joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ce70
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rcx, str.ntdll.dll
mov rdi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rdi
test rax, rax
mov rsi, rax
je 0x46d0ae
lea rdx, str.RtlNtStatusToDosError
mov rcx, rax
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbx
test rax, rax
mov qword [0x004e7128], rax
je 0x46d09a
lea rdx, str.NtDeviceIoControlFile
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x004e7160], rax
je 0x46d09a
lea rdx, str.NtQueryInformationFile
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x004e7100], rax
je 0x46d09a
lea rdx, str.NtSetInformationFile
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x004e7120], rax
je 0x46d09a
lea rdx, str.NtQueryVolumeInformationFile
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x004e7138], rax
je 0x46d09a
lea rdx, str.NtQueryDirectoryFile
mov rcx, rsi
call rbx
cmp qword [0x004e7138], 0
mov qword [0x004e7148], rax
je 0x46d09a
lea rdx, str.NtQuerySystemInformation
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x004e7158], rax
je 0x46d09a
lea rcx, str.kernel32.dll
call rdi
test rax, rax
mov rsi, rax
je 0x46d0ae
lea rdx, str.GetQueuedCompletionStatusEx
mov rcx, rax
call rbx
mov rcx, rsi
lea rdx, str.SetFileCompletionNotificationModes
mov qword [0x004e7108], rax
call rbx
mov rcx, rsi
lea rdx, str.CreateSymbolicLinkW
mov qword [0x004e7110], rax
call rbx
mov rcx, rsi
lea rdx, str.CancelIoEx
mov qword [0x004e70d8], rax
call rbx
mov rcx, rsi
lea rdx, str.InitializeConditionVariable
mov qword [0x004e7150], rax
call rbx
mov rcx, rsi
lea rdx, str.SleepConditionVariableCS
mov qword [0x004e70d0], rax
call rbx
mov rcx, rsi
lea rdx, str.SleepConditionVariableSRW
mov qword [0x004e7168], rax
call rbx
mov rcx, rsi
lea rdx, str.WakeAllConditionVariable
mov qword [0x004e70f0], rax
call rbx
mov rcx, rsi
lea rdx, str.WakeConditionVariable
mov qword [0x004e7130], rax
call rbx
mov rcx, rsi
lea rdx, str.CancelSynchronousIo
mov qword [0x004e70f8], rax
call rbx
mov rcx, rsi
lea rdx, str.GetFinalPathNameByHandleW
mov qword [0x004e7118], rax
call rbx
lea rcx, str.powrprof.dll
mov qword [0x004e7140], rax
mov rsi, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rsi
test rax, rax
je 0x46d071
lea rdx, str.PowerRegisterSuspendResumeNotification
mov rcx, rax
call rbx
mov qword [0x004e70e0], rax
lea rcx, str.user32.dll
call rsi
test rax, rax
je 0x46d092
lea rdx, str.SetWinEventHook
mov rcx, rax
call rbx
mov qword [0x004e70e8], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetProcAddress
mov ecx, eax
call fcn.0044c530
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetModuleHandleA
mov ecx, eax
call fcn.0044c530
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x46d1b0
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rbx
sub rsp, 0x468
mov ecx, 0x202
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x46d3b9
lea r8, [0x004e7180]
lea rcx, str.0.0.0.0
xor edx, edx
call fcn.0044a880
test eax, eax
jne 0x46d38c
lea r8, [0x004e7190]
lea rcx, [0x004cc1a3]
xor edx, edx
call fcn.0044a8d0
test eax, eax
jne 0x46d38c
xor r8d, r8d
mov edx, 1
mov ecx, 2
mov rsi, qword [sym.imp.WS2_32.dll_socket]
call rsi
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x46d320
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 0x274
lea r9, [rsp + 0x1e0]
mov r8d, 0x2005
mov edx, 0xffff
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x46d391
test byte [rsp + 0x1e2], 2
je 0x46d300
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x46d3a5
xor r8d, r8d
mov edx, 1
mov ecx, 0x17
call rsi
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x46d360
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 0x274
lea r9, [rsp + 0x1e0]
mov r8d, 0x2005
mov edx, 0xffff
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x46d391
test byte [rsp + 0x1e2], 2
je 0x46d310
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x46d3a5
add rsp, 0x468
pop rbx
pop rsi
ret
mov dword [0x004e71ac], 1
jmp 0x46d273
mov dword [0x004e7170], 1
jmp 0x46d2e2
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
lea edx, [rax - 0x273b]
cmp edx, 1
jbe 0x46d285
sub eax, 0x273e
cmp eax, 1
jbe 0x46d285
call rbx
lea rdx, str.socket
mov ecx, eax
call fcn.0044c530
nop word cs:[rax + rax]
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
lea edx, [rax - 0x273b]
cmp edx, 1
jbe 0x46d2f4
sub eax, 0x273e
cmp eax, 1
ja 0x46d346
add rsp, 0x468
pop rbx
pop rsi
ret
call sub.msvcrt.dll_abort
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.getsockopt
mov ecx, eax
call fcn.0044c530
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.closesocket
mov ecx, eax
call fcn.0044c530
lea rdx, str.WSAStartup
mov ecx, eax
call fcn.0044c530
nop
nop dword [rax + rax]
Function at 0x474af0
Capabilities:
Send data
Send data on socket

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12d, dword [rcx + 0x194]
lea r13, [rcx + 0x130]
mov rsi, rcx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [rsi + 0x17b], 0
je 0x474c34
mov rbx, qword [rsi + 0x28]
mov byte [rsi + 0x17b], 0
test rbx, rbx
je 0x474c34
and r12d, 4
xor ebp, ebp
nop dword [rax]
cmp byte [rbx + 0x168], 0
mov rdi, qword [rbx + 8]
je 0x474bd7
mov rax, qword [rbx + 0x158]
test rax, rax
je 0x474b6b
movzx edx, byte [rax + 8]
test dl, dl
je 0x474bd7
cmp byte [rax + 9], 0
je 0x474bd7
test rdi, rdi
mov rdx, qword [rbx]
je 0x474cd0
mov qword [rdi], rdx
mov rdx, qword [rbx]
mov rcx, qword [rbx + 8]
test rdx, rdx
je 0x474cc0
mov qword [rdx + 8], rcx
test rax, rax
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov byte [rbx + 0x160], 0
je 0x474c50
mov rax, qword [rsi + 0x30]
mov qword [rbx], rax
cmp qword [rsi + 0x38], 0
je 0x474ce0
mov rax, qword [rsi + 0x30]
mov qword [rax + 8], rbx
mov qword [rsi + 0x30], rbx
mov byte [rbx + 0x168], 0
mov ebp, 1
test rdi, rdi
mov rbx, rdi
jne 0x474b40
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r12d, r12d
je 0x474c3f
test ebp, ebp
je 0x474c3f
xor r9d, r9d
mov rcx, qword [rsi + 0x170]
mov r8d, 1
lea rdx, [0x004cd8e0]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x474c3f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x474c3f
lea rdx, str.Failed_to_signal_resume_of_connection_via_inter_thread_communication_channel.
mov rcx, rsi
call fcn.0047b4a0
jmp 0x474c3f
xor ebp, ebp
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rax, qword [rsi + 0x10]
mov qword [rbx], rax
cmp qword [rsi + 0x18], 0
je 0x474cf0
mov rax, qword [rsi + 0x10]
mov qword [rax + 8], rbx
test r12d, r12d
mov qword [rsi + 0x10], rbx
jne 0x474bcb
mov rax, qword [rbx + 0x108]
test rax, rax
jne 0x474d40
cmp rax, qword [rsi + 0x188]
je 0x474d10
mov rax, qword [rsi + 0x50]
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x10], rax
cmp qword [rsi + 0x58], 0
je 0x474d00
mov rax, qword [rsi + 0x50]
mov qword [rax + 0x18], rbx
mov qword [rsi + 0x50], rbx
jmp 0x474bcb
mov qword [rsi + 0x28], rcx
jmp 0x474b8e
mov qword [rsi + 0x20], rdx
jmp 0x474b7a
mov qword [rsi + 0x38], rbx
jmp 0x474bc7
mov qword [rsi + 0x18], rbx
jmp 0x474c6a
mov qword [rsi + 0x58], rbx
jmp 0x474cb3
mov rax, qword [rsi + 0x40]
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x10], rax
cmp qword [rsi + 0x48], 0
je 0x474d58
mov rax, qword [rsi + 0x40]
mov qword [rax + 0x18], rbx
mov qword [rsi + 0x40], rbx
jmp 0x474bcb
call fcn.0047bb50
mov qword [rbx + 0x100], rax
mov rax, qword [rbx + 0x108]
jmp 0x474c87
mov qword [rsi + 0x48], rbx
jmp 0x474d2f
Function at 0x474e90
Capabilities:
Resolve function by parsing pe exports
Send data
Send data on socket
Send http request

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
jmp 0x474ea3
mov rbx, rax
mov rax, qword [rbx + 0xc0]
test rax, rax
jne 0x474ea0
mov eax, dword [rbx + 0x190]
test eax, eax
jne 0x474ec1
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
cmp r8d, 0x10
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
je 0x474f80
cmp r8d, 0x1c
jne 0x474eb9
mov rax, qword [rdx + 8]
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x17
mov qword [rsp + 0x24], rax
mov qword [rsp + 0x2c], rdx
lea rdi, [rbx + 0x108]
add rbx, 0xd0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x20]
lea r8, [0x00474e80]
mov rdx, rbx
call fcn.0048c4b0
test rax, rax
je 0x474f94
mov rsi, qword [rax]
mov eax, dword [rsi + 0x14]
test eax, eax
je 0x474fb5
sub eax, 1
test eax, eax
mov dword [rsi + 0x14], eax
jne 0x474f64
lea r8, [0x00474e80]
mov rcx, rsi
mov rdx, rbx
call fcn.0048c3c0
mov rcx, rsi
call sub.msvcrt.dll_free
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [rdx + 4]
mov dword [rsp + 0x20], 2
mov dword [rsp + 0x24], eax
jmp 0x474f06
lea r9, str.Failed_to_find_previously_added_IP_address_n
mov r8d, 0x1c7
lea rdx, str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov rcx, qword [0x004e5ae0]
call qword [0x004e5ae8]
lea r9, str.Previously_added_IP_address_had_counter_of_zero_n
mov r8d, 0x1cd
lea rdx, str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov rcx, qword [0x004e5ae0]
call qword [0x004e5ae8]
nop
nop word [rax + rax]
Function at 0x475aa0
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdi, [rcx + 0x130]
mov rsi, rcx
mov rcx, rdi
call r12
mov rbx, qword [rsi + 0x38]
mov rbp, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x475c50
mov r15, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x475bf7
mov qword [rax], rdx
mov rax, qword [rbx]
mov rdx, qword [rbx + 8]
test rax, rax
je 0x475c1b
mov qword [rax + 8], rdx
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov rcx, rdi
call rbp
test byte [rsi + 0x194], 4
je 0x475b36
cmp byte [rbx + 0x122], 0
je 0x475c24
mov rcx, qword [rbx + 0x158]
test rcx, rcx
je 0x475b52
mov qword [rbx + 0x158], 0
call sub.msvcrt.dll_free
mov rcx, qword [rbx + 0x40]
call fcn.0047b8e0
mov rax, qword [rsi + 0x80]
test rax, rax
je 0x475b7d
mov rcx, qword [rsi + 0x88]
mov r9d, 1
lea r8, [rbx + 0x50]
mov rdx, rbx
call rax
mov rdx, qword [rbx + 0x98]
mov r8d, dword [rbx + 0xf8]
mov rcx, rsi
call fcn.00474e90
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x475ba9
call sym.xmrig.exe_MHD_destroy_response
mov qword [rbx + 0x38], 0
mov rcx, qword [rbx + 0x118]
cmp rcx, 0xffffffffffffffff
je 0x475bc1
call r13
test eax, eax
jne 0x475c69
mov rcx, qword [rbx + 0x98]
test rcx, rcx
je 0x475bd2
call sub.msvcrt.dll_free
mov rcx, rbx
call sub.msvcrt.dll_free
mov rcx, rdi
call r12
mov rbx, qword [rsi + 0x38]
sub dword [rsi + 0x180], 1
mov byte [rsi + 0x17a], 0
test rbx, rbx
je 0x475c50
mov rax, qword [rbx + 8]
mov rdx, qword [rbx]
test rax, rax
jne 0x475af5
mov qword [rsi + 0x30], rdx
mov rax, qword [rbx]
mov rdx, qword [rbx + 8]
test rax, rax
jne 0x475b08
mov qword [rsi + 0x38], rdx
jmp 0x475b0c
mov rcx, qword [rbx + 0xa0]
mov edx, 0xffffffff
call r15
test eax, eax
jne 0x475c8a
mov rcx, qword [rbx + 0xa0]
call r14
jmp 0x475b36
mov rcx, rdi
mov rax, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax
lea r9, str.Close_socket_failed._n
mov r8d, 0xc14
lea rdx, str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov rcx, qword [0x004e5ae0]
call qword [0x004e5ae8]
lea r9, str.Failed_to_join_a_thread_n
mov r8d, 0xbdf
lea rdx, str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov rcx, qword [0x004e5ae0]
call qword [0x004e5ae8]
nop
nop dword [rax]
Function at 0x476410
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rdi, rcx
mov byte [rcx + 0x17c], 0
mov rcx, qword [rcx + 0x168]
mov r12, rdx
mov qword [rsp + 0x90], r8
mov r14, r9
cmp rcx, 0xffffffffffffffff
jne 0x476610
mov rcx, qword [rdi + 0x158]
cmp rcx, 0xffffffffffffffff
je 0x476465
movzx eax, byte [rdi + 0x179]
test al, al
je 0x4765f0
test byte [rdi + 0x194], 4
jne 0x47651c
mov rbx, qword [rdi + 0x18]
test rbx, rbx
je 0x47651c
nop
mov rsi, qword [rbx + 0x118]
mov rbp, qword [rbx + 8]
cmp rsi, 0xffffffffffffffff
je 0x476510
mov rdx, r14
mov rcx, rsi
call sub.WS2_32.dll___WSAFDIsSet
mov rdx, qword [rsp + 0x90]
mov rcx, rsi
mov r13d, eax
call sub.WS2_32.dll___WSAFDIsSet
mov rdx, r12
mov rcx, rsi
mov r15d, eax
call sub.WS2_32.dll___WSAFDIsSet
test r13d, r13d
jne 0x476564
mov edx, dword [rbx + 0x12c]
mov esi, dword [rbx + 0x128]
test edx, edx
je 0x476540
cmp edx, 1
je 0x476590
mov rcx, rbx
call fcn.00471c90
mov rax, qword [rbx + 0x20]
cmp byte [rax + 0x17c], 0
jne 0x476510
test byte [rax + 0x194], 4
jne 0x476510
cmp dword [rbx + 0x12c], 2
je 0x476650
nop word [rax + rax]
test rbp, rbp
mov rbx, rbp
jne 0x476480
mov rcx, rdi
call fcn.00475aa0
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test eax, eax
je 0x4764df
mov rcx, rbx
call fcn.00470b70
mov rcx, rbx
call fcn.00471c90
cmp dword [rbx + 0x12c], 1
jne 0x4765a9
test r15d, r15d
je 0x4765a9
jmp 0x476599
mov rcx, rbx
mov edx, 1
call fcn.004709f0
mov rcx, rbx
mov rbx, rbp
call fcn.00471c90
test rbp, rbp
jne 0x476480
jmp 0x47651c
test r15d, r15d
je 0x4764df
mov rcx, rbx
call fcn.00470f80
mov rcx, rbx
call fcn.00471c90
test esi, esi
jne 0x4764e7
cmp byte [rbx + 0x120], 0
je 0x4764e7
mov eax, dword [rbx + 0x128]
cmp eax, 0xa
je 0x476670
and eax, 0xfffffffd
cmp eax, 0xc
jne 0x4764e7
mov rcx, rbx
call fcn.00470f80
jmp 0x4764df
mov rdx, r12
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x476465
mov rcx, rdi
call fcn.00475890
jmp 0x476465
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x476449
mov rbx, qword [sym.imp.WS2_32.dll_recv]
lea rsi, [rsp + 0x2c]
nop dword [rax]
xor r9d, r9d
mov rcx, qword [rdi + 0x168]
mov r8d, 4
mov rdx, rsi
call rbx
test eax, eax
jg 0x476630
jmp 0x476449
test rbp, rbp
mov byte [rax + 0x17c], 1
mov rbx, rbp
jne 0x476480
jmp 0x47651c
mov rcx, rbx
call fcn.00470f80
mov rcx, rbx
call fcn.00471c90
mov eax, dword [rbx + 0x128]
jmp 0x4765cd
Function at 0x477a70
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [rcx + 0x20]
mov rbx, rcx
test byte [rsi + 0x195], 0x20
je 0x477c06
cmp qword [rcx + 0x158], 0
je 0x477ab0
lea rdx, str.Error:_connection_scheduled_for__upgrade__cannot_be_suspended
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.0047b4a0
lea rdi, [rsi + 0x130]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [rbx + 0x168], 0
jne 0x477b90
test byte [rsi + 0x194], 4
jne 0x477b24
mov rcx, qword [rsi + 0x188]
cmp qword [rbx + 0x108], rcx
mov rax, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x10]
je 0x477bc0
test rax, rax
je 0x477bf0
mov qword [rax + 0x10], rdx
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
test rax, rax
je 0x477be3
mov qword [rax + 0x18], rdx
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx]
test rax, rax
je 0x477b84
mov qword [rax], rdx
mov rax, qword [rbx]
mov rdx, qword [rbx + 8]
test rax, rax
je 0x477bb0
mov qword [rax + 8], rdx
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov rax, qword [rsi + 0x20]
mov qword [rbx], rax
cmp qword [rsi + 0x28], 0
je 0x477ba0
mov rax, qword [rsi + 0x20]
mov qword [rax + 8], rbx
mov qword [rsi + 0x20], rbx
mov byte [rbx + 0x160], 1
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsi + 0x10], rdx
jmp 0x477b33
mov byte [rbx + 0x168], 0
jmp 0x477b73
mov qword [rsi + 0x28], rbx
jmp 0x477b68
mov qword [rsi + 0x18], rdx
jmp 0x477b43
test rax, rax
je 0x477c00
mov qword [rax + 0x10], rdx
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
test rax, rax
jne 0x477b10
mov qword [rsi + 0x48], rdx
jmp 0x477b14
mov qword [rsi + 0x58], rdx
jmp 0x477b14
mov qword [rsi + 0x50], rdx
jmp 0x477aff
mov qword [rsi + 0x40], rdx
jmp 0x477bc9
lea r9, str.Cannot_suspend_connections_without_enabling_MHD_ALLOW_SUSPEND_RESUME__n
mov r8d, 0xa5d
lea rdx, str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov rcx, qword [0x004e5ae0]
call qword [0x004e5ae8]
nop
nop dword [rax + rax]
Function at 0x477c30
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [rcx + 0x20]
mov rsi, rcx
test byte [rbx + 0x195], 0x20
je 0x477cc4
lea rdi, [rbx + 0x130]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsi + 0x168], 1
mov rcx, rdi
mov byte [rbx + 0x17b], 1
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp qword [rbx + 0x168], 0xffffffffffffffff
je 0x477c99
xor r9d, r9d
mov rcx, qword [rbx + 0x170]
mov r8d, 1
lea rdx, [0x004cdf06]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x477ca1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x477c99
lea rdx, str.Failed_to_signal_resume_via_inter_thread_communication_channel.
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.0047b4a0
lea r9, str.Cannot_resume_connections_without_enabling_MHD_ALLOW_SUSPEND_RESUME__n
mov r8d, 0xa7b
lea rdx, str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov rcx, qword [0x004e5ae0]
call qword [0x004e5ae8]
nop
nop word cs:[rax + rax]
Function at 0x4793e0
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, qword [rcx + 0x158]
mov r13, rcx
cmp rdi, 0xffffffffffffffff
je 0x479503
mov eax, dword [rcx + 0x194]
and eax, 0x408
cmp eax, 8
je 0x479541
mov rdx, qword [rcx + 0xc8]
test rdx, rdx
je 0x4794d0
mov eax, dword [rcx + 0xf0]
test eax, eax
je 0x4794d0
xor r12d, r12d
lea rsi, [0x004ce684]
mov rbx, qword [sym.imp.WS2_32.dll_send]
mov rbp, qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x479464
add r12d, 1
cmp dword [r13 + 0xf0], r12d
jbe 0x4794d0
mov rdx, qword [r13 + 0xc8]
mov eax, r12d
imul rax, rax, 0x1e8
add rdx, rax
mov byte [rdx + 0x179], 1
add rax, qword [r13 + 0xc8]
cmp qword [rax + 0x168], 0xffffffffffffffff
je 0x479450
xor r9d, r9d
mov rcx, qword [rax + 0x170]
mov r8d, 1
mov rdx, rsi
call rbx
test eax, eax
jg 0x479450
call rbp
cmp eax, 0x2733
je 0x479450
lea r9, str.Failed_to_signal_quiesce_via_inter_thread_communication_channel
mov r8d, 0x11da
lea rdx, str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov rcx, qword [0x004e5ae0]
call qword [0x004e5ae8]
nop dword [rax]
cmp qword [r13 + 0x168], 0xffffffffffffffff
mov byte [r13 + 0x179], 1
je 0x479503
xor r9d, r9d
mov rcx, qword [r13 + 0x170]
mov r8d, 1
lea rdx, [0x004ce684]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x479513
mov rax, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x479503
lea r9, str.failed_to_signal_quiesce_via_inter_thread_communication_channel
mov r8d, 0x11ed
lea rdx, str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov rcx, qword [0x004e5ae0]
call qword [0x004e5ae8]
lea rdx, str.Using_MHD_quiesce_daemon_in_this_mode_requires_MHD_USE_ITC_n
mov rdi, 0xffffffffffffffff
call fcn.0047b4a0
jmp 0x479503
Function at 0x47c140
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov eax, 0xffffffff
cmp rdx, rax
mov rbx, rcx
ja 0x47c180
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
cmp rax, 0xffffffffffffffff
mov qword [rbx], rax
setne al
movzx eax, al
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x47ce30
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov edx, 0x8004667e
mov dword [rsp + 0x2c], 1
lea r8, [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
sete al
movzx eax, al
add rsp, 0x38
ret
Function at 0x489cc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x004e62c4]
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
test esi, esi
jle 0x489e74
mov rax, qword [0x004e62c8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x489d0c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x489d99
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x489cf0
mov rcx, rbx
call fcn.0048a990
test rax, rax
mov r12, rax
je 0x489ea9
mov rax, qword [0x004e62c8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.0048aac0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x004e62c8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x489e8c
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x489d92
sub eax, 0x40
and eax, 0xffffffbf
jne 0x489e14
add dword [0x004e62c4], 1
cmp edi, 8
jae 0x489dd0
test dil, 4
jne 0x489e60
test edi, edi
je 0x489dbc
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x489e7b
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rbp]
mov qword [rbx], rax
mov eax, edi
mov rdx, qword [rbp + rax - 8]
mov qword [rbx + rax - 8], rdx
lea rax, [rbx + 8]
and rax, 0xfffffffffffffff8
sub rbx, rax
sub rbp, rbx
add ebx, edi
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x489dbc
and ebx, 0xfffffff8
xor edx, edx
mov ecx, edx
add edx, 8
mov r8, qword [rbp + rcx]
cmp edx, ebx
mov qword [rax + rcx], r8
jb 0x489e00
jmp 0x489dbc
add rsi, qword [0x004e62c8]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x489d92
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004c1570
nop dword [rax + rax]
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x489dbc
xor esi, esi
jmp 0x489d17
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x489dbc
mov rax, qword [0x004e62c8]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rsi + 0x18]
call fcn.004c1570
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.004c1570
nop
nop dword [rax]
Function at 0x48a600
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004e65a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004e6580]
test rbx, rbx
je 0x48a654
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x48a64b
test rsi, rsi
je 0x48a64b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x48a630
lea rcx, [0x004e65a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x48a990
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x004d32f0]
mov rdx, rcx
cmp word [r8], 0x5a4d
jne 0x48a9fd
mov rcx, r8
call fcn.0048a870
test eax, eax
je 0x48a9fd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x48a9fd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x48a9f4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x48a9ff
add rax, 0x28
cmp rax, r9
jne 0x48a9e0
xor eax, eax
add rsp, 0x28
ret