joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43def0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x8aa514]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
cmp eax, 0x4e
jne 0x43df43
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
push esi
push eax
push dword [edi + 4]
push dword [edi + 8]
call dword [sym.imp.USER32.dll_CallWindowProcW]
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.005b937d
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 8
jne 0x43e03c
push 0
push str.SysMonthCal32
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43dfcf
xorps xmm0, xmm0
lea eax, [esp + 0x14]
push eax
movaps xmmword [esp + 0x14], xmm0
movaps xmmword [esp + 0x24], xmm0
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x20
push eax
push 0
push 0x100e
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x1c]
cmp eax, 0x1010003
je 0x43dfb7
cmp eax, 0x2010003
jne 0x43e027
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.005b937d
mov esp, ebp
pop ebp
ret 0xc
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x10]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x10]
jl 0x43e004
cmp eax, dword [esp + 0x18]
jg 0x43e004
cmp eax, dword [esp + 0x14]
jl 0x43e004
cmp eax, dword [esp + 0x1c]
jle 0x43e027
push ecx
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
push 8
call fcn.0043e0d0
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.005b937d
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.005b937d
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x101
jne 0x43df1f
cmp esi, 0x2e
je 0x43e079
cmp esi, 8
je 0x43e079
cmp esi, 0x1b
jne 0x43df1f
push dword [ebp + 0x10]
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [edi + 0x10]
mov esi, eax
mov dword [ecx + 0x14dc], 3
jmp 0x43e0a2
push dword [ebp + 0x10]
push esi
push 0x101
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [edi + 0x10]
mov esi, eax
mov dword [ecx + 0x14dc], 2
mov ecx, dword [edi + 0x10]
call fcn.0043e1e0
push 0
push 0
push 0x10
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.005b937d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4466e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 8]
mov ebx, ecx
and ebx, 7
je 0x44672b
cmp ecx, ebx
jge 0x446723
mov edx, dword [esi]
mov edi, dword [esi + 0xc]
nop dword [eax]
cmp edx, dword [esi + 4]
jb 0x446709
xor al, al
jmp 0x44670e
mov al, byte [edx]
inc edx
mov dword [esi], edx
movzx eax, al
shl eax, cl
add ecx, 8
or edi, eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edi
cmp ecx, 0x18
jle 0x446700
mov ecx, ebx
shr dword [esi + 0xc], cl
sub dword [esi + 8], ebx
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x44675d
mov edi, dword [esi + 0xc]
nop word [eax + eax]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx - 4], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x446740
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x446779
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x44676a
xor dl, dl
jmp 0x44676f
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 4
jl 0x446762
mov eax, dword [ebp - 4]
movzx ecx, byte [ebp - 1]
movzx ebx, ah
movzx eax, al
shl ebx, 8
add ebx, eax
shl ecx, 8
movzx eax, byte [ebp - 2]
add ecx, eax
mov eax, ebx
xor eax, 0xffff
cmp ecx, eax
je 0x4467a8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
add eax, ebx
cmp eax, dword [esi + 4]
ja 0x44679f
mov ecx, dword [esi + 0x10]
mov edi, dword [esi + 0x18]
lea eax, [ecx + ebx]
cmp eax, edi
jbe 0x4467f9
cmp dword [esi + 0x1c], 0
je 0x44679f
mov edx, dword [esi + 0x14]
sub ecx, edx
sub edi, edx
mov dword [ebp - 4], ecx
lea eax, [ecx + ebx]
cmp eax, edi
jle 0x4467db
add edi, edi
cmp eax, edi
jg 0x4467d5
push edi
push edx
call fcn.007491fb
add esp, 8
test eax, eax
je 0x44679f
mov ecx, dword [ebp - 4]
add ecx, eax
mov dword [esi + 0x14], eax
add eax, edi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x18], eax
push ebx
push dword [esi]
push dword [esi + 0x10]
call fcn.00734c50
add dword [esi], ebx
add esp, 0xc
add dword [esi + 0x10], ebx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ed20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x44ed2b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x44ede7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x86e5a8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x86e5a8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x86e5a8]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x86e5a8]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x86e5a8]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x86e5a8]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x86e5a8]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x86e5a8]
sub edi, 1
jne 0x44ed40
pop edi
test esi, esi
je 0x44ee0a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x86e5a8]
sub esi, 1
jne 0x44edf0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x44f5d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x44f613
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44f605
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x44f624
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.00734c50
add dword [edi + 0x18], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f650
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x44f68b
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44f686
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x44f6b8
mov ebx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x44f69c
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x10]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.00734c50
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x18], eax
cmp edi, 1
jne 0x44f6cc
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x44f6c3
cmp byte [esi + 8], 0
je 0x44f6c3
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f820
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [edi], 0
je 0x44f854
cmp byte [edi + 1], 0
je 0x44f84d
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x44f85a
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x14]
mov dword [edi + 0x18], eax
cmp byte [edi], 0
push ebx
je 0x44f87d
cmp byte [edi + 1], 0
je 0x44f876
push 1
push 0
push 0
push dword [edi + 4]
call ecx
sub eax, dword [edi + 0xc]
jmp 0x44f880
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x44f88f
mov eax, dword [edi + 0x18]
mov ebx, 0xffff
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ebx
cmp eax, ebx
jae 0x44f894
mov ebx, eax
mov dword [ebp - 0xc], eax
push esi
push 0x404
call fcn.007444ae
mov esi, eax
add esp, 4
test esi, esi
jne 0x44f8af
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 0x10], 0
cmp ebx, eax
jbe 0x44f9aa
mov edx, dword [ebp - 4]
add eax, 0x400
cmp eax, ebx
mov ecx, eax
mov eax, 0x404
cmova ecx, ebx
sub edx, ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x404
mov dword [ebp - 0x18], edx
mov ebx, ecx
cmova ebx, eax
cmp byte [edi], 0
je 0x44f90e
cmp byte [edi + 1], 0
je 0x44f9aa
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, edx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x44f911
mov dword [edi + 0x18], edx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 8], ebx
je 0x44f939
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44f934
mov byte [edi + 8], 1
mov eax, dword [ebp - 0x14]
jmp 0x44f962
mov edx, dword [edi + 0x18]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x14]
jbe 0x44f94c
mov ecx, dword [edi + 0x14]
sub ecx, edx
mov dword [ebp - 8], ecx
push ecx
mov ecx, dword [edi + 0x10]
add ecx, edx
push ecx
push esi
call fcn.00734c50
mov eax, dword [ebp - 8]
add esp, 0xc
add dword [edi + 0x18], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x44f9aa
lea eax, [ebx - 3]
test eax, eax
jle 0x44f99c
dec eax
cmp byte [eax + esi], 0x50
jne 0x44f98e
cmp byte [eax + esi + 1], 0x4b
jne 0x44f98e
cmp byte [eax + esi + 2], 5
jne 0x44f98e
cmp byte [eax + esi + 3], 6
je 0x44f994
test eax, eax
jg 0x44f972
jmp 0x44f99c
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
jne 0x44f9aa
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0xc]
cmp eax, ebx
jb 0x44f8c3
push esi
call fcn.0073bf11
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x450970
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x450a08
cmp dword [esi + 4], 0xffffffff
jne 0x450a08
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4509a0
cmp dword [ebp + 0x10], 1
mov eax, dword [0x877c1c]
mov dword [edi], eax
mov edi, dword [ebp + 8]
jne 0x4509d3
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4509d3
mov eax, 0x2000000
pop edi
pop esi
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
mov ecx, edi
call fcn.0044f480
add esp, 8
test eax, eax
jne 0x4509f4
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 0xc
mov ecx, eax
call fcn.0044f9c0
mov dword [esi], eax
mov eax, dword [0x8c9254]
pop edi
pop esi
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x45911c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x8aa514]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
lea edi, [ebp - 0x1b]
xor ecx, ecx
xor eax, eax
mov byte [ebp - 0x1c], cl
stosd dword es:[edi], eax
push 7
mov byte [ebp - 0xc], cl
mov dword [ebp - 0xb], ecx
stosd dword es:[edi], eax
mov word [ebp - 7], cx
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004677d7
pop ecx
pop ecx
test eax, eax
jne 0x4591b0
push 8
pop ecx
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
push str.cloudeconfig.ini
push 0x21
stosb byte es:[edi], al
lea eax, [ebp - 0x40]
push eax
push 0x877985
push str.devicekey
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x40]
push eax
lea esi, [ebx + 0x2f4]
call fcn.0045f603
pop ecx
push eax
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.0045c516
cmp dword [ebx + 0x304], 0
jne 0x4591fa
push esi
call fcn.004674a5
pop ecx
jmp 0x4591fa
movzx eax, byte [ebp - 7]
push eax
movzx eax, byte [ebp - 8]
push eax
movzx eax, byte [ebp - 9]
push eax
movzx eax, byte [ebp - 0xa]
push eax
movzx eax, byte [ebp - 0xb]
push eax
movzx eax, byte [ebp - 0xc]
push eax
push str._02x_02x_02x_02x_02x_02x
lea eax, [ebp - 0x1c]
push 0xd
push eax
call fcn.004612d8
lea eax, [ebp - 0x1c]
push eax
call fcn.0045f603
add esp, 0x28
lea ecx, [ebx + 0x2f4]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0045c516
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005b937d
mov esp, ebp
pop ebp
ret
Function at 0x45930f
Capabilities:
List tcp connections and listeners

Disassembly:
push 0x38
mov eax, 0x7acc40
call fcn.005b93c5
mov ecx, dword [ebp + 8]
call fcn.0045ca2f
xor ebx, ebx
lea eax, [ebp - 0x10]
push ebx
push 5
push 2
push 1
push eax
push ebx
mov dword [ebp - 0x10], ebx
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
mov esi, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x1c], eax
cmp esi, 0x7a
jne 0x459434
push dword [ebp - 0x10]
call fcn.004885e5
pop ecx
push ebx
push 5
push 2
mov esi, eax
lea eax, [ebp - 0x10]
push 1
push eax
push esi
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
cmp dword [esi], ebx
jbe 0x45942d
lea edi, [esi + 0x18]
cmp dword [edi - 0x14], 2
jne 0x459421
mov eax, dword [ebp - 0x1c]
cmp eax, dword [edi]
je 0x459421
movzx eax, word [edi - 0xc]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [ebp + 8]
movzx eax, ax
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.004528ed
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx]
je 0x4593c9
mov edx, dword [ebp - 0x14]
cmp edx, dword [eax + 0x10]
jae 0x4593cb
mov eax, dword [ecx]
cmp eax, dword [ecx]
jne 0x459415
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x18]
push eax
call fcn.0045fcce
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x34]
push eax
call fcn.00455b8d
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.004531e2
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.0045bf60
jmp 0x459421
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [eax + 0x14]
call fcn.0045fcce
inc ebx
add edi, 0x18
cmp ebx, dword [esi]
jb 0x459380
push esi
call fcn.004885e0
pop ecx
lea ecx, [ebp - 0x34]
call fcn.0045bf60
call fcn.005b938e
ret 4

Function at 0x45946b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov eax, dword [ebx]
mov esi, dword [eax]
mov dword [ebp + 8], esi
cmp esi, eax
je 0x4594f0
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
push dword [esi + 0x18]
push dword [esi + 0x14]
call fcn.00452093
add esp, 0x10
cmp eax, dword [esi + 0x18]
je 0x4594e1
mov eax, dword [esi + 0x18]
sub eax, dword [esi + 0x14]
sar eax, 1
cmp eax, 0xa
ja 0x4594b3
cmp dword [ebp + 0x10], 0
jne 0x4594b3
xor edi, edi
inc edi
jmp 0x4594e1
push dword [esi + 0x10]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4594e1
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp + 8]
call fcn.00457a00
mov esi, dword [ebp + 8]
cmp esi, dword [ebx]
jne 0x459481
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x45d05d
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp edi, 0xffffffff
je 0x45d140
cmp byte [ebp + 0x10], 0
je 0x45d0ac
mov esi, dword [ebp + 0xc]
test byte [esi], 8
je 0x45d0ac
xor eax, eax
mov dword [ebp + 8], eax
call fcn.00719a60
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp + 8]
push eax
push 0x80
push 0xffff
push esi
push edi
call fcn.00460671
add esp, 0x1c
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
push eax
call fcn.00453482
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x45d140
call fcn.00719a60
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push ebx
mov dword [ebp - 8], 0x2733
call fcn.004579a6
pop ecx
pop ecx
test al, al
jne 0x45d108
call fcn.00719a60
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push ebx
mov dword [ebp - 8], 0x4d5
call fcn.004579a6
pop ecx
pop ecx
test al, al
je 0x45d13c
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
push 0x8004667e
push edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp + 0xc]
push 0
and byte [eax], 0xfc
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
push eax
call fcn.00453482
pop ecx
pop ecx
mov esi, eax
test esi, esi
jne 0x45d14b
call fcn.00719a60
and dword [ebx], 0
mov dword [ebx + 4], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45f514
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00460c34
push 0
push dword [esi + 4]
test al, al
je 0x45f557
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x45f56d
push fcn.0040fe90
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x460671
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
or edi, 0xffffffff
cmp dword [ebp + 8], edi
jne 0x460695
call fcn.00719a60
mov ecx, dword [ebp + 0x20]
mov dword [ecx + 4], eax
mov eax, edi
mov dword [ecx], 0x2719
jmp 0x46073b
cmp dword [ebp + 0x10], 0xa5100000
push esi
mov esi, dword [ebp + 0x14]
jne 0x4606ea
cmp esi, 2
jne 0x4606ba
call fcn.00719a60
mov ecx, dword [ebp + 0x20]
mov dword [ecx], 0x2726
mov dword [ecx + 4], eax
jmp 0x460738
cmp esi, 1
jne 0x460701
cmp dword [ebp + 0x1c], 4
jne 0x4606a7
mov eax, dword [ebp + 0x18]
cmp dword [eax], 0
mov eax, dword [ebp + 0xc]
je 0x4606d5
or byte [eax], 4
jmp 0x4606d8
and byte [eax], 0xfb
call fcn.00719a60
mov ecx, dword [ebp + 0x20]
and dword [ecx], 0
mov dword [ecx + 4], eax
xor eax, eax
jmp 0x46073a
cmp dword [ebp + 0x10], 0xffff
jne 0x460701
cmp esi, 0x80
jne 0x460701
mov eax, dword [ebp + 0xc]
or byte [eax], 8
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esi, dword [ebp + 0x20]
push esi
push eax
call fcn.00453482
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x460738
call fcn.00719a60
and dword [esi], edi
mov dword [esi + 4], eax
mov eax, edi
pop esi
pop edi
pop ebp
ret
Function at 0x46092f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor eax, eax
mov esi, ecx
push eax
push eax
push 1
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, dword [ebp + 8]
mov edi, eax
mov dword [ebx + 4], edi
test edi, edi
jne 0x46097c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov esi, eax
call dword [edx]
mov dword [ebp - 0x10], esi
call fcn.00719a60
mov dword [ebp - 0xc], eax
test esi, esi
jne 0x460a43
mov esi, dword [ebp - 4]
xor eax, eax
push eax
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 8], eax
mov dword [ebx + 8], eax
cmp dword [esi + 8], 0
jne 0x4609c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov esi, eax
call dword [edx]
mov dword [ebp - 0x10], esi
call fcn.00719a60
mov dword [ebp - 0xc], eax
test esi, esi
je 0x4609be
push str.thread.exit_event
jmp 0x460a48
mov esi, dword [ebp - 4]
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
push ebx
push 0x461201
push dword [ebp + 0xc]
push 0
call fcn.00741eee
add esp, 0x18
mov dword [esi + 4], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x460a2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov dword [ebp + 8], eax
call dword [edx]
test edi, edi
je 0x460a03
push edi
call esi
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x460a11
push dword [eax + 8]
call esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], ebx
call fcn.00719a60
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0x460a2a
push str.thread
jmp 0x460a48
test edi, edi
je 0x460a3a
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.thread.entry_event
lea eax, [ebp - 0x10]
push eax
call fcn.0045dc31
int3

Function at 0x460a52
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x8aa514]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x460aa0
movzx ecx, byte [ebp + 0x10]
lea eax, [ebp - 0x194]
push eax
movzx eax, byte [ebp + 0xc]
shl cx, 8
or cx, ax
movzx eax, cx
push eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
push eax
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005b937d
mov esp, ebp
pop ebp
ret