joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a232c
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405368
xor eax, eax
push ebp
push 0x5a244a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5a241d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
or eax, 1
push eax
call sub.kernel32.dll_SetErrorMode
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 4]
call fcn.00405378
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5a23fa
test byte [ebp - 0x14c], 0x10
jne 0x5a23dd
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00405158
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.00409a98
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x5a23a0
push ebx
call sub.kernel32.dll_FindClose_1
mov byte [ebp - 5], 1
jmp 0x5a2406
call sub.kernel32.dll_GetLastError
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a2424
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x5a7274
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, eax
movzx eax, byte [ebx + 4]
sub al, 1
jb 0x5a7283
je 0x5a7288
jmp 0x5a72ac
mov eax, dword [ebx + 8]
pop ebx
ret
cmp dword [ebx + 8], 0
jne 0x5a72a7
lea eax, [ebx + 8]
push eax
movzx eax, byte [ebx + 0xc]
push eax
mov eax, dword [0x5b4f30]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [ebx + 8]
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x5abc68
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
sub dl, 1
jb 0x5abc74
je 0x5abc85
jmp 0x5abc8c
push 1
mov eax, ebx
call fcn.00405378
push eax
call sub.kernel32.dll_WinExec
pop ebx
ret
mov eax, ebx
call fcn.005abc64
pop ebx
ret
Function at 0x5ac2c8
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
push esi
add esp, 0xffffffd0
lea eax, [esp + 4]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 8]
push eax
push 0x5ac368
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], 1
xor esi, esi
mov dword [esp + 0x2c], esi
push esp
lea eax, [esp + 0x14]
push eax
push 0x10
lea eax, [esp + 0x2c]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 1
or esi, 2
mov dword [esp + 0x1c], esi
push esp
push 0
mov eax, dword [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, ebx
add esp, 0x30
pop esi
pop ebx
ret
Function at 0x406330
Capabilities:
Accept command line arguments
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
and eax, 0xff
inc eax
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x4063a0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x54
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
mov ax, word [eax]
test ax, ax
je 0x406423
cmp ax, 9
je 0x406410
cmp ax, 0x20
je 0x406410
xor edi, edi
xor esi, esi
lea esi, [esi]
cmp ax, 0x5c
je 0x406488
cmp ax, 0x22
je 0x406470
xor esi, esi
mov ax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x406423
cmp ax, 9
sete cl
cmp ax, 0x20
sete dl
or dl, cl
je 0x4063d0
test edi, 1
jne 0x4063d0
lea esi, [esi]
mov ax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x406410
cmp ax, 0x20
je 0x406410
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
test byte [ebp - 0x24], 1
push ecx
je 0x406490
xor esi, esi
mov si, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push edx
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004049f0
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
and esi, 1
jne 0x4063e4
xor edi, 1
jmp 0x4063e6
inc esi
jmp 0x4063e6
mov word [ebp - 0x20], 1
mov esi, 1
jmp 0x40643c
Function at 0x4063a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
and eax, 0xff
inc eax
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x4063a0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x54
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
mov ax, word [eax]
test ax, ax
je 0x406423
cmp ax, 9
je 0x406410
cmp ax, 0x20
je 0x406410
xor edi, edi
xor esi, esi
lea esi, [esi]
cmp ax, 0x5c
je 0x406488
cmp ax, 0x22
je 0x406470
xor esi, esi
mov ax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x406423
cmp ax, 9
sete cl
cmp ax, 0x20
sete dl
or dl, cl
je 0x4063d0
test edi, 1
jne 0x4063d0
lea esi, [esi]
mov ax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x406410
cmp ax, 0x20
je 0x406410
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
test byte [ebp - 0x24], 1
push ecx
je 0x406490
xor esi, esi
mov si, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push edx
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004049f0
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
and esi, 1
jne 0x4063e4
xor edi, 1
jmp 0x4063e6
inc esi
jmp 0x4063e6
mov word [ebp - 0x20], 1
mov esi, 1
jmp 0x40643c
Function at 0x4013d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x610
mov eax, dword [0x45902c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x610], eax
lea eax, [ebp - 0x60c]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0042d4ff
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_AddDllDirectory]
push 0x1000
push 0
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ebx, eax
test edi, edi
je 0x401450
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDllDirectory]
test ebx, ebx
jne 0x401467
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425de4
mov esp, ebp
pop ebp
ret
push 0x58
push 1
call fcn.0042d0e3
mov ecx, dword [ebp + 0x10]
mov esi, eax
push 1
push 0x400
mov dword [esi + 0x14], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x30], 0x400
mov dword [esi + 0x34], 0x400
call fcn.0042d0e3
push 1
push dword [esi + 0x30]
mov dword [esi + 0x28], eax
call fcn.0042d0e3
push dword [ebp - 0x610]
mov dword [esi + 0x2c], eax
call fcn.0042f6a2
mov ecx, dword [ebp - 4]
add esp, 0x1c
mov dword [esi + 0x3c], eax
xor ecx, ebp
mov dword [esi + 0x48], 0
mov eax, esi
pop edi
pop esi
pop ebx
call fcn.00425de4
mov esp, ebp
pop ebp
ret
Function at 0x415700
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445bc5
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x45902c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [ebp + 8], 2
mov edi, dword [ebp + 0xc]
jge 0x415770
push str.Usage:_server__shared_library____lockfile__
push 0x45db00
call fcn.00402f80
push eax
call fcn.00409bd0
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00425de4
mov esp, ebp
pop ebp
ret
push str.Loading
push 0x45da40
mov dword [ebp - 4], 0
call fcn.00402f80
add esp, 8
push dword [edi + 4]
push eax
call fcn.00402f80
add esp, 8
push eax
call fcn.00409bd0
mov edx, dword [edi + 4]
xorps xmm0, xmm0
mov ecx, edx
mov dword [ebp - 0x1c], 0
add esp, 4
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
lea eax, [ecx + 1]
mov dword [ebp - 0x5c], eax
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4157c0
sub ecx, dword [ebp - 0x5c]
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.00403250
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x58]
call fcn.00409f70
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
cmp ecx, 0x10
jb 0x41581c
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x415812
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4158dc
push ecx
push edx
call fcn.00425e5b
add esp, 8
lea eax, [ebp - 0x3c]
push 0x45d558
mov dword [0x45d568], eax
call fcn.0042fac6
add esp, 4
cmp dword [ebp + 8], 2
jle 0x415856
mov eax, dword [edi + 8]
mov dword [0x45d56c], eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0x4147c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.Starting_RPC_server
push 0x45da40
call fcn.00402f80
add esp, 8
push eax
call fcn.00409bd0
add esp, 4
lea ecx, [ebp - 0x3c]
call fcn.0041be50
lea ecx, [ebp - 0x3c]
call fcn.00419550
mov ecx, dword [ebp - 0x44]
cmp ecx, 0x10
jb 0x4158b1
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4158a7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4158dc
push ecx
push edx
call fcn.00425e5b
add esp, 8
xor eax, eax
jmp 0x415754
call fcn.0042fa6a
int3
Function at 0x415ac0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
cmp dword [eax + 0x14], 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov esi, eax
jb 0x415ad8
mov esi, dword [eax]
mov edi, dword [eax + 0x10]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x415af7
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x415ae6
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, edx
mov edx, dword [ebx + 4]
mov dword [ebp - 4], edx
mov edi, dword [eax + ecx*8 + 4]
cmp edi, edx
je 0x415bb6
mov eax, dword [eax + ecx*8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
nop word [eax + eax]
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
jb 0x415b2c
mov edx, dword [edi + 8]
cmp dword [ebx + 0x14], 0x10
mov eax, ebx
jb 0x415b36
mov eax, dword [ebx]
mov esi, dword [ebx + 0x10]
cmp esi, dword [edi + 0x18]
jne 0x415b93
sub esi, 4
jb 0x415b54
mov ecx, dword [eax]
cmp ecx, dword [edx]
jne 0x415b59
add eax, 4
add edx, 4
sub esi, 4
jae 0x415b43
cmp esi, 0xfffffffc
je 0x415b8d
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x415b86
cmp esi, 0xfffffffd
je 0x415b8d
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x415b86
cmp esi, 0xfffffffe
je 0x415b8d
mov cl, byte [eax + 2]
cmp cl, byte [edx + 2]
jne 0x415b86
cmp esi, 0xffffffff
je 0x415b8d
mov al, byte [eax + 3]
cmp al, byte [edx + 3]
je 0x415b8d
sbb eax, eax
or eax, 1
jmp 0x415b8f
xor eax, eax
test eax, eax
je 0x415b9d
cmp edi, dword [ebp - 8]
je 0x415bb3
mov edi, dword [edi + 4]
jmp 0x415b20
mov eax, dword [ebp + 8]
test edi, edi
mov edx, dword [ebp - 4]
cmove edi, edx
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
xor edi, edi
test edi, edi
cmove edi, edx
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x418650
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ecx]
cmp esi, 0xffffffff
jne 0x41866e
mov ebx, 0x2719
call fcn.0041b1c0
mov dword [ebp - 4], eax
jmp 0x4186af
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 4
push dword [ebp + 8]
push 4
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edi, eax
call fcn.0041b1c0
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
mov dword [ebp - 4], esi
test edi, edi
mov dword [ebp - 8], ebx
pop edi
jne 0x4186b2
xor ebx, ebx
mov dword [ebp - 4], 0x459020
mov dword [ebp - 8], ebx
pop esi
test ebx, ebx
pop ebx
jne 0x4186be
mov esp, ebp
pop ebp
ret 4
push str.set_option
lea eax, [ebp - 8]
push eax
call fcn.0041ae90
int3
Function at 0x418c10
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446082
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x45902c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1a4], esi
mov dword [ebp - 0x1a8], esi
mov eax, 1
lock xadd dword [0x45d5a0], eax
inc eax
mov ebx, 0x45d5a4
cmp eax, 1
jne 0x418c75
lea eax, [ebp - 0x1a0]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [ebx], eax
xor edi, edi
lock xadd dword [ebx], edi
test edi, edi
jne 0x418cd0
push 0x20
mov dword [ebp - 4], edi
call fcn.00425e2b
add esp, 4
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x418ca7
push 0xffffffffffffffff
push edi
push esi
mov ecx, eax
call fcn.004179b0
jmp 0x418ca9
xor eax, eax
mov dword [esi + 4], eax
mov ecx, dword [eax + 0x1c]
mov eax, esi
mov dword [esi + 8], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425de4
mov esp, ebp
pop ebp
ret
call fcn.0041b1c0
mov dword [ebp - 0x1a8], eax
lea eax, [ebp - 0x1ac]
push str.winsock
push eax
mov dword [ebp - 0x1ac], edi
call fcn.0041ae90
int3

Function at 0x419cf0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [0x45d59c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x419d32
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x419d32
mov eax, dword [ecx]
test eax, eax
je 0x419d32
mov dword [ecx], 0
mov dl, byte [eax]
movzx ecx, dl
cmp ecx, ebx
jb 0x419d29
mov byte [eax + ebx], dl
pop ebx
pop ebp
ret
push eax
call fcn.00426436
add esp, 4
lea eax, [ebx + 1]
push eax
call fcn.00425e2b
add esp, 4
movzx ecx, bl
xor edx, edx
cmp ebx, 0xff
cmova ecx, edx
mov byte [eax + ebx], cl
pop ebx
pop ebp
ret

Function at 0x419d60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [0x45d59c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x419d78
mov edx, dword [eax + 4]
jmp 0x419d7a
xor edx, edx
mov eax, dword [ebp + 0xc]
cmp eax, 0xff
ja 0x419d99
test edx, edx
je 0x419d99
cmp dword [edx], 0
jne 0x419d99
mov ecx, dword [ebp + 8]
mov al, byte [ecx + eax]
mov byte [ecx], al
mov dword [edx], ecx
pop ebp
ret
push dword [ebp + 8]
call fcn.00426436
add esp, 4
pop ebp
ret

Function at 0x41b220
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ecx + 4]
lea eax, [ebp - 1]
push 0
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 1
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 1
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.WS2_32.dll_WSASend]
call fcn.0041b1c0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop esi
cmp eax, 0x40
je 0x41b279
cmp eax, 0x4d2
jne 0x41b27e
call fcn.0041b1c0
mov esp, ebp
pop ebp
ret
Function at 0x41b290
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, 0x45d5a8
lock xadd dword [ecx], eax
mov ecx, dword [esi + 4]
push 0
push ecx
test eax, eax
je 0x41b2de
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
mov esp, ebp
pop ebp
ret
push method.clmdep_asio::io_service::service.virtual_8
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41bba0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x41bbe0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push 1
lea ecx, [ebp + 0xf]
mov dword [ebp - 4], 0x459020
push ecx
push eax
mov byte [ebp + 0xf], 0
call fcn.00419db0
add esp, 0x10
mov dword [edi], 0xffffffff
mov eax, dword [ebx + 4]
add eax, 0x18
lock inc dword [eax]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 0x18]
mov dword [ebp - 4], 0x459020
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0041c1c0
mov esi, dword [edi]
add esp, 0x10
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], esi
cmp esi, 0xffffffff
je 0x41bcad
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
call fcn.0041b1c0
mov dword [ebp + 0x14], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 0x18], eax
test esi, esi
je 0x41bcaa
call fcn.0041b1c0
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
mov ecx, dword [ecx + 4]
cmp ecx, dword [eax + 4]
jne 0x41bc5e
cmp esi, 0x2733
je 0x41bc76
call fcn.0041b1c0
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx + 4]
cmp ecx, dword [eax + 4]
jne 0x41bcaa
cmp esi, 0x4d5
jne 0x41bcaa
mov esi, dword [ebp + 0x10]
lea eax, [ebp + 0x18]
push eax
push 0x8004667e
push esi
mov dword [ebp + 0x18], 0
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call fcn.0041b1c0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0xffffffff
mov dword [edi], eax
jne 0x41bccf
mov ecx, dword [ebx + 4]
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0x24]
call fcn.0041b7f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
mov edi, dword [ebp + 0x24]
lea eax, [ebp + 0x18]
push edi
push eax
mov eax, dword [ebp + 0x20]
push eax
push eax
push 0
push dword [ebp + 0x1c]
mov dword [ebp + 0x18], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.MSWSOCK.dll_AcceptEx
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test esi, esi
jne 0x41bd1a
cmp eax, 0x3e5
je 0x41bd1a
mov ecx, dword [ebx + 4]
push esi
push eax
push edi
call fcn.0041b870
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
mov ecx, dword [ebx + 4]
push edi
call fcn.0041b8f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x41be50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov ecx, dword [ecx]
add ecx, 4
jmp fcn.0041bd30
Function at 0x420ae0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov dword [ebp - 0x1c], eax
mov edi, ecx
add eax, 8
push eax
push 0x4c
mov dword [ebp - 4], eax
call fcn.00419cf0
mov ebx, dword [ebp + 8]
mov esi, eax
add esp, 8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x420b1b
mov ecx, dword [ebx + 8]
mov edx, eax
lock inc dword [eax + 8]
mov al, byte [ebx + 4]
mov byte [esi + 0x20], al
lea eax, [edx + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x424150
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp + 8], eax
test edx, edx
je 0x420b7b
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], edx
lock inc dword [eax]
jmp 0x420b7e
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esi + 0x30], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x2c], eax
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esi + 0x38], ecx
mov ecx, dword [ebp - 4]
mov dword [esi + 0x34], eax
mov eax, dword [ecx]
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x3c], eax
mov eax, dword [ecx + 4]
mov dword [esi + 0x40], eax
mov eax, dword [ecx + 8]
mov dword [esi + 0x44], eax
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [ecx + 0xc]
mov dword [esi + 0x48], eax
test edx, edx
je 0x420be7
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
lock xadd dword [ecx], eax
jne 0x420be7
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 4]
test byte [ebx + 4], 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
je 0x420c1b
test ecx, ecx
jne 0x420c1b
mov eax, dword [edi + 4]
add eax, 0x18
lock inc dword [eax]
push ecx
push ecx
mov ecx, dword [edi + 4]
push esi
call fcn.0041b870
jmp 0x420ca4
mov eax, dword [edi + 4]
add eax, 0x18
lock inc dword [eax]
mov ecx, dword [ebx]
push 0
cmp ecx, 0xffffffff
jne 0x420c3d
mov ecx, dword [edi + 4]
push 0x2719
push esi
call fcn.0041b870
jmp 0x420ca4
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0x14]
mov dword [ebp + 0x14], 0
push eax
push 1
lea eax, [ebp - 0x10]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x420c74
mov eax, 0x2746
jmp 0x420c81
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x420c9b
cmp eax, 0x3e5
je 0x420c9b
push dword [ebp + 0x14]
mov ecx, dword [edi + 4]
push eax
push esi
call fcn.0041b870
jmp 0x420ca4
mov ecx, dword [edi + 4]
push esi
call fcn.0041b8f0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
call fcn.00425a40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10