joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d9c0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x7c
mov esi, dword [esp + 0x90]
mov eax, dword [esi + 0xf4]
cmp eax, 0xffffffff
jne 0x45d9f2
mov dword [esi + 0x48], 0xfffff00d
mov dword [esi + 0xf0], 6
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esi + 0x110]
mov ecx, dword [esi + 0x114]
mov dword [esp], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ecx
call dword [sym.imp.msvcrt.dll__get_osfhandle]
cmp eax, 0xffffffff
mov ebp, eax
je 0x45dbd1
mov ecx, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov edx, ecx
mov ecx, ebx
not ecx
not edx
mov eax, ecx
or eax, edx
jne 0x45daf3
mov dword [esp + 0x38], 0
mov dword [esp + 0x2c], 0
or ecx, edx
xor ebx, ebx
xor edi, edi
mov dword [esp + 0x28], ecx
jmp 0x45da58
cmp dword [esi + 0x108], ebx
jbe 0x45dab3
mov edx, dword [esp + 0x28]
test edx, edx
je 0x45da74
xor edx, edx
mov eax, edi
add eax, dword [esp + 0x30]
adc edx, dword [esp + 0x34]
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], edx
mov eax, dword [esi + 0x10c]
mov ecx, dword [esp + 0x2c]
lea eax, [eax + ebx*8]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x4c]
add ebx, 1
mov dword [esp + 0xc], ecx
mov edx, dword [eax]
mov dword [esp + 8], edx
mov eax, dword [eax + 4]
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
add edi, dword [esp + 0x4c]
test eax, eax
mov edx, edi
jne 0x45da50
mov ecx, eax
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x45db90
or ecx, edx
je 0x45db70
cmp edx, 0xffffffff
mov dword [esi + 0x48], edx
jne 0x45d9ea
call dword [sym.imp.msvcrt.dll___doserrno]
mov eax, dword [eax]
mov dword [esi + 0xf0], eax
mov dword [esp], eax
call fcn.0045b940
mov dword [esi + 0x48], eax
jmp 0x45d9ea
lea eax, [esp + 0x50]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
sub esp, 0x14
test eax, eax
setne al
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x3c]
movzx eax, al
mov dword [esp + 0x38], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x2c], eax
jmp 0x45da44
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x45dbf0
mov dword [esi + 0x48], 0
jmp 0x45d9ea
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp], ebp
mov dword [esp + 8], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
sub esp, 0x14
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
jmp 0x45dac1
mov dword [esi + 0xf0], 6
mov dword [esp], 6
call fcn.0045b940
mov dword [esi + 0x48], eax
jmp 0x45d9ea
mov dword [esi + 0xf0], eax
mov dword [esp], eax
call fcn.0045b940
mov dword [esi + 0x48], eax
jmp 0x45d9ea
Function at 0x45dc10
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x7c
mov esi, dword [esp + 0x90]
mov eax, dword [esi + 0xf4]
cmp eax, 0xffffffff
jne 0x45dc42
mov dword [esi + 0x48], 0xfffff00d
mov dword [esi + 0xf0], 6
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esi + 0x110]
mov ecx, dword [esi + 0x114]
mov dword [esp], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ecx
call dword [sym.imp.msvcrt.dll__get_osfhandle]
cmp eax, 0xffffffff
mov ebp, eax
je 0x45de21
mov ecx, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov edx, ecx
mov ecx, ebx
not ecx
not edx
mov eax, ecx
or eax, edx
jne 0x45dd43
mov dword [esp + 0x38], 0
mov dword [esp + 0x2c], 0
or ecx, edx
xor ebx, ebx
xor edi, edi
mov dword [esp + 0x28], ecx
jmp 0x45dca8
cmp dword [esi + 0x108], ebx
jbe 0x45dd03
mov edx, dword [esp + 0x28]
test edx, edx
je 0x45dcc4
xor edx, edx
mov eax, edi
add eax, dword [esp + 0x30]
adc edx, dword [esp + 0x34]
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], edx
mov eax, dword [esi + 0x10c]
mov ecx, dword [esp + 0x2c]
lea eax, [eax + ebx*8]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x4c]
add ebx, 1
mov dword [esp + 0xc], ecx
mov edx, dword [eax]
mov dword [esp + 8], edx
mov eax, dword [eax + 4]
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
add edi, dword [esp + 0x4c]
test eax, eax
mov edx, edi
jne 0x45dca0
mov ecx, eax
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x45dde0
or ecx, edx
je 0x45ddc0
cmp edx, 0xffffffff
mov dword [esi + 0x48], edx
jne 0x45dc3a
call dword [sym.imp.msvcrt.dll___doserrno]
mov eax, dword [eax]
mov dword [esi + 0xf0], eax
mov dword [esp], eax
call fcn.0045b940
mov dword [esi + 0x48], eax
jmp 0x45dc3a
lea eax, [esp + 0x50]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
sub esp, 0x14
test eax, eax
setne al
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x3c]
movzx eax, al
mov dword [esp + 0x38], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x2c], eax
jmp 0x45dc94
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xf0], eax
mov dword [esp], eax
call fcn.0045b940
mov dword [esi + 0x48], eax
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp], ebp
mov dword [esp + 8], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
sub esp, 0x14
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
jmp 0x45dd11
mov dword [esi + 0xf0], 6
mov dword [esp], 6
call fcn.0045b940
mov dword [esi + 0x48], eax
jmp 0x45dc3a
Function at 0x4655f0
Capabilities:
Resolve dns

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx + 0x24]
lea edx, [ebx + 0x24]
mov dword [ebx + 0x24], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
sub esp, 0x10
mov dword [esp], eax
call fcn.00465520
mov dword [ebx + 0x2c], eax
add esp, 0x18
pop ebx
ret
Function at 0x4665a0
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
push edi
mov edi, eax
push esi
push ebx
mov esi, edx
mov ebx, ecx
sub esp, 0x2c
test byte [edx + 0x2d], 8
je 0x466730
mov eax, dword [esp + 0x40]
mov edx, dword [ebx + 0x3c]
test eax, eax
jne 0x46665e
cmp edx, 0xffffffff
je 0x4665e7
mov dword [esp + 8], 0x323
mov dword [esp + 4], str.src_win_pipe.c
mov dword [esp], str.req__pipeHandle__INVALID_HANDLE_VALUE
call fcn.004a0380
mov eax, dword [esi + 0x98]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x10000
mov dword [esp + 0x10], 0x10000
mov dword [esp + 0xc], 0xff
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000003
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
sub esp, 0x20
cmp eax, 0xffffffff
mov dword [ebx + 0x3c], eax
je 0x4666eb
mov ecx, eax
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
mov edx, esi
mov eax, edi
call fcn.00466320
test eax, eax
jne 0x4666d5
mov edx, dword [ebx + 0x3c]
cmp edx, 0xffffffff
je 0x466774
lea eax, [ebx + 0x20]
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
sub esp, 8
test eax, eax
je 0x4666b0
add dword [esi + 0x3c], 1
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x3e5
je 0x4666a1
call ebp
cmp eax, 0x217
jne 0x466751
mov dword [ebx + 0x20], 0
jmp 0x466704
mov eax, dword [ebx + 0x3c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x3c], 0xffffffff
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
test eax, eax
jle 0x466770
call ebp
movzx eax, ax
or eax, 0x80070000
mov dword [ebx + 0x20], eax
mov eax, dword [edi + 0x28]
mov dword [ebx + 0x38], 0
test eax, eax
je 0x4667a0
mov edx, dword [eax + 0x38]
mov dword [ebx + 0x38], edx
mov dword [eax + 0x38], ebx
mov dword [edi + 0x28], ebx
add dword [esi + 0x3c], 1
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x320
mov dword [esp + 4], str.src_win_pipe.c
mov dword [esp], 0x645298
call fcn.004a0380
jmp 0x4665b7
mov eax, dword [ebx + 0x3c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x3c], 0xffffffff
sub esp, 4
call ebp
test eax, eax
jg 0x4666f7
lea esi, [esi]
call ebp
jmp 0x466701
mov dword [esp + 8], 0x33b
mov dword [esp + 4], str.src_win_pipe.c
mov dword [esp], str.req__pipeHandle___INVALID_HANDLE_VALUE
call fcn.004a0380
mov edx, dword [ebx + 0x3c]
jmp 0x466667
mov dword [ebx + 0x38], ebx
mov dword [edi + 0x28], ebx
add dword [esi + 0x3c], 1
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x468470
Capabilities:
Create pipe

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [esp + 0x58]
mov esi, dword [esp + 0x5c]
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x54]
or edi, 0x40080000
jmp 0x4684a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
je 0x4684a6
cmp eax, 5
jne 0x4685a0
add ebx, 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 8], str._pipeuv_p__lu
mov dword [esp + 4], ebp
mov dword [esp], esi
call fcn.004682a0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x10000
mov dword [esp + 0x10], 0x10000
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
sub esp, 0x20
cmp eax, 0xffffffff
je 0x468490
mov ecx, eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], 0
mov dword [esp + 0x28], ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x50]
mov eax, dword [eax + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
sub esp, 0x10
test eax, eax
mov ecx, dword [esp + 0x28]
je 0x468570
mov eax, dword [esp + 0x54]
mov dword [esp + 0x28], ecx
call fcn.00466f30
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x28]
xor edx, edx
mov dword [eax + 0x94], ecx
add esp, 0x3c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov edx, dword [esp + 0x28]
add esp, 0x3c
pop ebx
pop esi
mov eax, edx
pop edi
pop ebp
ret
add esp, 0x3c
mov edx, eax
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
Function at 0x46c2c0
Capabilities:
Terminate process

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x34
cmp edx, 2
je 0x46c325
jg 0x46c310
test edx, edx
jne 0x46c31a
lea eax, [esp + 0x2c]
mov dword [esp + 0x1c], edx
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
sub esp, 8
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x46c360
cmp dword [esp + 0x2c], 0x103
mov eax, 0xfffff038
cmove eax, edx
add esp, 0x34
pop ebx
pop esi
ret
cmp edx, 9
je 0x46c325
cmp edx, 0xf
je 0x46c325
add esp, 0x34
mov eax, 0xfffff02a
pop ebx
pop esi
ret
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, eax
sub esp, 8
xor eax, eax
test edx, edx
jne 0x46c302
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
mov esi, eax
je 0x46c374
mov dword [esp], esi
call fcn.0045b940
add esp, 0x34
pop ebx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
call fcn.0045b940
add esp, 0x34
pop ebx
pop esi
ret
lea eax, [esp + 0x2c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
sub esp, 8
test eax, eax
je 0x46c34e
cmp dword [esp + 0x2c], 0x103
mov eax, 0xfffff038
jne 0x46c302
jmp 0x46c34e

Function at 0x46ee40
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x1c
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x2c]
test al, 1
jne 0x46eeb0
test eax, 0x10000
je 0x46eec0
mov edx, dword [edx + 8]
cmp edx, 0xc
je 0x46eea0
cmp edx, 0xe
je 0x46ee91
cmp edx, 7
mov eax, 0xfffff008
je 0x46ee8d
mov dword [esp + 8], 0xc8
mov dword [esp + 4], str.src_win_stream.c
mov dword [esp], 0x6462fd
call fcn.004a0380
mov eax, 0xfffff02a
add esp, 0x1c
ret
add esp, 0x1c
jmp 0x4789e0
add esp, 0x1c
jmp 0x470dd0
mov eax, 0xfffff00d
jmp 0x46ee8d
mov eax, 0xfffff031
jmp 0x46ee8d
sub esp, 0x3c
mov eax, dword [esp + 0x40]
mov edx, dword [eax + 0x88]
test edx, edx
jne 0x470e50
lea edx, [esp + 0x2c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x44]
mov dword [esp + 4], edx
mov eax, dword [eax + 0x90]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_WSASend]
sub esp, 0x1c
cmp eax, 0xffffffff
mov edx, dword [esp + 0x2c]
je 0x470e32
mov eax, edx
add esp, 0x3c
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp], eax
call fcn.0045b940
mov edx, eax
add esp, 0x3c
mov eax, edx
ret
mov edx, 0xfffff008
jmp 0x470e2c
push esi
push ebx
sub esp, 0x24
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov esi, dword [esp + 0x38]
mov edx, dword [eax + 0x88]
test edx, edx
jne 0x478a33
lea edx, [esp + 0x1c]
mov ecx, esi
mov dword [esp], edx
mov edx, ebx
call fcn.00474db0
test eax, eax
jne 0x478a21
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0045a060
add esp, 0x24
pop ebx
pop esi
ret
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.0045b940
add esp, 0x24
pop ebx
pop esi
ret
mov eax, 0xfffff008
jmp 0x478a1b
Function at 0x46f6b0
Capabilities:
Set socket configuration

Disassembly:
push esi
push ebx
mov esi, eax
sub esp, 0x34
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], 4
mov dword [esp + 8], 8
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xffff
mov dword [esp], esi
call ebx
sub esp, 0x14
cmp eax, 0xffffffff
je 0x46f72f
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x46f702
add esp, 0x34
xor eax, eax
pop ebx
pop esi
ret
lea eax, [esp + 0x28]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 3
mov dword [esp + 4], 6
mov dword [esp], esi
mov dword [esp + 0xc], eax
call ebx
sub esp, 0x14
cmp eax, 0xffffffff
jne 0x46f6fa
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add esp, 0x34
pop ebx
pop esi
ret
Function at 0x46f740
Capabilities:
Set socket configuration

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
cmp dword [ecx], 0xffffffff
mov esi, dword [esp + 0x60]
mov dword [esp + 0x38], 1
jne 0x46f930
mov ebp, eax
lea eax, [esp + 0x38]
mov edi, ecx
mov ebx, edx
mov dword [esp + 4], 0x8004667e
mov dword [esp], esi
mov dword [esp + 8], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x46f860
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
sub esp, 0xc
test eax, eax
je 0x46f851
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov eax, dword [ebp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
sub esp, 0x10
test eax, eax
je 0x46f8d0
mov eax, dword [ebx]
mov ecx, dword [0x6ac788]
cmp dword [esp + 0x64], 0x17
mov edx, dword [0x6ac7dc]
cmovne edx, dword [0x6ac7e0]
test ecx, ecx
je 0x46f7fc
mov ebp, eax
and ebp, 0x100000
or ebp, edx
je 0x46f870
test eax, 0x2000000
jne 0x46f8f0
test eax, 0x4000000
jne 0x46f8a0
cmp dword [esp + 0x64], 0x17
mov dword [edi], esi
je 0x46f8c0
mov edx, dword [ebx]
xor eax, eax
and edx, 0x1000000
je 0x46f857
mov dword [esp + 8], 0x96
mov dword [esp + 4], str.src_win_tcp.c
mov dword [esp], 0x646420
mov dword [esp + 0x2c], eax
call fcn.004a0380
mov eax, dword [esp + 0x2c]
jmp 0x46f857
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 3
mov dword [esp], esi
call ecx
sub esp, 8
test eax, eax
je 0x46f950
mov eax, dword [ebx]
or eax, 0x40000
mov dword [ebx], eax
jmp 0x46f7fc
mov ecx, 0x3c
mov edx, 1
mov eax, esi
call fcn.0046f6b0
test eax, eax
je 0x46f812
jmp 0x46f857
or dword [ebx], 0x1000000
xor eax, eax
jmp 0x46f857
mov eax, dword [esp + 0x68]
test eax, eax
je 0x46f851
mov eax, dword [ebx]
or eax, 0x100000
mov dword [ebx], eax
jmp 0x46f7d4
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 1
mov dword [esp + 0x10], 4
mov dword [esp + 8], 1
mov dword [esp + 4], 6
mov dword [esp + 0xc], eax
mov dword [esp], esi
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
cmp eax, 0xffffffff
je 0x46f940
mov eax, dword [ebx]
jmp 0x46f807
mov eax, 0xfffff00e
jmp 0x46f857
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x46f857
jmp 0x46f929
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 1
jne 0x46f964
mov eax, dword [ebx]
jmp 0x46f7fc
call ebp
jmp 0x46f857
Function at 0x46f970
Capabilities:
Set socket configuration

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
mov eax, dword [eax + 0x90]
movzx edx, word [edx]
cmp eax, 0xffffffff
je 0x46f9c5
cmp dx, 0x17
je 0x46fa40
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_bind]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x46fa90
or dword [ebx + 0x2c], 0x200
xor ecx, ecx
add esp, 0x4c
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [esp + 0x60], 1
je 0x46f9d7
cmp dx, 0x17
mov ecx, 0x57
jne 0x46f9bb
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], edx
call dword [sym.imp.WS2_32.dll_socket]
sub esp, 0xc
cmp eax, 0xffffffff
mov ebp, eax
je 0x46fa82
movzx eax, word [esi]
lea ecx, [ebx + 0x90]
lea edx, [ebx + 0x2c]
mov dword [esp + 8], 0
mov dword [esp], ebp
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
call fcn.0046f740
test eax, eax
jne 0x46fab2
movzx edx, word [esi]
mov eax, dword [ebx + 0x90]
cmp dx, 0x17
jne 0x46f995
lea esi, [esi]
mov edx, dword [esp + 0x60]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 0x29
mov dword [esp], eax
and edx, 1
mov dword [esp + 0x3c], edx
lea edx, [esp + 0x3c]
mov dword [esp + 0xc], edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [ebx + 0x90]
sub esp, 0x14
jmp 0x46f995
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
jmp 0x46f9bb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2740
mov ecx, eax
jne 0x46f9bb
mov dword [ebx + 0x94], 0x2740
jmp 0x46f9b2
mov dword [esp + 0x2c], eax
mov dword [esp], ebp
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
mov ecx, dword [esp + 0x2c]
jmp 0x46f9bb

Function at 0x4708c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov edx, dword [eax + 0x90]
cmp edx, 0xffffffff
je 0x470915
mov eax, dword [eax + 0x94]
test eax, eax
jne 0x470908
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.WS2_32.dll_getsockname]
sub esp, 0xc
test eax, eax
jne 0x470902
add esp, 0x18
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 0x20], eax
add esp, 0x18
pop ebx
jmp fcn.0045b940
mov eax, 0xfffff019
jmp 0x4708fd
Function at 0x471570
Capabilities:
Set socket configuration

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x34]
mov esi, dword [esp + 0x38]
cmp dword [ebx + 8], 0xc
je 0x47159f
mov dword [esp + 8], 0x45d
mov dword [esp + 4], str.src_win_tcp.c
mov dword [esp], str.handle__type__UV_TCP
call fcn.004a0380
mov eax, dword [esi + 0x3c]
cmp eax, 0xffffffff
je 0x471630
mov edx, dword [esi + 0x20]
test edx, edx
js 0x4715eb
lea edx, [ebx + 0x90]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 0x700b
mov dword [esp + 4], 0xffff
mov dword [esp], eax
mov dword [esp + 0xc], edx
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
test eax, eax
je 0x4716f0
mov eax, dword [esi + 0x3c]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
test byte [ebx + 0x2d], 8
mov dword [esi + 0x3c], 0xffffffff
jne 0x471722
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x4716a1
sub eax, 1
mov edx, dword [ebx + 0x2c]
test eax, eax
mov dword [ebx + 0x3c], eax
jne 0x471629
test dl, 1
jne 0x4716c5
add esp, 0x24
pop ebx
pop esi
ret
mov eax, dword [ebx + 0x2c]
test ah, 8
je 0x471608
mov edx, eax
and dh, 0xf7
sub dword [ebx + 0x40], 1
mov dword [ebx + 0x2c], edx
jne 0x471730
test al, 1
jne 0x471670
test al, 0x40
je 0x471670
mov edx, eax
and edx, 0xfffff7bf
test al, 0x20
mov dword [ebx + 0x2c], edx
je 0x471670
mov eax, dword [ebx + 4]
sub dword [eax + 4], 1
nop
lea esi, [esi]
mov ecx, dword [ebx + 0x88]
test ecx, ecx
je 0x471608
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call fcn.0047d590
mov esi, dword [ebx + 0x88]
mov dword [esp], eax
call fcn.0045b940
mov dword [esp], ebx
mov dword [esp + 4], eax
call esi
jmp 0x471608
mov dword [esp + 8], 0x485
mov dword [esp + 4], str.src_win_tcp.c
mov dword [esp], 0x6464e3
call fcn.004a0380
mov eax, dword [ebx + 0x3c]
jmp 0x471613
test dl, 8
jne 0x471629
mov eax, dword [esp + 0x30]
or edx, 8
mov dword [ebx + 0x2c], edx
mov eax, dword [eax + 0x2c]
mov dword [ebx + 0x28], eax
mov eax, dword [esp + 0x30]
mov dword [eax + 0x2c], ebx
add esp, 0x24
pop ebx
pop esi
ret
mov eax, dword [ebx + 0xa0]
mov dword [esi + 0x168], eax
mov eax, dword [ebx + 0x88]
mov dword [ebx + 0xa0], esi
test eax, eax
je 0x471608
mov dword [esp + 4], 0
mov dword [esp], ebx
call eax
jmp 0x471608
mov edx, esi
mov eax, ebx
call fcn.0046f060
jmp 0x471608
jns 0x471670
mov dword [esp + 8], 0x466
mov dword [esp + 4], str.src_win_tcp.c
mov dword [esp], 0x646619
call fcn.004a0380
jmp 0x471670