joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494ba7
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
lea eax, [esi + 0x30]
mov dword [esi + 0xc], ecx
xor edx, edx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x584c00
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
and dword [eax + 8], 0
and dword [esp], 0
lea ecx, [esi + 0x10]
mov byte [esi + 0xb], 1
call fcn.004948cd
lea ecx, [esi + 0x10]
mov byte [esi + 0xb], 1
call fcn.00494a18
mov edx, dword [esi + 0xc]
lea edi, [esi + 0x18]
mov ecx, dword [edx + 8]
movsd xmm0, qword [edx]
mov dword [edi + 0xc], ecx
movsd qword [edi + 4], xmm0
mov dword [edi], eax
xor eax, eax
inc eax
mov dword [edi - 8], eax
mov dword [edi - 4], eax
mov dword [esi + 0x38], eax
push 0x18
pop ecx
push 4
pop edx
call fcn.0042029e
movsd xmm0, qword [esi + 0x20]
mov edx, 0x5d0ed0
movsd qword [eax + 0x10], xmm0
movsd xmm0, qword [esi + 0x10]
movsd xmm1, qword [esi + 0x18]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov ecx, dword [esi + 0x30]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4abd2b
Capabilities:
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 0x18
mov esi, ecx
call fcn.00479b6c
cmp eax, 2
jb 0x4abd47
cmp dword [eax + 4], 0
je 0x4abd47
add eax, 8
jmp 0x4abdb2
call fcn.00479b6c
cmp eax, 1
je 0x4abdb0
mov edi, eax
test eax, eax
jne 0x4abd80
push 0xc
pop ecx
push 4
pop edx
call fcn.0042029e
mov dword [eax], 0x673054
and dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x673054]
test eax, eax
je 0x4abdb8
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x4abd92
mov eax, dword [esi]
and dword [esi], 0
test eax, eax
je 0x4abd92
mov ecx, dword [esi + 4]
jmp 0x4abda1
xor ecx, ecx
inc ecx
lock xadd dword [0x673050], ecx
test ecx, ecx
je 0x4abdc4
lea eax, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], ecx
jmp 0x4abdb2
xor eax, eax
add esp, 0x18
pop esi
pop edi
ret
mov ecx, 0x673054
call fcn.0059d5e0
jmp 0x4abd78
mov ecx, esp
mov edx, 0x5d4200
mov dword [ecx], str.regex:_thread_ID_allocation_space_exhausted
mov dword [ecx + 4], 1
and dword [ecx + 0x10], 0
mov dword [ecx + 8], str._rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_std_srcioimpls.rs
and dword [ecx + 0xc], 0
call fcn.0059a150
Function at 0x4d78c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x673094]
test eax, eax
je 0x4d7978
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4d78ec
cmp dword [eax + 4], 0
mov edi, eax
je 0x4d78ec
add edi, 8
jmp 0x4d7973
mov eax, dword [0x673094]
test eax, eax
je 0x4d7987
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4d7971
mov esi, eax
test eax, eax
jne 0x4d7947
movzx eax, byte [0x673c84]
mov ecx, 0xc
mov edx, 4
call fcn.004051f0
test eax, eax
je 0x4d79a2
mov dword [eax], 0x673094
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x673094]
test eax, eax
je 0x4d7996
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x4d7973
test ecx, ecx
je 0x4d7973
lock dec dword [ecx]
jne 0x4d7973
call fcn.004d7440
jmp 0x4d7973
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x673094
call fcn.0059d5e0
jmp 0x4d78d0
mov ecx, 0x673094
call fcn.0059d5e0
jmp 0x4d78fa
mov ecx, 0x673094
call fcn.0059d5e0
jmp 0x4d793f
mov ecx, 4
mov edx, 0xc
call fcn.00599e40
int3

Function at 0x4d7f40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x6730a4]
test eax, eax
je 0x4d7fc4
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4d7f5f
cmp byte [eax + 4], 0
mov esi, eax
jne 0x4d7fb9
mov eax, dword [0x6730a4]
test eax, eax
je 0x4d7fd3
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4d7fbe
mov esi, eax
test eax, eax
jne 0x4d7fb3
movzx eax, byte [0x673c84]
mov ecx, 8
mov edx, 4
call fcn.004051f0
test eax, eax
je 0x4d7feb
mov dword [eax], 0x6730a4
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x6730a4]
test eax, eax
je 0x4d7fdf
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x4d7fc0
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x6730a4
call fcn.0059d5e0
jmp 0x4d7f4b
mov ecx, 0x6730a4
call fcn.0059d5e0
jmp 0x4d7f69
mov ecx, 0x6730a4
call fcn.0059d5e0
jmp 0x4d7fab
mov ecx, 4
mov edx, 8
call fcn.00599e40
int3
Function at 0x4d8690
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x4d86e4
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x4d8707
test eax, eax
js 0x4d86f3
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x4d86ff
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x620eac
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.004d6ef0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.004d7020
mov ecx, 7
int 0x29
ud2
Function at 0x4d8ef0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x673084]
test eax, eax
je 0x4d8f88
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4d8f16
cmp dword [eax + 4], 0
je 0x4d8f16
add eax, 8
pop esi
ret
mov eax, dword [0x673084]
test eax, eax
je 0x4d8f97
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4d8f84
mov esi, eax
test eax, eax
jne 0x4d8f6d
movzx eax, byte [0x673c84]
mov ecx, 0x10
mov edx, 4
call fcn.004051f0
test eax, eax
je 0x4d8fb2
mov dword [eax], 0x673084
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x673084]
test eax, eax
je 0x4d8fa6
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x673084
call fcn.0059d5e0
jmp 0x4d8eff
mov ecx, 0x673084
call fcn.0059d5e0
jmp 0x4d8f20
mov ecx, 0x673084
call fcn.0059d5e0
jmp 0x4d8f65
mov ecx, 4
mov edx, 0x10
call fcn.00599e40
int3

Function at 0x4d9cb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], esp
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x34], 0x585790
lea eax, [esi + 0x30]
mov ecx, dword fs:[0]
mov dword [esi + 0x30], ecx
mov dword fs:[0], eax
lea eax, [esi + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x4d9dc3
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
mov dword [esi], eax
call fcn.004da030
mov ecx, eax
or ecx, edx
je 0x4d9daf
push edx
push eax
push ebx
push dword [esi]
mov edi, edx
mov dword [esi + 0x20], edx
mov dword [esi + 0x1c], eax
call fcn.00589500
mov ecx, edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 4], edx
mov dword [esi + 0x24], eax
imul ecx, eax
mul edi
add edx, ecx
mov ecx, edi
imul ecx, dword [esi + 4]
add ecx, edx
mov edx, dword [esi]
sub edx, eax
sbb ebx, ecx
mov eax, edx
imul ecx, ebx, 0x3b9aca00
mov ebx, 0x3b9aca00
mul ebx
add edx, ecx
push dword [esi + 0x20]
push edi
push edx
push eax
call fcn.00589500
mov ebx, eax
mov eax, dword [esi + 0x24]
mov ecx, edx
mov edx, 0x3b9aca00
mul edx
mov edi, eax
imul eax, dword [esi + 4], 0x3b9aca00
add eax, edx
add edi, ebx
adc eax, ecx
push 0
push 0x3b9aca00
push eax
push edi
call fcn.00589500
imul ecx, eax, 0xc4653600
add ecx, edi
mov edi, dword [esi + 0x30]
mov dword fs:[0], edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.attempt_to_divide_by_zero
mov edx, 0x19
push 0x6206d8
call fcn.0059a2a0
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x38], 0
lea eax, [esi + 0x14]
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov edx, 0x2b
push 0x621724
push 0x61f5f4
push eax
call fcn.0059a560
add esp, 0xc
ud2
Function at 0x4db6a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x440
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x5857e0
mov dword [ebp - 0x28], ecx
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x30], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x34], 0
cmp esi, 0x201
jae 0x4db730
jmp 0x4db71e
jbe 0x4db7bc
cmp esi, 0x201
jae 0x4db730
mov dword [ebp - 0x2c], 0x200
lea ebx, [ebp - 0x44c]
mov edi, esi
jmp 0x4db76b
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x4db75c
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x3c]
mov edx, edi
push esi
call fcn.0059d860
add esp, 4
mov edi, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x4db78b
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x4db7f4
cmp esi, edi
jne 0x4db710
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4db832
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x4db71e
jmp 0x4db730
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0
cmp esi, edx
ja 0x4db852
lea ecx, [ebp - 0x4c]
mov edx, ebx
push esi
call fcn.004dbf00
add esp, 4
movsd xmm0, qword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
movsd xmm1, qword [ebp - 0x44]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
jmp 0x4db80a
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx], 0x80000000
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4db81e
mov ecx, dword [ebp - 0x24]
mov edx, 2
call fcn.00405250
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x440
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, 0x651fc6
mov edx, 0x28
push 0x62176c
call fcn.0059a2a0
add esp, 4
jmp 0x4db861
mov ecx, esi
push 0x62175c
call fcn.0059a240
add esp, 4
ud2
Function at 0x4e12b0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x4e12fd
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x4e130d
mov dword [esi + 4], 0
jmp 0x4e131f
cmp eax, 0x103
je 0x4e1337
test eax, eax
js 0x4e1328
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x4e1322
mov eax, esp
mov dword [esp + 0x1c], 0x620eac
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.004d6ef0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.004d7020
mov ecx, 7
int 0x29
ud2
Function at 0x4e37e0
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov ecx, esp
push dword [esp + 0x28]
call fcn.004d9510
add esp, 4
mov ecx, dword [esp]
mov edi, dword [esp + 4]
mov eax, dword [esp + 8]
cmp ecx, 0x80000000
je 0x4e3838
mov dword [esp], ecx
mov dword [esp + 4], edi
mov dword [esp + 8], eax
lea ecx, [esp + 0xc]
mov edx, esp
push 1
call fcn.004e14e0
add esp, 4
mov ebx, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
cmp ebx, 0x80000000
jne 0x4e3844
mov eax, dword [esp + 0x14]
mov dword [esi + 4], eax
mov dword [esi], edi
add esp, 0x18
pop esi
pop edi
pop ebx
ret
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x4e385a
mov byte [esi], 4
test ebx, ebx
jne 0x4e386a
jmp 0x4e383d
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
test ebx, ebx
je 0x4e383d
mov ecx, edi
mov edx, 2
call fcn.00405250
jmp 0x4e383d

Function at 0x4e6430
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x6730d4]
test eax, eax
je 0x4e64e8
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4e645c
cmp dword [eax + 4], 0
mov edi, eax
je 0x4e645c
add edi, 8
jmp 0x4e64e3
mov eax, dword [0x6730d4]
test eax, eax
je 0x4e64f7
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4e64e1
mov esi, eax
test eax, eax
jne 0x4e64b7
movzx eax, byte [0x673c84]
mov ecx, 0xc
mov edx, 4
call fcn.004051f0
test eax, eax
je 0x4e6512
mov dword [eax], 0x6730d4
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x6730d4]
test eax, eax
je 0x4e6506
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x4e64e3
test ecx, ecx
je 0x4e64e3
lock dec dword [ecx]
jne 0x4e64e3
call fcn.004e6530
jmp 0x4e64e3
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x6730d4
call fcn.0059d5e0
jmp 0x4e6440
mov ecx, 0x6730d4
call fcn.0059d5e0
jmp 0x4e646a
mov ecx, 0x6730d4
call fcn.0059d5e0
jmp 0x4e64af
mov ecx, 4
mov edx, 0xc
call fcn.00599e40
int3
Function at 0x4e6bc0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push edi
push esi
test dx, dx
mov eax, 2
mov edi, 0x17
mov esi, ecx
cmove edi, eax
push 0x81
push 0
push 0
push 0
push 1
push edi
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x4e6bf6
mov dword [esi + 4], eax
mov byte [esi], 4
pop esi
pop edi
ret
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x4e6c0a
cmp eax, 0x2739
jne 0x4e6c36
push 1
push 0
push 0
push 0
push 1
push edi
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x4e6c3e
mov edi, eax
push 0
push 1
push eax
call dword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
je 0x4e6c4f
mov dword [esi + 4], edi
jmp 0x4e6bf0
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x4e6bf3
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x4e6bf3
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
mov edx, eax
shr eax, 0x18
mov byte [esi], 0
shr ecx, 8
shl edx, 0x18
mov byte [esi + 7], al
mov dword [esi + 1], edx
mov word [esi + 5], cx
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
jmp 0x4e6bf3

Function at 0x4e6c80
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x28]
xor edi, edi
mov esi, ecx
cmp ebx, 0x3b9aca00
je 0x4e6cde
mov eax, dword [esp + 0x24]
mov ebp, 0x3e8
mov dword [esp + 4], edx
mul ebp
mov edi, eax
mov eax, dword [esp + 0x20]
seto cl
mul ebp
mov ebp, edx
mov dword [esp], eax
add ebp, edi
mov edi, 0xffffffff
setb al
or al, cl
jne 0x4e6cda
mov ecx, 0x431bde83
mov eax, ebx
mul ecx
mov eax, dword [esp]
shr edx, 0x12
add eax, edx
adc ebp, 0
jae 0x4e6d20
mov edx, dword [esp + 4]
mov dword [esp + 8], edi
lea eax, [esp + 8]
push 4
push eax
push 0x1006
push 0xffff
push edx
call dword [sym.imp.ws2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x4e6d16
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
imul eax, edx, 0xf4240
xor ecx, ecx
mov edx, dword [esp + 4]
sub ebx, eax
mov eax, dword [esp]
setne cl
add eax, ecx
adc ebp, 0
jb 0x4e6cde
xor edi, edi
neg ebp
sbb edi, edi
or edi, eax
jne 0x4e6cde
mov byte [esi], 2
mov dword [esi + 4], 0x620f0c
jmp 0x4e6d18
Function at 0x4e6d60
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x28]
xor edi, edi
mov esi, ecx
cmp ebx, 0x3b9aca00
je 0x4e6dbe
mov eax, dword [esp + 0x24]
mov ebp, 0x3e8
mov dword [esp + 4], edx
mul ebp
mov edi, eax
mov eax, dword [esp + 0x20]
seto cl
mul ebp
mov ebp, edx
mov dword [esp], eax
add ebp, edi
mov edi, 0xffffffff
setb al
or al, cl
jne 0x4e6dba
mov ecx, 0x431bde83
mov eax, ebx
mul ecx
mov eax, dword [esp]
shr edx, 0x12
add eax, edx
adc ebp, 0
jae 0x4e6e00
mov edx, dword [esp + 4]
mov dword [esp + 8], edi
lea eax, [esp + 8]
push 4
push eax
push 0x1005
push 0xffff
push edx
call dword [sym.imp.ws2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x4e6df6
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
imul eax, edx, 0xf4240
xor ecx, ecx
mov edx, dword [esp + 4]
sub ebx, eax
mov eax, dword [esp]
setne cl
add eax, ecx
adc ebp, 0
jb 0x4e6dbe
xor edi, edi
neg ebp
sbb edi, edi
or edi, eax
jne 0x4e6dbe
mov byte [esi], 2
mov dword [esi + 4], 0x620f0c
jmp 0x4e6df8

Function at 0x4e6e40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x18]
mov edx, dword [ebx + 4]
mov edi, dword [ebx + 8]
mov ecx, edx
sub ecx, edi
jb 0x4e6eae
cmp ecx, 0x7fffffff
mov edx, 0x7fffffff
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmovb edx, ecx
mov ecx, dword [ebx]
add ecx, edi
push 0
push edx
push ecx
push dword [eax]
call dword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
je 0x4e6e90
add eax, edi
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 0xc]
cmp ecx, eax
cmova eax, ecx
mov dword [ebx + 0xc], eax
jmp 0x4e6e9d
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x274a
jne 0x4e6ea6
mov byte [esi], 4
mov eax, esi
pop esi
pop edi
pop ebx
ret
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x4e6ea0
mov ecx, edi
push 0x64ade0
call fcn.0059a180
int3

Function at 0x4e6f30
Capabilities:
Send data
Send data on socket

Disassembly:
push edi
push esi
push eax
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp], 0
mov edi, esp
mov ecx, dword [ecx]
push 0
push 0
push 0
push edi
push edx
push eax
push ecx
call dword [sym.imp.ws2_32.dll_WSASend]
cmp eax, 0xffffffff
je 0x4e6f6e
mov eax, dword [esp]
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x4e6f7d
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
mov eax, esi
add esp, 4
pop esi
pop edi
ret
Function at 0x4e72c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0xa0
xorps xmm0, xmm0
mov esi, ecx
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x80
lea ecx, [esp + 0x10]
movaps xmmword [esp + 0x80], xmm0
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
push eax
push ecx
push edx
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x4e735e
movzx ecx, word [esp + 0x10]
mov eax, dword [esp + 0xc]
cmp ecx, 2
je 0x4e7377
cmp ecx, 0x17
jne 0x4e7397
cmp eax, 0x1b
jbe 0x4e73ad
movzx eax, word [esp + 0x12]
movups xmm0, xmmword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x28]
mov word [esi], 1
rol ax, 8
movups xmmword [esi + 4], xmm0
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], edx
mov word [esi + 0x1c], ax
jmp 0x4e73a7
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov byte [esi + 4], 0
mov byte [esi + 7], 0
mov word [esi + 5], 0
mov dword [esi + 8], eax
jmp 0x4e73a2
cmp eax, 0xf
jbe 0x4e73c1
movzx ecx, word [esp + 0x12]
mov eax, dword [esp + 0x14]
mov word [esi], 0
rol cx, 8
mov dword [esi + 2], eax
mov word [esi + 6], cx
jmp 0x4e73a7
mov byte [esi + 4], 2
mov dword [esi + 8], 0x621afc
mov word [esi], 2
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x621a98
mov edx, 0x43
push 0x621adc
call fcn.0059a2a0
mov ecx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___library_std_src_sys_common_net.rs
mov edx, 0x42
push 0x621a88
call fcn.0059a2a0
int3

Function at 0x4e74a0
Capabilities:
Set socket configuration

Disassembly:
push esi
push eax
movzx eax, byte [esp + 0xc]
mov esi, ecx
mov dword [esp], eax
mov eax, esp
push eax
push 0x8004667e
push edx
call dword [sym.imp.ws2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x4e74c5
mov byte [esi], 4
jmp 0x4e74d4
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
add esp, 4
pop esi
ret

Function at 0x4e74e0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, 0x7fffffff
cmp eax, 0x7fffffff
cmovb edx, eax
push 0
push edx
push dword [esp + 0x18]
push dword [ecx]
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x4e7516
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x4e752c
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov byte [esi], 0
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov eax, esi
pop esi
ret
Function at 0x4e7530
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, 0x7fffffff
cmp eax, 0x7fffffff
cmovb edx, eax
push 0
push edx
push dword [esp + 0x18]
push dword [ecx]
call dword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x4e7570
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 0x274a
jne 0x4e7578
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x4e757e
mov byte [esi], 0
mov dword [esi + 4], ecx
mov eax, esi
pop esi
ret
Function at 0x4ed9b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.004d9510
add esp, 4
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp edx, 0x80000000
jne 0x4ed9ee
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp], 0x80000000
jmp 0x4eda10
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.004ed8e0
mov ebx, dword [esp]
cmp ebx, 0x80000000
jne 0x4eda25
mov ecx, esp
call fcn.004d96c0
mov dword [esi], 0x80000000
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [esp + 4]
mov ebp, dword [esp + 8]
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4eda43
mov dword [esi], ebx
mov dword [esi + 4], edi
mov dword [esi + 8], ebp
jmp 0x4eda1d
test ebx, ebx
mov dword [esi], 0x80000000
je 0x4eda1d
mov ecx, edi
mov edx, 2
call fcn.00405250
jmp 0x4eda1d