joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439b30
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6a70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
mov eax, dword [0x5015f0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
movzx eax, byte [0x50420c]
test eax, eax
je 0x439bcd
push 0x1c3
push str.common_src_base_tcp_srcCoIoTcpDescriptor_WinNT.cpp
call sym.MANAGER.exe_public:_static_void___cdecl_WireTap::CoMsg::setModule_char_const___int_
add esp, 8
push sym.MANAGER.exe_public:_static_void___cdecl_WireTap::CoMsg::postDebug_char_const___char_const___char__
lea ecx, [ebp - 0x128]
call sym.MANAGER.exe_public:_void___thiscall_WireTap::CoMsgBuilder_0_::constructor_void____cdecl___char_const___char_const___char___
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x130], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
push edx
push str.Calling_getaddrinfo___s__.
mov eax, dword [ebp - 0x130]
push eax
call sym.MANAGER.exe_public:_void___cdecl_WireTap::CoMsgBuilder_0_::operator___char_const__
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x128]
call sym.MANAGER.exe_public_virtual:_void___thiscall_WireTap::CoMsgBuilder_0_::destructor_void_
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [0x4b0a14]
test eax, eax
je 0x439be7
xor al, al
jmp 0x439c65
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x439c52
movzx ecx, byte [ebp + 0x10]
neg ecx
sbb ecx, ecx
and ecx, 4
or ecx, 1
push ecx
push 0
push 0
push 0x100
lea edx, [ebp - 0x11c]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x18]
push eax
call dword [0x4b09fc]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x439c47
lea ecx, [ebp - 0x11c]
push ecx
mov ecx, dword [ebp + 0xc]
call dword [0x4b06b4]
jmp 0x439c52
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x14], eax
jmp 0x439bed
mov ecx, dword [ebp - 0x10]
push ecx
call dword [0x4b0a20]
xor eax, eax
cmp dword [ebp - 0x14], 0
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x18]
call fcn.0041c9ce
mov esp, ebp
pop ebp
ret
Function at 0x439d60
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6ac4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x1c], ecx
movzx eax, byte [ebp + 8]
mov dword [ebp - 0x10], eax
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0xffff
mov ecx, dword [ebp - 0x1c]
call sym.MANAGER.exe_public:_int___thiscall_WireTap::CoIoDescriptor::id_void_const
push eax
call dword [0x4b09b4]
test eax, eax
jge 0x439dfc
push 0x45
push str.common_src_base_tcp_srcCoIoTcpDescriptor.cpp
call sym.MANAGER.exe_public:_static_void___cdecl_WireTap::CoMsg::setModule_char_const___int_
add esp, 8
push sym.MANAGER.exe_public:_static_void___cdecl_WireTap::CoMsg::postDebug_char_const___char_const___char__
lea ecx, [ebp - 0x18]
call sym.MANAGER.exe_public:_void___thiscall_WireTap::CoMsgBuilder_0_::constructor_void____cdecl___char_const___char_const___char___
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], 0
push 1
mov ecx, dword [ebp - 0x1c]
call sym.MANAGER.exe_protected:_char_const____thiscall_WireTap::CoIoDescriptor::setLastError_enum_WireTap::CoIoDescriptor::IoError_
push eax
push str.Cant_set_socket_option:__s.
mov eax, dword [ebp - 0x24]
push eax
call sym.MANAGER.exe_public:_void___cdecl_WireTap::CoMsgBuilder_0_::operator___char_const__
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call sym.MANAGER.exe_public_virtual:_void___thiscall_WireTap::CoMsgBuilder_0_::destructor_void_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x439e10
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x5015f0]
mov dword [ebp - 8], eax
call sym.MANAGER.exe_public:_static_void___cdecl_WireTap::CoIoTcpDescriptor::init_void_
mov dword [ebp - 0x8c], 0x80
push 0x80
lea eax, [ebp - 0x88]
push eax
call dword [0x4b09ec]
test eax, eax
je 0x439e4a
xor al, al
jmp 0x439eb2
push 0x2e
lea ecx, [ebp - 0x88]
push ecx
call dword [0x4b08c0]
add esp, 8
mov dword [ebp - 0x90], eax
mov dword [ebp - 4], str..local
cmp dword [ebp - 0x90], 0
je 0x439ea0
mov edx, dword [ebp - 4]
push edx
call fcn.004a3a52
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x90]
push ecx
call dword [0x4b07a0]
add esp, 0xc
test eax, eax
je 0x439ea0
mov edx, dword [ebp - 0x90]
mov byte [edx], 0
lea eax, [ebp - 0x88]
push eax
mov ecx, dword [ebp + 8]
call dword [0x4b06b4]
mov al, 1
mov ecx, dword [ebp - 8]
call fcn.0041c9ce
mov esp, ebp
pop ebp
ret
Function at 0x43e330
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x4b84c4
call dword [0x4b07ac]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43e369
push str.TEMP
call dword [0x4b07ac]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43e369
mov eax, 0x4b84cd
jmp 0x43e36c
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x43e370
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7001
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x72c
mov eax, dword [0x5015f0]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x728], ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x43e445
lea ecx, [ebp - 0x50]
push ecx
mov ecx, dword [ebp - 0x728]
call sym.MANAGER.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_WireTap::CoFilePath::directoryName_void_
mov dword [ebp - 0x72c], eax
mov edx, dword [ebp - 0x72c]
mov dword [ebp - 0x730], edx
mov dword [ebp - 4], 0
push 0
push 0
mov ecx, dword [ebp - 0x730]
call dword [0x4b069c]
push eax
lea ecx, [ebp - 0x34]
call sym.MANAGER.exe_public:_void___thiscall_WireTap::CoFilePath::constructor_char_const___char_const___char_const__
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x50]
call dword [0x4b0504]
lea ecx, [ebp - 0x34]
call sym.MANAGER.exe_public:_bool___thiscall_WireTap::CoFilePath::exists_void_const
movzx eax, al
test eax, eax
jne 0x43e436
mov ecx, dword [ebp - 0x728]
call sym.MANAGER.exe_public:_char_const____thiscall_WireTap::CoFilePath::path_void_const
push eax
lea ecx, [ebp - 0x34]
call sym.MANAGER.exe_public:_char_const____thiscall_WireTap::CoFilePath::path_void_const
push eax
call fcn.004a3a58
add esp, 8
test eax, eax
je 0x43e436
mov cl, byte [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x34]
call sym.MANAGER.exe_public:_void___thiscall_WireTap::CoFilePath::createDir_class_WireTap::CoFilePath::Permissions_const___bool_const
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call sym.MANAGER.exe_public_virtual:_void___thiscall_WireTap::CoFilePath::destructor_void_
mov eax, dword [ebp + 8]
push eax
call fcn.0043e4f0
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x728]
call sym.MANAGER.exe_public:_char_const____thiscall_WireTap::CoFilePath::path_void_const
push eax
call dword [0x4b0748]
add esp, 4
test eax, eax
je 0x43e4c7
push 0x4b84d0
push 0x66
lea ecx, [ebp - 0x724]
call sym.MANAGER.exe_public:_void___thiscall_WireTap::CoException::constructor_int__char_const__
mov dword [ebp - 0x734], eax
mov ecx, dword [ebp - 0x734]
mov dword [ebp - 0x738], ecx
mov dword [ebp - 4], 3
push 0
mov ecx, dword [ebp - 0x728]
call sym.MANAGER.exe_protected:_char_const____thiscall_WireTap::CoFilePath::errnoString_void_const
push eax
mov edx, dword [ebp - 0x738]
push edx
call sym.MANAGER.exe_public:_void___cdecl_WireTap::CoException::fire_char_const___char_const__
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x724]
call sym.MANAGER.exe_public_virtual:_void___thiscall_WireTap::CoException::destructor_void_
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x728]
call sym.MANAGER.exe_public:_void___thiscall_WireTap::CoFilePath::chmod_class_WireTap::CoFilePath::Permissions_const__const
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0041c9ce
mov esp, ebp
pop ebp
ret 8
Function at 0x43e540
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7016
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6e0
mov dword [ebp - 0x6e4], ecx
mov ecx, dword [ebp - 0x6e4]
call sym.MANAGER.exe_public:_char_const____thiscall_WireTap::CoFilePath::path_void_const
push eax
call dword [0x4b0744]
add esp, 4
test eax, eax
je 0x43e5d7
push 0x4b8504
push 0x6c
lea ecx, [ebp - 0x6e0]
call sym.MANAGER.exe_public:_void___thiscall_WireTap::CoException::constructor_int__char_const__
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x6ec], eax
mov dword [ebp - 4], 0
push 0
mov ecx, dword [ebp - 0x6e4]
call sym.MANAGER.exe_protected:_char_const____thiscall_WireTap::CoFilePath::errnoString_void_const
push eax
mov ecx, dword [ebp - 0x6ec]
push ecx
call sym.MANAGER.exe_public:_void___cdecl_WireTap::CoException::fire_char_const___char_const__
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6e0]
call sym.MANAGER.exe_public_virtual:_void___thiscall_WireTap::CoException::destructor_void_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x440460
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.HOME
call dword [0x4b07ac]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x440487
call sym.MANAGER.exe_public:_static_char_const____cdecl_WireTap::CoFilePath::tempDir_void_
mov dword [ebp - 8], eax
jmp 0x44048d
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4404d0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a721d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6e0
mov dword [ebp - 0x6e4], ecx
mov ecx, dword [ebp + 8]
call sym.MANAGER.exe_public:_char_const____thiscall_WireTap::CoFilePath::path_void_const
push eax
mov ecx, dword [ebp - 0x6e4]
call sym.MANAGER.exe_public:_char_const____thiscall_WireTap::CoFilePath::path_void_const
push eax
call dword [0x4b07f0]
add esp, 8
cmp eax, 0xffffffff
jne 0x440574
push str.common_src_base_fileUtil_srcCoFilePath.cpp
push 0x197
lea ecx, [ebp - 0x6e0]
call sym.MANAGER.exe_public:_void___thiscall_WireTap::CoException::constructor_int__char_const__
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x6ec], eax
mov dword [ebp - 4], 0
push 0
mov ecx, dword [ebp - 0x6e4]
call sym.MANAGER.exe_protected:_char_const____thiscall_WireTap::CoFilePath::errnoString_void_const
push eax
mov ecx, dword [ebp - 0x6ec]
push ecx
call sym.MANAGER.exe_public:_void___cdecl_WireTap::CoException::fire_char_const___char_const__
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6e0]
call sym.MANAGER.exe_public_virtual:_void___thiscall_WireTap::CoException::destructor_void_
mov ecx, dword [ebp + 8]
call sym.MANAGER.exe_public:_char_const____thiscall_WireTap::CoFilePath::path_void_const
push eax
mov ecx, dword [ebp - 0x6e4]
call sym.MANAGER.exe_public:_void___thiscall_WireTap::CoFilePath::setPath_char_const__
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x442140
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7357
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6e4
mov dword [ebp - 0x6e8], ecx
mov eax, dword [ebp - 0x6e8]
mov ecx, dword [eax + 0x20]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x4b07c8]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x6e8]
mov eax, dword [edx + 0x20]
mov ecx, dword [eax + 0xc]
and ecx, 0x20
je 0x4421f4
push 0x4b88c4
push 0x85
lea ecx, [ebp - 0x6e4]
call sym.MANAGER.exe_public:_void___thiscall_WireTap::CoException::constructor_int__char_const__
mov dword [ebp - 0x6ec], eax
mov edx, dword [ebp - 0x6ec]
mov dword [ebp - 0x6f0], edx
mov dword [ebp - 4], 0
push 0
mov ecx, dword [ebp - 0x6e8]
call sym.MANAGER.exe_protected:_char_const____thiscall_WireTap::CoFilePath::errnoString_void_const
push eax
mov eax, dword [ebp - 0x6f0]
push eax
call sym.MANAGER.exe_public:_void___cdecl_WireTap::CoException::fire_char_const___char_const__
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6e4]
call sym.MANAGER.exe_public_virtual:_void___thiscall_WireTap::CoException::destructor_void_
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x442300
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7381
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6e4
mov dword [ebp - 0x6e8], ecx
mov eax, dword [ebp - 0x6e8]
mov ecx, dword [eax + 0x20]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x4b07f8]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x6e8]
mov eax, dword [edx + 0x20]
mov ecx, dword [eax + 0xc]
and ecx, 0x20
je 0x4423b4
push 0x4b891c
push 0xa7
lea ecx, [ebp - 0x6e4]
call sym.MANAGER.exe_public:_void___thiscall_WireTap::CoException::constructor_int__char_const__
mov dword [ebp - 0x6ec], eax
mov edx, dword [ebp - 0x6ec]
mov dword [ebp - 0x6f0], edx
mov dword [ebp - 4], 0
push 0
mov ecx, dword [ebp - 0x6e8]
call sym.MANAGER.exe_protected:_char_const____thiscall_WireTap::CoFilePath::errnoString_void_const
push eax
mov eax, dword [ebp - 0x6f0]
push eax
call sym.MANAGER.exe_public:_void___cdecl_WireTap::CoException::fire_char_const___char_const__
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6e4]
call sym.MANAGER.exe_public_virtual:_void___thiscall_WireTap::CoException::destructor_void_
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x459310
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 4]
test ecx, ecx
jne 0x459330
mov edx, dword [ebp - 8]
push edx
call fcn.004564c0
add esp, 4
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [0x4b07ac]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45935d
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
add eax, 0x11
push eax
call fcn.00456870
add esp, 8
jmp 0x459370
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00456700
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x4597e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 4]
test ecx, ecx
jne 0x459800
mov edx, dword [ebp - 8]
push edx
call fcn.00456500
add esp, 4
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [0x4b07ac]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45982d
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
add eax, 0x14
push eax
call fcn.00456930
add esp, 8
jmp 0x459840
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00456710
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x459cb0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 4]
test ecx, ecx
jne 0x459cd0
mov edx, dword [ebp - 8]
push edx
call fcn.00456540
add esp, 4
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [0x4b07ac]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x459cfd
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
add eax, 0x14
push eax
call fcn.00456950
add esp, 8
jmp 0x459d10
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00456720
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x45a280
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + 4]
test ecx, ecx
jne 0x45a2a0
mov edx, dword [ebp - 0xc]
push edx
call fcn.00456580
add esp, 4
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
call dword [0x4b07ac]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45a2cd
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x14
push eax
call fcn.00456840
add esp, 8
jmp 0x45a2f1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 8], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x10]
push eax
call dword [0x4b0510]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00456740
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x467160
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x50498c]
and eax, 1
jne 0x467190
mov ecx, dword [0x50498c]
or ecx, 1
mov dword [0x50498c], ecx
push str.SW_WIRETAP_MULTICAST_PORT
call dword [0x4b07ac]
add esp, 4
mov dword [0x504988], eax
mov edx, dword [0x50498c]
and edx, 2
jne 0x4671d5
mov eax, dword [0x50498c]
or al, 2
mov dword [0x50498c], eax
cmp dword [0x504988], 0
je 0x4671c5
mov ecx, dword [0x504988]
push ecx
call dword [0x4b07b0]
add esp, 4
mov dword [ebp - 4], eax
jmp 0x4671cc
mov dword [ebp - 4], 0
mov edx, dword [ebp - 4]
mov dword [0x504984], edx
cmp dword [0x504984], 0
jle 0x4671e5
mov eax, dword [0x504984]
jmp 0x4671f5
cmp dword [ebp + 8], 0
jbe 0x4671f0
mov eax, dword [ebp + 8]
jmp 0x4671f5
mov eax, 0x1d83
mov esp, ebp
pop ebp
ret

Function at 0x467200
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.SW_WIRETAP_MULTICAST_SCOPE
call dword [0x4b07ac]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x467222
mov eax, dword [str.224.0.0.1]
jmp 0x467225
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x467230
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push str.SW_WIRETAP_MULTICAST_IFACE
call dword [0x4b07ac]
add esp, 4
pop ebp
ret

Function at 0x467250
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.SW_WIRETAP_MULTICAST_TTL
call dword [0x4b07ac]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x467272
mov eax, 1
jmp 0x46727f
mov eax, dword [ebp - 4]
push eax
call dword [0x4b07b0]
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x479800
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0xedb88320
mov dword [ebp - 4], 0
jmp 0x47981f
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jae 0x47987a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
jmp 0x479840
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jae 0x47986b
mov eax, dword [ebp - 0x10]
and eax, 1
je 0x47985b
mov ecx, dword [ebp - 0x10]
shr ecx, 1
xor ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
jmp 0x479863
mov edx, dword [ebp - 0x10]
shr edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x479837
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov dword [ecx*4 + 0x5049d0], edx
jmp 0x479816
mov byte [0x504dd0], 1
mov esp, ebp
pop ebp
ret
Function at 0x4840a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ab81e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x72c
mov eax, dword [0x5015f0]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x724], ecx
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x724]
mov ecx, dword [eax + 0x1c]
movzx edx, word [ecx]
cmp edx, 0x17
jne 0x484123
mov eax, dword [ebp - 0x724]
add eax, 0x20
push eax
mov ecx, dword [ebp - 0x724]
mov edx, dword [ecx + 0x1c]
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.00483c90
add esp, 0xc
push 0x14
lea ecx, [ebp - 0x28]
push ecx
push 0xc
push 0x29
mov edx, dword [ebp - 0x724]
mov eax, dword [edx + 0x3c]
push eax
call dword [0x4b09b4]
mov dword [ebp - 0x10], eax
jmp 0x484170
push 8
push 0
lea ecx, [ebp - 0x30]
push ecx
call fcn.0041ce38
add esp, 0xc
mov edx, dword [ebp - 0x724]
add edx, 0x20
push edx
mov eax, dword [ebp - 0x724]
mov ecx, dword [eax + 0x1c]
push ecx
lea edx, [ebp - 0x30]
push edx
call fcn.00483c40
add esp, 0xc
push 8
lea eax, [ebp - 0x30]
push eax
push 0xc
push 0
mov ecx, dword [ebp - 0x724]
mov edx, dword [ecx + 0x3c]
push edx
call dword [0x4b09b4]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x484247
call dword [0x4b07c0]
cmp dword [eax], 0x13
jne 0x484191
mov dword [ebp - 0x728], str.__Check_the_default_multicast_gateway_route_entry
jmp 0x48419b
mov dword [ebp - 0x728], 0x4c0bee
push 0
lea eax, [ebp - 0x720]
push eax
call fcn.00483430
add esp, 8
mov dword [ebp - 0x72c], eax
mov ecx, dword [ebp - 0x72c]
mov dword [ebp - 0x730], ecx
mov dword [ebp - 4], 0
push 0x4c0b94
push 0x1d4
lea ecx, [ebp - 0x704]
call sym.MANAGER.exe_public:_void___thiscall_WireTap::CoException::constructor_int__char_const__
mov dword [ebp - 0x734], eax
mov edx, dword [ebp - 0x734]
mov dword [ebp - 0x738], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x728]
push eax
mov ecx, dword [ebp - 0x724]
call dword [0x4b069c]
push eax
push str.Unable_to_join_multicast_group__s._s
mov ecx, dword [ebp - 0x730]
call dword [0x4b069c]
push eax
mov ecx, dword [ebp - 0x738]
push ecx
call sym.MANAGER.exe_public:_void___cdecl_WireTap::CoException::fire_char_const___char_const__
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x704]
call sym.MANAGER.exe_public_virtual:_void___thiscall_WireTap::CoException::destructor_void_
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x720]
call dword [0x4b0504]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0041c9ce
mov esp, ebp
pop ebp
ret
Function at 0x4843f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ab860
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x70c
mov dword [ebp - 0x708], ecx
mov al, byte [ebp + 8]
mov byte [ebp - 0xd], al
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp - 0x708]
mov edx, dword [ecx + 0x1c]
movzx eax, word [edx]
cmp eax, 0x17
jne 0x484451
push 4
lea ecx, [ebp + 8]
push ecx
push 0xa
push 0x29
mov edx, dword [ebp - 0x708]
mov eax, dword [edx + 0x3c]
push eax
call dword [0x4b09b4]
mov dword [ebp - 0x14], eax
jmp 0x48446e
push 1
lea ecx, [ebp - 0xd]
push ecx
push 0xa
push 0
mov edx, dword [ebp - 0x708]
mov eax, dword [edx + 0x3c]
push eax
call dword [0x4b09b4]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x484515
push 0
lea ecx, [ebp - 0x704]
push ecx
call fcn.00483430
add esp, 8
mov dword [ebp - 0x70c], eax
mov edx, dword [ebp - 0x70c]
mov dword [ebp - 0x710], edx
mov dword [ebp - 4], 0
push 0x4c0c64
push 0x217
lea ecx, [ebp - 0x6e8]
call sym.MANAGER.exe_public:_void___thiscall_WireTap::CoException::constructor_int__char_const__
mov dword [ebp - 0x714], eax
mov eax, dword [ebp - 0x714]
mov dword [ebp - 0x718], eax
mov byte [ebp - 4], 1
movzx ecx, byte [ebp - 0xd]
push ecx
push str.Unable_to_set_the_time_to_live_to__u
mov ecx, dword [ebp - 0x710]
call dword [0x4b069c]
push eax
mov edx, dword [ebp - 0x718]
push edx
call sym.MANAGER.exe_public:_void___cdecl_WireTap::CoException::fire_char_const___char_const__
add esp, 0x10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6e8]
call sym.MANAGER.exe_public_virtual:_void___thiscall_WireTap::CoException::destructor_void_
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x704]
call dword [0x4b0504]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4