x44d308
cmp ecx, 2
jne 0x44d31b
mov ecx, esp
lea edx, [esp + 0x10]
movups xmmword [ecx], xmm0
push eax
push edx
push ecx
call fcn.00450440
jmp 0x44d32c
mov ecx, esp
lea edx, [esp + 0x10]
movups xmmword [ecx], xmm0
push eax
push edx
push ecx
call fcn.00450480
jmp 0x44d32c
mov ecx, esp
lea edx, [esp + 0x10]
movups xmmword [ecx], xmm0
push eax
push edx
push ecx
call fcn.004acec0
add esp, 0xc
movsd xmm0, qword [edi]
movsd xmm1, qword [edi + 8]
mov eax, 0xfffffff0
movsd qword [esp + 8], xmm1
movsd qword [esp], xmm0
mov ecx, dword [esp + eax + 0x10]
mov edx, dword [esp + eax + 0x14]
xor dword [esp + eax + 0x20], ecx
xor dword [esp + eax + 0x24], edx
add eax, 8
jne 0x44d348
movups xmm0, xmmword [esp + 0x10]
mov eax, esi
movups xmmword [esi], xmm0
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x450480
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
movups xmm2, xmmword [eax]
mov ecx, dword [edx + 0xf0]
mov eax, dword [esp + 8]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
lea edx, [edx + 0x20]
xorps xmm2, xmm0
aesenc xmm2, xmm1
dec ecx
movups xmm1, xmmword [edx]
lea edx, [edx + 0x10]
jne 0x4504a2
aesenclast xmm2, xmm1
pxor xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [eax], xmm2
pxor xmm2, xmm2
ret
Function at 0x45bc8d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
lea ebx, [esp + 8]
mov dword [ebx], 1
add ecx, eax
mov dword [ebx + 4], eax
lea eax, [esp + 0x18]
mov dword [ebx + 8], ecx
mov word [ebx + 0xc], 0
push ebx
push eax
call fcn.0046be3f
add esp, 8
mov eax, 0x800
mov ebp, esp
xor edi, edi
lea esi, [esp + 4]
mov dword [ebp], eax
mov dword [esi], edi
push edi
push eax
call fcn.00415b38
add esp, 8
mov ecx, dword [esp + 0x3c]
mov dword [ebx], eax
mov dword [ebx + 4], edx
lea edx, [esp + 0x18]
mov dword [ebx + 8], edi
mov ebx, dword [edx]
mov edi, dword [ecx]
push ebp
push eax
push esi
push 0
push ebx
push edi
call sub.ADVAPI32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x45bd1b
push dword [esp]
lea eax, [esp + 0xc]
push eax
call fcn.0046bdec
add esp, 8
mov eax, dword [esp + 8]
jmp 0x45bcf2
test eax, eax
jne 0x45bd40
mov eax, dword [esp]
mov esi, dword [esp + 0x38]
lea edi, [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 4]
cmp eax, 0xb
jbe 0x45bd6b
mov eax, 0xde
xor ecx, ecx
jmp 0x45bd4a
mov esi, dword [esp + 0x38]
xor ecx, ecx
lea edi, [esp + 0x18]
lea ebx, [esp + 8]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov byte [esi + 0xc], 0xc
push ebx
call fcn.004011c0
add esp, 4
push ebx
call fcn.00414190
add esp, 4
jmp 0x45bd7f
mov ecx, dword [esp + 0x10]
movsd xmm0, qword [esp + 8]
mov dword [esi + 8], ecx
movsd qword [esi], xmm0
mov byte [esi + 0xc], al
push edi
call fcn.004011c0
add esp, 4
push edi
call fcn.0046befb
add esp, 4
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4675d3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov esi, dword [esp + 0xa0]
mov edi, dword [esi]
push esi
call fcn.00466893
add esp, 4
mov ecx, dword [edi + 0x10]
cmp ecx, eax
jbe 0x4677d4
mov ecx, dword [edi + 8]
lea edx, [eax + eax*8]
lea edx, [edx + edx*2]
add edx, eax
cmp dword [ecx + edx], 2
je 0x4677e5
add ecx, edx
mov edi, dword [esp + 0x9c]
movzx eax, byte [ecx + 0x18]
cmp eax, 8
je 0x467663
cmp eax, 9
je 0x46762f
cmp eax, 0xc
jne 0x4677f8
mov eax, dword [esi + 0x10]
movsd xmm0, qword [esi]
movsd xmm1, qword [esi + 8]
lea ecx, [esp + 0x50]
mov dword [ecx + 0x10], eax
movsd qword [ecx + 8], xmm1
movsd qword [ecx], xmm0
lea eax, [edi + 4]
push ecx
push eax
call fcn.004680eb
add esp, 8
mov dword [edi], 0
jmp 0x4677c7
mov eax, dword [esi + 0x10]
movsd xmm0, qword [esi]
movsd xmm1, qword [esi + 8]
lea ebx, [esp + 0x50]
xor edi, edi
mov dword [esp], edi
mov dword [esp + 8], edi
mov dword [ebx + 0x10], eax
movsd qword [ebx + 8], xmm1
movsd qword [ebx], xmm0
push ebx
call fcn.00466893
add esp, 4
mov ecx, dword [ebx + 0x10]
lea esi, [esp + 0x6c]
inc ecx
push eax
push ecx
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
push dword [ebx]
push esi
call fcn.00465d5b
add esp, 0x1c
lea ebp, [esp + 0xc]
push esi
push ebp
call fcn.00465f36
add esp, 8
cmp dword [ebp], edi
je 0x46778f
lea ebp, [esp + 0x5c]
mov esi, esp
mov eax, dword [esp + 0x1c]
movsd xmm0, qword [esp + 0xc]
movsd xmm1, qword [esp + 0x14]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x3c]
movsd qword [esp + 0x44], xmm1
movsd qword [esp + 0x3c], xmm0
push eax
push ebx
call fcn.00467f6c
add esp, 8
mov eax, dword [esp + 0x58]
movsd xmm0, qword [esp + 0x50]
movsd xmm2, qword [ebp]
movsd xmm1, qword [ebp + 8]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
movsd qword [esp + 0x20], xmm0
movsd qword [esp + 0x2c], xmm2
movsd qword [esp + 0x34], xmm1
push eax
push esi
push ebx
call fcn.004665bb
add esp, 0xc
push ebx
call fcn.004663a0
add esp, 4
mov edi, eax
mov eax, dword [eax + 8]
cmp eax, dword [edi + 4]
jne 0x467753
push eax
push edi
call fcn.004242c1
add esp, 8
mov eax, dword [edi + 8]
mov ecx, dword [edi]
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x34]
shl eax, 4
movsd qword [ecx + eax + 8], xmm1
movsd qword [ecx + eax], xmm0
inc dword [edi + 8]
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00465f36
add esp, 8
cmp dword [esp + 0xc], 0
jne 0x4676cc
lea eax, [esp + 0x6c]
push eax
call fcn.00465ede
add esp, 4
lea eax, [esp + 0x78]
push eax
call fcn.00465eb3
add esp, 4
mov eax, dword [esp + 8]
mov edi, dword [esp + 0x9c]
movsd xmm0, qword [esp]
mov dword [edi + 0xc], eax
movsd qword [edi + 4], xmm0
mov dword [edi], 1
mov eax, edi
add esp, 0x88
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5097f0
push ecx
push eax
call fcn.004b4860
add esp, 0xc
ud2
push 0x509828
push 0x28
push 0x509800
call fcn.004b47c0
jmp 0x4677e0
call fcn.004672bc
ud2
Function at 0x477470
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x43c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x492040
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x2c], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
cmp esi, 0x201
jae 0x477500
jmp 0x4774ee
jbe 0x477594
cmp esi, 0x201
jae 0x477500
mov dword [ebp - 0x28], 0x200
lea ebx, [ebp - 0x448]
mov edi, esi
jmp 0x47753b
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x47752c
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x38]
mov edx, edi
push esi
call fcn.004b3860
add esp, 4
mov eax, dword [ebp - 0x38]
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x47755f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4775f7
cmp esi, edi
jne 0x4774e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x477613
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x4774ee
jmp 0x477500
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0
cmp esi, eax
ja 0x477630
lea eax, [ebp - 0x48]
push esi
push ebx
push eax
call fcn.0047d080
add esp, 0xc
movsd xmm0, qword [ebp - 0x48]
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x40]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4775e1
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.00414130
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x43c
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov byte [esi], 0
mov dword [esi + 4], eax
mov byte [esi + 0xc], 2
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4775d1
jmp 0x4775e1
mov dword [ebp - 0x10], 0
push 0x50db60
push 0x28
push str.internal_error:_entered_unreachable_codeP
call fcn.004b47c0
add esp, 0xc
jmp 0x47763f
push 0x50db50
push eax
push esi
call fcn.004b4c10
add esp, 0xc
ud2
Function at 0x478a60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
mov dword [esi + 0x6c], esp
mov dword [esi + 0x78], 0xffffffff
mov dword [esi + 0x74], 0x4920b0
mov ebx, dword [ebp + 8]
movaps xmm0, xmmword [0x50aec0]
mov edx, dword [ebp + 0xc]
lea edi, [esi + 0x20]
lea ecx, [esi + 4]
mov eax, dword fs:[0]
mov dword [esi + 0x70], eax
lea eax, [esi + 0x70]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x3c], 0
mov word [esi + 0x40], 0
mov dword [esi + 0x20], 0
movups xmmword [esi + 0x28], xmm0
mov dword [esi + 0x38], 0
mov byte [esi + 0x3c], 1
push edi
push eax
call fcn.00485370
add esp, 8
cmp byte [esi + 4], 4
jne 0x478ae5
mov edx, dword [esi + 8]
jmp 0x478af3
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
cmp al, 4
jne 0x478ba3
lea ecx, [esi + 0x20]
mov dword [esi + 0x1c], edx
mov dword [esi + 0xc], edx
call fcn.004855a0
mov eax, dword [esi + 0x20]
xor eax, 2
or eax, dword [esi + 0x24]
jne 0x478b70
movzx eax, byte [esi + 0x28]
mov ebx, dword [esi + 0x2c]
cmp al, 4
je 0x478b73
cmp al, 3
jne 0x478b5e
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esi + 0x18], ebx
mov dword [esi + 0x78], 1
mov dword [esi + 0x10], eax
push eax
mov dword [esi + 0x14], ecx
call dword [ecx]
add esp, 4
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx + 4]
test eax, eax
je 0x478b4f
push dword [ecx + 8]
push eax
push dword [esi + 0x10]
call fcn.00414130
add esp, 0xc
push 4
push 0xc
push dword [esi + 0x18]
call fcn.00414130
add esp, 0xc
mov eax, 1
xor ebx, ebx
xor edi, edi
mov dword [esi + 0x78], 2
jmp 0x478bcf
mov ebx, dword [esi + 0x58]
test ebx, ebx
je 0x478bc3
setns al
js 0x478c62
movzx edi, al
movzx eax, byte [0x519171]
push edi
push ebx
call fcn.00414120
add esp, 8
test eax, eax
je 0x478c70
mov edi, 1
jmp 0x478bcf
mov ecx, eax
mov byte [ebx + 4], al
shr eax, 0x18
shr ecx, 8
mov byte [ebx + 7], al
mov word [ebx + 5], cx
mov dword [ebx + 8], edx
mov dword [ebx], 0
jmp 0x478c4f
mov edi, 1
xor ebx, ebx
mov eax, 1
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], 0
mov dword [esi + 0x78], 2
lea eax, [esi + 0x1c]
lea ecx, [esi + 4]
lea edx, [esi + 0x20]
push ebx
push edi
push eax
call fcn.0047add0
add esp, 0xc
movzx eax, byte [esi + 4]
mov ebx, dword [ebp + 8]
cmp al, 4
jne 0x478c13
mov eax, dword [esi + 0x28]
movsd xmm0, qword [esi + 0x20]
mov dword [ebx + 8], eax
movsd qword [ebx], xmm0
jmp 0x478c46
movzx ecx, byte [esi + 7]
movzx edi, word [esi + 5]
mov edx, dword [esi + 8]
mov byte [ebx + 7], cl
mov word [ebx + 5], di
mov byte [ebx + 4], al
mov eax, dword [esi + 0x24]
mov dword [ebx + 8], edx
mov dword [ebx], 0
test eax, eax
je 0x478c46
push 1
push eax
push dword [esi + 0x20]
call fcn.00414130
add esp, 0xc
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x78], 0
call fcn.004994d0
jmp 0x478c81
mov dword [esi + 0x78], 0
push ebx
push edi
call fcn.004b45c0
add esp, 8
ud2
Function at 0x47ccb0
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x2c]
xor ebp, ebp
mov ecx, dword [eax]
cmp edi, 0x3b9aca00
je 0x47cd0e
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov ebx, 0x3e8
mov dword [esp], ecx
mul ebx
mov ebp, eax
mov eax, esi
seto cl
mul ebx
mov ebx, edx
mov esi, eax
add ebx, ebp
mov ebp, 0xffffffff
setb al
or al, cl
jne 0x47cd0b
mov ecx, 0x431bde83
mov eax, edi
mul ecx
shr edx, 0x12
add esi, edx
adc ebx, 0
jae 0x47cd56
mov ecx, dword [esp]
mov dword [esp + 4], ebp
lea eax, [esp + 4]
push 4
push eax
push 0x1006
push 0xffff
push ecx
call dword [sym.imp.ws2_32.dll_setsockopt]
mov esi, dword [esp + 0x1c]
mov cl, 4
cmp eax, 0xffffffff
jne 0x47cd4a
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
imul eax, edx, 0xf4240
xor ecx, ecx
sub edi, eax
setne cl
add esi, ecx
mov ecx, dword [esp]
adc ebx, 0
jb 0x47cd0e
xor ebp, ebp
neg ebx
sbb ebp, ebp
or ebp, esi
jne 0x47cd0e
mov esi, dword [esp + 0x1c]
mov byte [esi], 2
mov dword [esi + 4], 0x50d2e0
jmp 0x47cd4c

Function at 0x47cd90
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x2c]
xor ebp, ebp
mov ecx, dword [eax]
cmp edi, 0x3b9aca00
je 0x47cdee
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov ebx, 0x3e8
mov dword [esp], ecx
mul ebx
mov ebp, eax
mov eax, esi
seto cl
mul ebx
mov ebx, edx
mov esi, eax
add ebx, ebp
mov ebp, 0xffffffff
setb al
or al, cl
jne 0x47cdeb
mov ecx, 0x431bde83
mov eax, edi
mul ecx
shr edx, 0x12
add esi, edx
adc ebx, 0
jae 0x47ce36
mov ecx, dword [esp]
mov dword [esp + 4], ebp
lea eax, [esp + 4]
push 4
push eax
push 0x1005
push 0xffff
push ecx
call dword [sym.imp.ws2_32.dll_setsockopt]
mov esi, dword [esp + 0x1c]
mov cl, 4
cmp eax, 0xffffffff
jne 0x47ce2a
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
imul eax, edx, 0xf4240
xor ecx, ecx
sub edi, eax
setne cl
add esi, ecx
mov ecx, dword [esp]
adc ebx, 0
jb 0x47cdee
xor ebp, ebp
neg ebx
sbb ebp, ebp
or ebp, esi
jne 0x47cdee
mov esi, dword [esp + 0x1c]
mov byte [esi], 2
mov dword [esi + 4], 0x50d2e0
jmp 0x47ce2c
Function at 0x47ce70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x18]
mov eax, dword [edi + 4]
mov ebx, dword [edi + 8]
mov ecx, eax
sub ecx, ebx
jb 0x47cede
cmp ecx, 0x7fffffff
mov edx, 0x7fffffff
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmovb edx, ecx
mov ecx, dword [edi]
add ecx, ebx
push 0
push edx
push ecx
push dword [eax]
call dword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
je 0x47cec0
add eax, ebx
mov dword [edi + 8], eax
mov ecx, dword [edi + 0xc]
cmp ecx, eax
cmova eax, ecx
mov dword [edi + 0xc], eax
jmp 0x47cecd
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x274a
jne 0x47ced6
mov byte [esi], 4
mov eax, esi
pop esi
pop edi
pop ebx
ret
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x47ced0
push 0x50c218
push eax
push ebx
call fcn.004b4ba0
add esp, 0xc
ud2

Function at 0x47cf60
Capabilities:
Send data
Send data on socket

Disassembly:
push edi
push esi
push eax
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp], 0
mov edi, esp
mov ecx, dword [ecx]
push 0
push 0
push 0
push edi
push edx
push eax
push ecx
call dword [sym.imp.ws2_32.dll_WSASend]
cmp eax, 0xffffffff
je 0x47cf9e
mov eax, dword [esp]
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x47cfad
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
mov eax, esi
add esp, 4
pop esi
pop edi
ret

Function at 0x47cfc0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, 0x7fffffff
cmp eax, 0x7fffffff
cmovb edx, eax
push 0
push edx
push dword [esp + 0x18]
push dword [ecx]
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x47cff8
mov dword [esi + 4], eax
mov byte [esi], 4
mov eax, esi
pop esi
ret
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov byte [esi], 0
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov eax, esi
pop esi
ret

Function at 0x47d020
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, 0x7fffffff
cmp eax, 0x7fffffff
cmovb edx, eax
push 0
push edx
push dword [esp + 0x18]
push dword [ecx]
call dword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x47d060
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 0x274a
jne 0x47d06a
mov dword [esi + 4], eax
mov byte [esi], 4
mov eax, esi
pop esi
ret
mov byte [esi], 0
mov dword [esi + 4], ecx
mov eax, esi
pop esi
ret