joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a735
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, eax
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x74]
mov edx, dword [esi + 0x3c]
sub edx, eax
mov eax, dword [ebp - 0x14]
add eax, dword [esi + 0x2c]
mov dword [ebp - 0x10], edx
sub eax, 0x106
mov edx, dword [esi + 0x6c]
sub dword [ebp - 0x10], edx
cmp edx, eax
jb 0x42a7d1
push dword [ebp - 0x14]
mov edx, dword [esi + 0x38]
mov eax, dword [ebp - 0x14]
add eax, edx
push eax
push edx
call fcn.00478620
mov edx, dword [ebp - 0x14]
mov ecx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edx
add esp, 0xc
sub dword [esi + 0x6c], edx
lea eax, [eax + ecx*2]
sub dword [esi + 0x5c], edx
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, dword [ebp - 0x14]
jb 0x42a7a3
mov ebx, edx
sub bx, word [ebp - 0x14]
dec ecx
mov word [eax], bx
jne 0x42a790
mov ecx, dword [ebp - 0x14]
mov eax, dword [esi + 0x40]
lea eax, [eax + ecx*2]
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, dword [ebp - 0x14]
jb 0x42a7c5
mov ebx, edx
sub bx, word [ebp - 0x14]
dec ecx
mov word [eax], bx
jne 0x42a7b2
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov ebx, dword [esi]
mov eax, dword [ebx + 4]
test eax, eax
je 0x42a889
mov edx, dword [esi + 0x6c]
mov edi, eax
mov dword [ebp - 0x18], edx
mov edx, dword [esi + 0x38]
add dword [ebp - 0x18], edx
mov edx, dword [esi + 0x74]
add dword [ebp - 0x18], edx
cmp eax, dword [ebp - 0x10]
jbe 0x42a7fa
mov edi, dword [ebp - 0x10]
xor edx, edx
test edi, edi
je 0x42a848
sub eax, edi
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x42a81d
push edi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.0042b970
jmp 0x42a82d
cmp eax, 2
jne 0x42a833
push edi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.0042905a
add esp, 0xc
mov dword [ebx + 0x30], eax
push edi
push dword [ebx]
push dword [ebp - 0x18]
call fcn.00478620
add dword [ebx], edi
add dword [ebx + 8], edi
add esp, 0xc
mov edx, edi
mov eax, dword [esi + 0x74]
add eax, edx
mov dword [esi + 0x74], eax
cmp eax, 2
jbe 0x42a874
mov ebx, dword [esi + 0x6c]
mov edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
movzx eax, byte [ebx + edx]
mov dword [esi + 0x48], eax
movzx edx, byte [edx + ebx + 1]
shl eax, cl
xor eax, edx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp dword [esi + 0x74], 0x105
ja 0x42a889
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x42a746
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x42eab3
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov esi, dword [ebp + 8]
mov eax, esi
call fcn.0042e9ba
mov ebx, eax
test eax, eax
je 0x42eade
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
inc eax
setne al
push ebx
movzx esi, al
call fcn.0042f550
pop ebx
jmp 0x42eaeb
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
inc eax
setne al
movzx esi, al
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret
Function at 0x42eafb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3b4
mov eax, dword [0x6bf060]
mov esi, dword [ebp + 8]
test eax, eax
je 0x42eb2e
push 0x118
push eax
lea eax, [ebp - 0x14c]
push eax
call sub.msvcrt.dll_strncpy
add esp, 0xc
mov byte [ebp - 0x34], 0
jmp 0x42eb87
call fcn.0042e972
test eax, eax
je 0x42eb76
lea ebx, [ebp - 0x3bc]
push ebx
push 0x118
call sub.KERNEL32.DLL_GetTempPathW
mov eax, ebx
call fcn.0042ea21
mov ebx, eax
test eax, eax
je 0x42eb87
push 0x118
push eax
lea eax, [ebp - 0x14c]
push eax
call sub.msvcrt.dll_strncpy
push ebx
mov byte [ebp - 0x34], 0
call fcn.0042f550
add esp, 0x10
jmp 0x42eb87
lea eax, [ebp - 0x14c]
push eax
push 0x118
call sub.KERNEL32.DLL_GetTempPathA
cld
or ecx, 0xffffffff
xor eax, eax
lea edi, [ebp - 0x14c]
repne scasb al, byte es:[edi]
not ecx
lea ebx, [ecx - 1]
jmp 0x42eba7
cmp byte [ebx + ebp - 0x14d], 0x5c
jne 0x42ebab
dec ebx
test ebx, ebx
jg 0x42eb9c
mov byte [ebx + ebp - 0x14c], 0
lea eax, [ebp - 0x14c]
mov edi, esi
push eax
push str._s_sqlite_
push esi
call sub.msvcrt.dll_sprintf
cld
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov ebx, 0xe
lea edi, [ecx - 1]
lea eax, [esi + edi]
push eax
push 0xf
call fcn.0043f3d0
add esp, 0x14
movzx ax, byte [edi + esi]
xor edx, edx
mov ecx, 0x3e
div cx
and edx, 0x3f
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi], al
inc edi
dec ebx
jns 0x42ebe7
mov byte [edi + esi], 0
push esi
call fcn.0042eab3
pop edi
test eax, eax
jne 0x42ebb3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x42f087
Capabilities:
Get file attributes

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x42f0e8
call fcn.0042e972
test eax, eax
jne 0x42f0b3
cld
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor eax, eax
cmp ecx, 0x104
ja 0x42f0e8
mov eax, ebx
call fcn.0042e9ba
mov edi, eax
test eax, eax
je 0x42f0d1
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov ebx, eax
push edi
call fcn.0042f550
pop ecx
jmp 0x42f0d9
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
je 0x42f0e8
xor eax, eax
test bl, 0x10
setne al
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x42f47a
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
cmp dword [0x6bf090], 0
push ebx
mov esi, dword [ebp + 8]
jne 0x42f4c1
call fcn.0042f40e
cmp dword [0x6bf090], 0
jne 0x42f4bc
call sub.KERNEL32.DLL_TlsAlloc
mov dword [0x6bf080], eax
inc eax
jne 0x42f4b2
call fcn.0042f419
xor eax, eax
jmp 0x42f541
mov dword [0x6bf090], 1
call fcn.0042f419
push dword [0x6bf080]
call sub.KERNEL32.DLL_TlsGetValue
test esi, esi
mov ebx, eax
jle 0x42f509
test eax, eax
jne 0x42f53f
push 0xc
call fcn.0042e950
mov ebx, eax
pop eax
test ebx, ebx
je 0x42f53f
mov eax, dword [0x6a77e4]
mov dword [ebx], eax
mov eax, dword [0x6a77e8]
mov dword [ebx + 4], eax
mov eax, dword [0x6a77ec]
mov dword [ebx + 8], eax
push ebx
push dword [0x6bf080]
call sub.KERNEL32.DLL_TlsSetValue
jmp 0x42f53f
test eax, eax
setne al
shr esi, 0x1f
test eax, esi
je 0x42f53f
push 0xc
push 0x6a77e4
push ebx
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x42f53f
push ebx
call fcn.0042e962
push 0
xor ebx, ebx
push dword [0x6bf080]
call sub.KERNEL32.DLL_TlsSetValue
pop eax
mov eax, ebx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x451e00
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
cmp edx, 1
push edi
mov edi, eax
push esi
mov eax, 0x17
push ebx
mov esi, edx
push ecx
jle 0x451e91
jmp 0x451e20
movzx eax, byte [ebx + 0x6aade0]
jmp 0x451e91
movzx eax, byte [edi]
movzx eax, byte [eax + 0x6a77f0]
lea ecx, [eax*4]
movzx eax, byte [edi + edx - 1]
movzx eax, byte [eax + 0x6a77f0]
imul eax, eax, 3
xor ecx, eax
xor ecx, edx
mov edx, 0x7f
mov eax, ecx
mov ebx, edx
cdq
idiv ebx
movzx eax, byte [edx + str.Pk_]
mov ebx, eax
dec ebx
js 0x451e8c
movzx eax, byte [ebx + 0x6aac60]
cmp eax, esi
jne 0x451e83
movzx eax, word [ebx + ebx + 0x6aace0]
add eax, str.ABORTABLEFTEMPORARYADDATABASELECTHENDEFAULTRANSACTIONATURALTERAISEACHECKEYAFTEREFERENCESCAPELSEXCEPTRIGGEREGEXPLAINITIALLYANALYZEXCLUSIVEXISTSTATEMENTANDEFERRABLEATTACHAVINGLOBEFOREIGNOREINDEXAUTOINCREMENTBEGINNERENAMEBETWEENOTNULLIKEBYCASCADEFERREDELETECASECASTCOLLATECOLUMNCOMMITCONFLICTCONSTRAINTERSECTCREATECROSSCURRENT_DATECURRENT_TIMESTAMPLANDESCDETACHDISTINCTDROPRAGMATCHFAILIMITFROMFULLGROUPDATEIFIMMEDIATEINSERTINSTEADINTOFFSETISNULLJOINORDEREPLACEOUTERESTRICTPRIMARYQUERYRIGHTROLLBACKROWHENUNIONUNIQUEUSINGVACUUMVALUESVIEWHERE
push esi
push edi
push eax
call fcn.0042f6cb
add esp, 0xc
test eax, eax
je 0x451e17
movzx eax, byte [ebx + 0x6aabe0]
jmp 0x451e57
mov eax, 0x17
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x451e99
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
pop ebp
jmp fcn.00451e00
Function at 0x46b5f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 0xc]
mov bl, byte [esi]
movzx eax, bl
mov edx, eax
and edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp + 8], 0xff
jg 0x46b638
test al, 2
je 0x46b638
mov edx, 8
mov eax, dword [ebp + 8]
mov edi, edx
mov ecx, dword [ebp + 8]
cdq
idiv edi
and ecx, 7
movzx eax, byte [esi + eax + 1]
sar eax, cl
test al, 1
jne 0x46b7eb
inc esi
and bl, 2
je 0x46b641
add esi, 0x20
movzx ebx, byte [esi]
inc esi
test ebx, ebx
je 0x46b802
cmp ebx, 1
jne 0x46b6a3
movzx eax, byte [esi]
inc esi
mov dword [ebp - 0x14], eax
cmp eax, 0xbf
jle 0x46b696
and eax, 0x3f
movzx edx, byte [eax + 0x6af790]
imul ebx, edx, 6
mov ecx, dword [edx*4 + 0x6af7d0]
and dword [ebp - 0x14], ecx
mov cl, bl
shl dword [ebp - 0x14], cl
mov eax, edx
dec edx
test eax, eax
jle 0x46b696
movzx eax, byte [esi]
sub ebx, 6
and eax, 0x3f
mov cl, bl
inc esi
shl eax, cl
or dword [ebp - 0x14], eax
jmp 0x46b67c
mov edi, dword [ebp - 0x14]
cmp dword [ebp + 8], edi
jne 0x46b641
jmp 0x46b7eb
cmp ebx, 2
mov cl, byte [esi]
jne 0x46b754
movzx ecx, cl
inc esi
mov dword [ebp - 0x14], ecx
cmp ecx, 0xbf
jle 0x46b6f7
mov eax, ecx
and eax, 0x3f
movzx edx, byte [eax + 0x6af790]
imul ebx, edx, 6
mov eax, dword [edx*4 + 0x6af7d0]
and ecx, eax
mov dword [ebp - 0x14], ecx
mov cl, bl
shl dword [ebp - 0x14], cl
mov eax, edx
dec edx
test eax, eax
jle 0x46b6f7
movzx eax, byte [esi]
sub ebx, 6
and eax, 0x3f
mov cl, bl
inc esi
shl eax, cl
or dword [ebp - 0x14], eax
jmp 0x46b6dd
movzx ebx, byte [esi]
inc esi
cmp ebx, 0xbf
jle 0x46b736
mov eax, ebx
and eax, 0x3f
movzx edx, byte [eax + 0x6af790]
imul edi, edx, 6
and ebx, dword [edx*4 + 0x6af7d0]
mov ecx, edi
shl ebx, cl
mov eax, edx
dec edx
test eax, eax
jle 0x46b736
movzx eax, byte [esi]
sub edi, 6
and eax, 0x3f
mov ecx, edi
inc esi
shl eax, cl
or ebx, eax
jmp 0x46b71d
mov edi, dword [ebp - 0x14]
cmp dword [ebp + 8], edi
setge dl
xor eax, eax
cmp dword [ebp + 8], ebx
setle al
test edx, eax
je 0x46b641
jmp 0x46b7eb
mov edx, pe_nt_image_headers32
mov eax, dword [ebp + 8]
mov edi, edx
cdq
idiv edi
mov dword [ebp - 0x18], eax
movzx eax, byte [eax + 0x6b96b0]
shl eax, 7
add eax, edx
movzx edx, cl
movzx eax, word [eax + eax + 0x6af8b0]
cmp edx, 4
lea eax, [eax*8 + 0x6bb8b0]
ja case.default.0x46b787
jmp dword [edx*4 + 0x6bcb50]
cmp ebx, 3
jne 0x46b7fa
jmp 0x46b7eb
mov cl, byte [eax + 1]
xor edi, edi
cmp cl, 9
setne dl
xor eax, eax
cmp cl, 5
setne al
test edx, eax
je 0x46b7b5
cmp cl, 8
je 0x46b7b5
mov di, 1
xor eax, eax
cmp ebx, 3
sete al
cmp edi, eax
jmp 0x46b7e9
movzx eax, byte [eax + 1]
movzx edx, byte [esi + 1]
cmp edx, dword [eax*4 + 0x6af710]
jmp 0x46b7dc
mov al, byte [eax + 1]
jmp 0x46b7d9
mov al, byte [eax]
cmp byte [esi + 1], al
setne dl
cmp ebx, 3
sete al
xor eax, edx
test al, 1
je 0x46b7fa
xor eax, eax
cmp dword [ebp - 0x10], 0
sete al
jmp 0x46b805
xor eax, eax
jmp 0x46b805
add esi, 2
jmp 0x46b641
mov eax, dword [ebp - 0x10]
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x46cb15
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x130
mov edi, dword [ebp + 0xc]
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
cmp eax, 0xffffffff
je 0x46cb92
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x13c], 0x128
push eax
push esi
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x46cb8c
cmp dword [ebp - 0x124], edi
jne 0x46cb7d
push dword [ebp - 0x134]
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
test eax, eax
je 0x46cb7d
push 0xffffffffffffffff
push eax
call sub.KERNEL32.DLL_TerminateProcess
push ebx
call sub.KERNEL32.DLL_CloseHandle
lea eax, [ebp - 0x13c]
push eax
push esi
call sub.KERNEL32.DLL_Process32Next
jmp 0x46cb4b
push esi
call sub.KERNEL32.DLL_CloseHandle
push 0xffffffffffffffff
push dword [ebp + 8]
call sub.KERNEL32.DLL_TerminateProcess
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x46ddbd
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa0
lea ebx, [ebp - 0xa4]
push 0x94
push 0x4ce250
push ebx
call fcn.00478620
add esp, 0xc
cmp dword [0x6bf360], 0
jne 0x46de49
push ebx
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
je 0x46de06
cmp dword [ebp - 0x94], 2
jne 0x46de06
mov dword [0x6bf320], 1
mov dword [0x6bf390], 1
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x6bf340], eax
push eax
push 0
push 0x46da85
push 3
call sub.USER32.dll_SetWindowsHookExA
mov dword [0x6bf330], eax
push 1
call sub.WINMM.DLL_timeBeginPeriod
push 0x46d90b
call fcn.004012d0
mov dword [0x6bf360], 1
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x46de4e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
jmp 0x46df31
mov ecx, dword [ebp - 0x20]
sub ecx, 0x100
cmp ecx, 5
ja 0x46deee
mov eax, 1
shl eax, cl
test al, 0x33
je 0x46deee
mov eax, dword [ebp - 0x1c]
cmp eax, 0x10
jb 0x46deee
cmp eax, 0x12
jbe 0x46de8c
sub eax, 0x5b
cmp eax, 1
ja 0x46deee
mov dword [0x6bf350], 0
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x46dea9
or dword [0x6bf350], 1
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x46debc
or dword [0x6bf350], 2
push 0x12
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x46decf
or dword [0x6bf350], 4
push 0x5b
call sub.USER32.dll_GetKeyState
test ax, ax
js 0x46dee7
push 0x5c
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x46deee
or dword [0x6bf350], 8
mov eax, dword [ebp - 0x24]
call fcn.0046d92a
test eax, eax
je 0x46df22
push dword [ebp - 0x24]
jmp 0x46df00
push ebx
call sub.USER32.dll_GetParent
mov ebx, eax
test eax, eax
je 0x46df22
call fcn.0046d92a
test eax, eax
jne 0x46deff
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.USER32.dll_IsDialogMessageA
test eax, eax
jne 0x46df31
lea ebx, [ebp - 0x24]
push ebx
call sub.USER32.dll_TranslateMessage
push ebx
call sub.USER32.dll_DispatchMessageA
lea eax, [ebp - 0x24]
push 1
push 0
push 0
push 0
push eax
call sub.USER32.dll_PeekMessageA
test eax, eax
jne 0x46de5a
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x46df4f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xff
push 0xffffffffffffffff
push 0
push 0
push 0
call sub.USER32.dll_MsgWaitForMultipleObjects
leave
jmp fcn.0046de4e

Function at 0x46e467
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x6bf320], 0
mov eax, dword [ebp + 8]
je 0x46e490
push 0xa
push 0
push 0
push eax
call fcn.0047191b
mov dword [esp], eax
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteW
jmp 0x46e4a8
push 0xa
push 0
push 0
push eax
call fcn.00471901
mov dword [esp], eax
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteA
cmp eax, 0x20
leave
setg al
movzx eax, al
ret
Function at 0x46e636
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x6cde70], 0
mov eax, dword [ebp + 8]
je 0x46e65d
push eax
call fcn.0047191b
mov dword [esp], eax
call sub.msvcrt.dll__wgetenv
pop edx
mov dword [ebp + 8], eax
leave
jmp fcn.00470b1a
push eax
call fcn.00471901
mov dword [esp], eax
call sub.msvcrt.dll_getenv
pop ecx
mov dword [ebp + 8], eax
leave
jmp fcn.00470aa5
Function at 0x46ebd4
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00471901
mov dword [esp], eax
call sub.WSOCK32.DLL_gethostbyname
mov ecx, eax
xor eax, eax
test ecx, ecx
je 0x46ec04
movsx edx, word [ecx + 8]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
movsx edx, word [ecx + 0xa]
mov dword [eax], edx
mov eax, dword [ecx + 0xc]
leave
ret

Function at 0x46ec06
Capabilities:
Connect socket

Disassembly:
push ebp
or eax, 0xffffffff
mov ebp, esp
push edi
sub esp, 0x10
cmp dword [ebp + 0x10], 2
jne 0x46ec54
cld
xor eax, eax
lea edi, [ebp - 0x14]
mov ecx, 4
rep stosd dword es:[edi], eax
movzx eax, word [ebp + 0x18]
mov word [ebp - 0x14], 2
push eax
call sub.WSOCK32.DLL_htons
push dword [ebp + 0x14]
push dword [ebp + 0xc]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x10]
push eax
call fcn.00478620
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [ebp + 8]
call sub.WSOCK32.DLL_connect
mov edi, dword [ebp - 4]
leave
ret

Function at 0x46eff2
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.WSOCK32.DLL_WSAStartup
push 0x46efe9
call fcn.004012d0
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [0x6cde40], eax
lea edx, [eax + 0x20]
add eax, 0x40
mov dword [0x6cde60], edx
mov dword [0x6cde50], eax
leave
ret

Function at 0x472c27
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0x6cde80
call sub.KERNEL32.DLL_InitializeCriticalSection
call sub.KERNEL32.DLL_TlsAlloc
push 0xb8
mov dword [0x6c9b10], eax
call sub.msvcrt.dll_malloc
mov ebx, eax
mov dword [eax + 4], 0
lea eax, [eax + 8]
push pe_nt_image_headers32
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 8]
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
push 2
push 0
mov dword [ebx + 0xb4], eax
lea eax, [ebx + 0xb0]
push 0
push eax
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_DuplicateHandle
add esp, 0x10
test eax, eax
jne 0x472cb2
push 0xffffffffffffffff
call sub.msvcrt.dll_exit
push ebx
push dword [0x6c9b10]
call sub.KERNEL32.DLL_TlsSetValue
mov eax, dword [0x6c9ae0]
mov dword [ebx], eax
mov dword [0x6c9ae0], ebx
mov dword [0x6c9b00], ebx
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x472cd6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x2d0
lea ebx, [ebp - 0x2d8]
push 0xb8
call sub.msvcrt.dll_malloc
mov esi, eax
mov eax, dword [ebp + 8]
push pe_nt_image_headers32
push 0
mov dword [esi + 4], eax
lea eax, [esi + 8]
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x88], 0
mov dword [esi + 8], eax
lea eax, [esi + 0xb4]
push eax
push 4
push esi
push 0x472b90
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push 0x2cc
mov dword [esi + 0xb0], eax
push 0x4d06b0
push ebx
call fcn.00478620
push ebx
push dword [esi + 0xb0]
call sub.KERNEL32.DLL_GetThreadContext
mov eax, dword [ebp - 0x214]
add esp, 0x1c
mov dword [esi + 0x8c], eax
cmp dword [0x6cdea0], 0
je 0x472d75
push 0x6cde80
call sub.KERNEL32.DLL_EnterCriticalSection
mov ebx, 0x6c9af0
mov edx, dword [0x6c9af0]
test edx, edx
je 0x472da0
cmp dword [edx + 0x88], 0
je 0x472d9a
mov eax, dword [edx]
mov dword [ebx], eax
push edx
call fcn.004785d0
pop ecx
jmp 0x472d9c
mov ebx, edx
mov edx, dword [ebx]
jmp 0x472d80
mov eax, dword [0x6c9ae0]
mov dword [0x6c9ae0], esi
mov dword [esi], eax
cmp dword [0x6cdea0], 0
je 0x472dc0
push 0x6cde80
call sub.KERNEL32.DLL_LeaveCriticalSection
mov eax, esi
mov dword [0x6cdea0], 1
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x472e48
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax + 0xb0]
call sub.KERNEL32.DLL_ResumeThread
leave
ret

Function at 0x472e5b
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2d0
call fcn.00472e25
mov esi, dword [0x6c9ae0]
mov edi, eax
test esi, esi
je 0x472f1b
cmp esi, edi
je 0x472f14
push dword [esi + 0xb0]
call sub.KERNEL32.DLL_SuspendThread
lea ebx, [ebp - 0x2dc]
push 0x2cc
push 0x4d097c
push ebx
call fcn.00478620
push ebx
push dword [esi + 0xb0]
call sub.KERNEL32.DLL_GetThreadContext
mov eax, dword [ebp - 0x240]
mov dword [esi + 0x94], eax
mov eax, dword [ebp - 0x23c]
mov dword [esi + 0x98], eax
mov eax, dword [ebp - 0x238]
mov dword [esi + 0x9c], eax
mov eax, dword [ebp - 0x234]
mov dword [esi + 0xa0], eax
mov eax, dword [ebp - 0x230]
mov dword [esi + 0xa4], eax
mov eax, dword [ebp - 0x22c]
mov dword [esi + 0xa8], eax
mov eax, dword [ebp - 0x228]
mov dword [esi + 0xac], eax
mov eax, dword [ebp - 0x218]
mov dword [esi + 0x90], eax
add esp, 0xc
mov esi, dword [esi]
jmp 0x472e74
mov eax, dword [0x6c9ae0]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x472f28
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
call fcn.00472e25
mov ebx, dword [0x6c9ae0]
mov esi, eax
test ebx, ebx
je 0x472f51
cmp ebx, esi
je 0x472f4d
push dword [ebx + 0xb0]
call sub.KERNEL32.DLL_ResumeThread
mov ebx, dword [ebx]
jmp 0x472f3a
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x475cc0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
je 0x475cf6
mov dword [0x6cdb50], eax
mov edx, 0x475ca0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00476d00
test eax, eax
sete al
movzx eax, al
mov dword [0x4d0c80], eax
leave
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x4d0c80], eax
leave
ret

Function at 0x475de0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], 0x474fb0
mov dword [ebp - 0x24], 0x479a4c
mov dword [ebp - 0x1c], 0x475ea0
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call fcn.00477820
cmp dword [0x4d0c80], 0
mov dword [ebp - 0x44], 0x6cdb60
je 0x475e80
jl 0x475ec0
mov dword [ebp - 0x3c], 1
mov eax, dword [0x6cdb50]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x475f63
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.00477900
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x6cdba0]
mov eax, 0xffffffff
test edx, edx
je 0x475eda
mov eax, dword [0x4d0c84]
test eax, eax
je 0x475f1a
xor eax, eax
test eax, eax
jne 0x475f10
mov edi, dword [0x4d0c80]
test edi, edi
js 0x475f10
mov dword [ebp - 0x44], 0x6cdb60
mov ebx, dword [0x4d0c80]
test ebx, ebx
je 0x475e80
jmp 0x475e2e
xor esi, esi
mov dword [0x4d0c80], esi
jmp 0x475ee8
mov dword [esp], 0x4d0c88
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.DLL_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x475fa1
mov eax, dword [0x4d0c84]
test eax, eax
jne 0x475ed8
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x4d0c84]
test eax, eax
je 0x475f3d
jmp 0x475ed8
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x475f95
mov dword [esp + 4], eax
mov eax, dword [0x6cdb50]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x475fca
test edx, edx
je 0x475fb5
mov dword [ebp - 0x3c], 1
call fcn.00474af0
call fcn.00475cc0
mov eax, 1
mov dword [0x4d0c84], eax
jmp 0x475ed8
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x475e76
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
jmp 0x475f91