joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4750f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x679d8e
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebp
push esi
mov eax, dword [0x70df38]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi + 4], 0
mov ebp, dword [esp + 0x30]
push ebp
lea ecx, [esi + 8]
mov dword [esp + 0x2c], 0
mov dword [esi], vtable.bdCommonAddr.0
call fcn.00474ea0
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esi + 0x14]
mov byte [esp + 0x2c], 1
call fcn.00477170
mov ecx, dword [esp + 0x38]
mov byte [esp + 0x28], 2
mov dword [esi + 0x1c], ecx
mov byte [esi + 0x24], 1
nop
cmp dword [ebp + 8], 0
ja 0x475193
push str.Too_few_local_addresses_
push 0x6f8dcb
push str.dw_err
push 0x22
push str.__thiscall_bdCommonAddr::bdCommonAddr_const_class_bdArray_class_bdAddr___const_class_bdAddr__const_enum_bdNATType_
push str.._bdSocket_bdCommonAddr.cpp
lea ecx, [esp + 0x28]
call fcn.00475a90
push eax
call fcn.00475c30
add esp, 0xc
cmp byte [0x77ffcc], 0
jne 0x475160
lea esp, [esp]
cmp dword [ebp + 8], 3
jbe 0x4751d3
push str.Too_many_local_addresses_
push 0x6f8dcb
push str.dw_err
push 0x23
push str.__thiscall_bdCommonAddr::bdCommonAddr_const_class_bdArray_class_bdAddr___const_class_bdAddr__const_enum_bdNATType_
push str.._bdSocket_bdCommonAddr.cpp
lea ecx, [esp + 0x28]
call fcn.00475a90
push eax
call fcn.00475c30
add esp, 0xc
cmp byte [0x77ffcc], 0
jne 0x4751a0
mov ecx, esi
call fcn.00474cc0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x20
ret 0xc

Function at 0x4788c0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x68
mov eax, dword [0x70df38]
xor eax, esp
mov dword [esp + 0x64], eax
cmp dword [0x77fff8], 0
je 0x478937
push esi
mov ecx, 0x780000
call fcn.00478ba0
mov eax, dword [0x77fffc]
mov ecx, dword [0x77fff8]
push eax
push ecx
push str._u_Bytes_leaked_in__u_allocation_s__n
lea edx, [esp + 0x10]
push 0x64
push edx
call fcn.004755c0
add esp, 0x14
mov ecx, 0x780000
call fcn.00478bb0
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x68ac18
call esi
push str.______BITDEMON_MEMORY_LEAKS_DETECTED_______n
call esi
push 0x68ac18
call esi
lea eax, [esp + 4]
push eax
call esi
push 0x68ac18
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.004ad31a
add esp, 0x68
ret
Function at 0x47aed0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x67a478
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x70df38]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.0047dd30
xor edi, edi
lea ecx, [esi + 0xc]
mov dword [esp + 0x18], edi
mov dword [esi], vtable.bdLobbyServiceImpl.0
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.004806d0
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0xf0], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x47c850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67a728
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x70df38]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x70df38]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov esi, dword [esp + 0x54]
mov ebx, dword [esp + 0x58]
lea ecx, [esp + 0x10]
call fcn.00477b90
mov eax, esi
mov dword [esp + 0x4c], 0
mov dword [esp + 0x14], 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x47c8a7
sub eax, edx
mov edi, eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
push ecx
push edi
push esi
lea ecx, [esp + 0x20]
call fcn.00477b00
test al, al
jne 0x47c8fa
push str.Hash_function_failed.
push 0x6f8dcb
push str.dw_err
push 0x4f
push str.void___cdecl_bdAuthUtility::getUserKey_const_char__char____
push str.._bdLobbyCommon_bdAuthCommon.cpp
lea ecx, [esp + 0x30]
call fcn.00475a90
push eax
call fcn.00475c30
add esp, 0xc
cmp byte [0x77ffcc], 0
jne 0x47c8b4
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [ebx], edx
mov edx, dword [esp + 0x34]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x38]
mov dword [ebx + 8], ecx
mov ecx, dword [esp + 0x3c]
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x4c], 0xffffffff
call fcn.00477af0
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004ad31a
add esp, 0x40
ret
Function at 0x484dd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x67afc7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x70df38]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.bdNetImpl.0
call fcn.0041c440
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x38]
mov byte [esp + 0x18], 1
mov dword [esi + 0x34], ebx
call fcn.00476be0
lea ecx, [esi + 0x5c]
mov byte [esp + 0x18], 2
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
call fcn.00489940
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
lea ecx, [esi + 0x98]
mov byte [esp + 0x18], 4
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov byte [esi + 0x90], bl
mov dword [esi + 0x94], ebx
call fcn.004c8140
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x485cb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67b13b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x70df38]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
fldz
lea ecx, [esi + 0x10]
fstp dword [esi + 8]
mov dword [esi], vtable.bdDiscoveryClient.0
call fcn.004c7600
lea ecx, [esi + 0x20]
call fcn.004c8140
xor eax, eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x489670
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x67b511
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x70df38]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esi], edi
mov eax, 1
mov dword [esi + 4], eax
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x18], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
lea ecx, [esi + 0x20]
mov byte [esp + 0x18], al
call fcn.004c8140
fld dword [0x686bf8]
lea ecx, [esi + 0x38]
fstp dword [esi + 0x30]
mov byte [esp + 0x18], 2
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
call fcn.004c7600
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x489820
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67b598
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70df38]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x14], eax
mov ebp, dword [esp + 0x34]
mov eax, dword [ebp]
mov edx, dword [eax + 0xc]
lea ecx, [esp + 0x14]
push ecx
mov ebx, 1
mov ecx, ebp
mov byte [esp + 0x30], bl
call edx
test al, al
je 0x4898e8
push ecx
mov eax, esp
mov dword [eax], ebp
add dword [ebp + 4], ebx
mov dword [esp + 0x1c], esp
push ecx
mov ecx, dword [esp + 0x1c]
mov eax, esp
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x20], esp
je 0x489897
add dword [eax + 4], ebx
lea ecx, [esp + 0x24]
call fcn.0048a320
mov byte [esp + 0x2c], 2
xor esi, esi
cmp esi, dword [edi + 8]
jae 0x4898c8
push esi
mov ecx, edi
call fcn.004897c0
mov ecx, dword [eax]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
lea eax, [esp + 0x1c]
push eax
call edx
add esi, ebx
test al, al
je 0x4898a7
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], bl
call fcn.0048a3c0
mov eax, dword [ebp]
mov edx, dword [eax + 0xc]
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebp
call edx
test al, al
jne 0x489873
mov eax, dword [esp + 0x14]
or esi, 0xffffffff
test eax, eax
mov byte [esp + 0x2c], 0
je 0x489912
add eax, 4
add dword [eax], esi
jne 0x489912
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov eax, dword [edx]
push ebx
call eax
mov dword [esp + 0x14], 0
add dword [ebp + 4], esi
mov dword [esp + 0x2c], esi
jne 0x489925
mov edx, dword [ebp]
mov eax, dword [edx]
push ebx
mov ecx, ebp
call eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x489c10
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
sub esp, 8
push esi
push edi
push 0x11
push 2
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov edi, dword [sym.imp.WSOCK32.dll_setsockopt]
push 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0xfffffffffffffffb
push 0xffff
push esi
mov dword [esp + 0x1c], 1
call edi
test eax, eax
je 0x489c4f
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
cmp byte [esp + 0x14], 0
je 0x489c73
push 4
lea ecx, [esp + 0x10]
push ecx
push 0x20
push 0xffff
push esi
mov dword [esp + 0x20], 1
call edi
test eax, eax
jne 0x489c46
pop edi
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x48a180
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
movsx eax, byte [esi]
push eax
xor ebx, ebx
call fcn.004ab519
add esp, 4
test eax, eax
je 0x48a1dd
push edi
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov edi, eax
test edi, edi
je 0x48a239
mov edx, dword [esp + 0x18]
xor eax, eax
test edx, edx
jbe 0x48a23b
mov esi, dword [esp + 0x14]
lea esp, [esp]
mov ecx, dword [edi + 0xc]
cmp dword [ecx + eax*4], ebx
lea ecx, [ecx + eax*4]
je 0x48a23b
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov dword [esi + eax*4], ecx
add eax, 1
cmp eax, edx
jb 0x48a1c0
pop edi
pop esi
pop ebx
ret
push esi
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov edx, dword [esp + 0x10]
mov dword [edx], eax
jne 0x48a231
mov eax, dword [str.255.255.255.255]
mov ecx, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x48a220
test dl, dl
je 0x48a212
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x48a220
add eax, 2
add ecx, 2
test dl, dl
jne 0x48a1f6
xor eax, eax
xor ecx, ecx
test eax, eax
sete cl
pop esi
pop ebx
mov eax, ecx
ret
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
pop esi
pop ebx
mov eax, ecx
ret
pop esi
mov eax, 1
pop ebx
ret
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x48ad00
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x67b868
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x70df38]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push str.Disconnecting_all_connections.
push str.bdConnection_connectionstore
push str.dw_info_
push 0x96
push str.void___thiscall_bdConnectionStore::disconnectAll_void_
push str.._bdConnectionStore.cpp
lea ecx, [esp + 0x30]
call fcn.00475a90
push eax
call fcn.00475c30
lea edi, [esi + 0x10]
add esp, 0xc
mov ecx, edi
call fcn.00477c80
test eax, eax
mov dword [esp + 0x10], eax
je 0x48adb6
or ebx, 0xffffffff
lea ecx, [ecx]
mov esi, dword [eax]
test esi, esi
mov dword [esp + 0x14], esi
je 0x48ad7e
add dword [esi + 4], 1
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
mov dword [esp + 0x30], 0
call edx
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.0048aa30
add dword [esi + 4], ebx
mov dword [esp + 0x30], ebx
jne 0x48adae
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x48ad70
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret

Function at 0x48bb40
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x67b868
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x70df38]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push str.Closing_all_connections.
push str.bdConnection_connectionstore
push str.dw_info_
push 0x83
push str.void___thiscall_bdConnectionStore::closeAll_void_
push str.._bdConnectionStore.cpp
lea ecx, [esp + 0x30]
call fcn.00475a90
push eax
call fcn.00475c30
lea edi, [esi + 0x10]
add esp, 0xc
mov ecx, edi
call fcn.00477c80
test eax, eax
mov dword [esp + 0x10], eax
je 0x48bbf6
or ebx, 0xffffffff
lea ecx, [ecx]
mov esi, dword [eax]
test esi, esi
mov dword [esp + 0x14], esi
je 0x48bbbe
add dword [esi + 4], 1
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
mov ecx, esi
mov dword [esp + 0x30], 0
call edx
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.0048aa30
add dword [esi + 4], ebx
mov dword [esp + 0x30], ebx
jne 0x48bbee
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x48bbb0
mov ecx, edi
call fcn.0048b860
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x48be20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67b8c1
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x70df38]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
xor ebp, ebp
cmp edi, ebp
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esp + 0x1c], ebp
mov dword [esi + 0xc], edi
je 0x48be73
add dword [edi + 4], 1
fld dword [0x6f9b34]
push ecx
fstp dword [esp]
push 4
lea ecx, [esi + 0x10]
mov byte [esp + 0x24], 1
call fcn.0048add0
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], ebp
mov dword [esi + 0x30], ebp
cmp edi, ebp
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
mov dword [eax], edi
je 0x48bea6
add dword [edi + 4], 1
mov byte [esp + 0x20], 4
call fcn.0048bd40
mov ecx, eax
mov byte [esp + 0x20], 3
call fcn.0049d5a0
or eax, 0xffffffff
cmp edi, ebp
mov dword [esp + 0x1c], eax
je 0x48bed6
add dword [edi + 4], eax
jne 0x48bed6
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 0x10

Function at 0x48c700
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67ba01
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x70df38]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 2
call fcn.0048bb40
mov ecx, esi
call fcn.0048c250
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov eax, dword [esi + 0x28]
push eax
mov byte [esp + 0x1c], 1
call fcn.00475da0
add esp, 4
lea ecx, [esi + 0x10]
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov byte [esp + 0x18], bl
call fcn.0048bc20
mov eax, dword [esi + 0xc]
or ecx, 0xffffffff
cmp eax, ebx
mov dword [esp + 0x18], ecx
je 0x48c790
add dword [eax + 4], ecx
jne 0x48c790
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x48c78d
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0xc], ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x496310
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x67c806
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x70df38]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.004c8a20
lea edi, [esi + 4]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x1c], ebx
call fcn.0048a240
mov dword [esi], vtable.bdSession.1.0
mov dword [edi], vtable.bdSession.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov eax, dword [esp + 0x24]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 1
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
lea ecx, [esi + 0x60]
mov byte [esp + 0x1c], 9
call fcn.00474730
lea ecx, [esi + 0x68]
call fcn.00474710
mov dword [esi + 0x78], ebx
lea ecx, [esi + 0x7d]
mov byte [esp + 0x1c], 0xa
mov byte [esi + 0x7c], bl
call fcn.00474730
lea ecx, [esi + 0x85]
call fcn.00474710
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x49ce20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x67d1b4
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x70df38]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [esi + 0xc]
mov dword [esi], vtable.bdNATTypeDiscoveryClient.0
call fcn.00477170
xor edi, edi
lea ecx, [esi + 0x14]
mov dword [esp + 0x40], edi
call fcn.00477150
lea ecx, [esi + 0x1c]
mov byte [esp + 0x40], 1
call fcn.00477150
mov ebx, 3
lea ecx, [esi + 0x38]
mov byte [esp + 0x40], 2
mov dword [esi + 0x24], ebx
mov byte [esi + 0x28], 0
mov dword [esi + 0x2c], edi
mov byte [esi + 0x30], 0
call fcn.004c7600
push 8
call fcn.00475d70
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, edi
mov byte [esp + 0x40], bl
je 0x49cebe
mov ecx, eax
call fcn.004c8140
jmp 0x49cec0
xor eax, eax
cmp eax, edi
mov byte [esp + 0x40], 2
mov dword [esi + 8], eax
je 0x49cedf
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 4]
push 1
call eax
test al, al
je 0x49cedf
mov bl, 1
jmp 0x49cee1
xor bl, bl
lea ecx, [esp + 0x1c]
call fcn.00477150
mov edi, dword [ebp + 8]
mov byte [esp + 0x40], 4
call fcn.00476e80
mov ecx, eax
call fcn.00478a90
movzx eax, ax
cmp ax, 0x400
ja 0x49cf0c
add eax, 0x401
push eax
push edi
lea ecx, [esp + 0x24]
call fcn.004771b0
test bl, bl
je 0x49cf30
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov edx, dword [edx + 8]
lea eax, [esp + 0x1c]
push eax
call edx
test eax, eax
je 0x49cef2
jmp 0x49cf5d
push str.Failed_to_create_socket
push str.bdSocket_nat
push str.dw_warn_
push 0x5c
push str.__thiscall_bdNATTypeDiscoveryClient::bdNATTypeDiscoveryClient_const_class_bdInetAddr__const_class_bdAddr__
push str.._bdNAT_bdNATTypeDiscoveryClient.cpp
lea ecx, [esp + 0x3c]
call fcn.00475a90
push eax
call fcn.00475c30
add esp, 0xc
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 2
call fcn.00476340
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x49fa80
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x67d75e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x70df38]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004a5fa0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
push ecx
lea ecx, [esi + 8]
mov dword [esp + 0x18], 0
mov dword [esi], vtable.bdNATTravClient.0
mov dword [esi + 4], eax
call fcn.00474ea0
fld dword [0x6f9b34]
mov edx, dword [esp + 0x20]
lea ecx, [esi + 0x18]
push ecx
fstp dword [esp]
push 4
mov byte [esp + 0x1c], 1
mov dword [esi + 0x14], edx
call fcn.0049e8f0
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 2
call fcn.004c7600
mov ecx, esi
mov dword [esi + 0x5c], 1
call fcn.0049eab0
lea eax, [esi + 0x40]
push 0x1c
push eax
call fcn.00476e80
mov ecx, eax
call fcn.00478a70
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0xc
Function at 0x4a3cc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67dd23
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x70df38]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
test eax, eax
mov dword [esi], eax
je 0x4a3cf9
add dword [eax + 4], 1
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x14], ecx
mov edx, dword [edi + 0x18]
lea ecx, [edi + 0x20]
mov dword [esi + 0x18], edx
mov eax, dword [edi + 0x1c]
push ecx
lea ecx, [esi + 0x20]
mov dword [esp + 0x1c], 0
mov dword [esi + 0x1c], eax
call fcn.00477170
mov edx, dword [edi + 0x28]
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
mov byte [esp + 0x1c], 1
mov dword [esi + 0x28], edx
call fcn.004c7550
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x4a3e50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x67dd23
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x70df38]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esi], edi
lea ecx, [esi + 4]
mov dword [esp + 0x18], edi
call fcn.00474730
lea ecx, [esi + 0xc]
call fcn.00474710
lea ecx, [esi + 0x20]
mov dword [esi + 0x1c], edi
call fcn.00477150
mov dword [esi + 0x28], edi
lea edi, [esi + 0x30]
mov ecx, edi
mov byte [esp + 0x18], 1
call fcn.004c7600
mov ecx, edi
call fcn.004c75a0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret