joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4384d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0x601860
call fcn.00429200
mov eax, dword [0x60188c]
mov ebx, dword [ebp + 8]
push 0x601860
mov esi, dword [eax + ebx*4]
call fcn.00429210
add esp, 8
test byte [esi + 0x58], 1
je 0x438623
mov eax, dword [0x601878]
test eax, eax
je 0x43851f
push 4
lea ecx, [ebp + 0xc]
push ecx
push 1
push 6
push ebx
call eax
add esp, 0x14
jmp 0x4385dc
cmp dword [0x601894], 0
push edi
mov edi, dword fs:[0x2c]
je 0x43856a
mov eax, dword [edi]
cmp dword [eax + 0x21d0], 0
jne 0x43856a
push 0x601860
call fcn.00429200
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [eax + ebx*4]
call fcn.00429210
add esp, 8
test dword [esi + 0x58], 0x10000000
jne 0x43856a
mov esi, 1
jmp 0x43856c
xor esi, esi
push 0x601860
call fcn.00429200
mov eax, dword [0x60188c]
add esp, 4
test esi, esi
mov esi, dword [eax + ebx*4]
push 0x601860
call fcn.00429210
add esp, 4
cmp dword [esi + 0x3c], 0
je 0x4385bf
cmp dword [esi + 0xc], 2
jne 0x4385bf
cmp word [esi + 0x5c], 0
je 0x4385bf
mov eax, dword [edi]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x4385b4
call fcn.00541542
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x4385db
push 4
lea eax, [ebp + 0xc]
push eax
push 1
push 6
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_setsockopt]
push eax
call fcn.0053b400
add esp, 4
pop edi
test eax, eax
je 0x438623
mov eax, dword [0x601894]
xor ecx, ecx
test eax, eax
setne cl
lea ecx, [ecx*4 + 3]
test eax, eax
jne 0x43861c
cmp ecx, 5
jbe 0x438604
cmp dword [0x601c18], ecx
jl 0x43861c
or ecx, 0x360000
push str.failed_setsockopt_TCP_NODELAY_:__m
push ecx
call fcn.00424230
add esp, 8
pop esi
pop ebx
pop ebp
ret
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x438630
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x601860
mov dword [ebp + 0xc], edi
call fcn.00429200
mov eax, dword [ebp + 8]
push 0x601860
lea esi, [eax*4]
mov eax, dword [0x60188c]
mov ebx, dword [esi + eax]
call fcn.00429210
mov eax, dword [ebx + 0x58]
add esp, 8
test al, 1
je 0x4386fc
test edi, edi
jne 0x4386a7
test al, al
jns 0x4386a7
push edi
push edi
push dword [ebx + 0x60]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
push eax
call fcn.0053b400
add esp, 4
test eax, eax
je 0x4386a7
push str.WSAEventSelect:__m
push 0x360003
call fcn.00424230
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x601860
call fcn.00429200
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [esi + eax]
call fcn.00429210
add esp, 8
lea eax, [ebp + 0xc]
push eax
push 0x8004667e
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push eax
call fcn.0053b400
add esp, 4
test eax, eax
je 0x4386fc
push str.failed_ioctl_FIOBIO_:__m
push 0x360003
call fcn.00424230
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebx + 0x58]
neg edi
sbb edi, edi
and eax, 0xffffff7f
and edi, 0x80
or edi, eax
xor eax, eax
mov dword [ebx + 0x58], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x439aa0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
push eax
call fcn.0053b400
add esp, 4
test eax, eax
je 0x439ad2
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
mov ax, word [ebp - 0x12]
mov word [ecx + 0x78], ax
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0x7c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x43a210
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
or ebx, 0xffffffff
mov eax, dword [esi + 0x58]
test eax, 0x4000000
je 0x43a24e
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x43a23f
call fcn.00541542
pop esi
mov dword [eax], 0x2746
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
cmp word [esi + 0x5c], 0
push edi
je 0x43a2f3
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [esi + 0x6c]
call fcn.00447f50
mov ecx, dword [ebp + 8]
add esp, 0x10
cmp dword [ebp + 0x10], ecx
cmovb ecx, dword [ebp + 0x10]
push dword [ebp + 0x14]
push ecx
push dword [ebp - 4]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_recv]
push eax
call fcn.0053b400
mov edi, eax
add esp, 4
test edi, edi
jns 0x43a3fe
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x43a2b5
call fcn.00541542
cmp dword [eax], 0x2738
jne 0x43a3fe
push edi
push dword [esi + 0x6c]
call fcn.00447f90
add esp, 8
cmp dword [ebp + 0x18], 0
jne 0x43a2ea
push edi
push dword [ebp + 0xc]
push dword [esi + 0x6c]
call fcn.00436b70
push dword [esi + 0x6c]
call fcn.00447ff0
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, 0x4080
jne 0x43a355
test eax, 0x400
jne 0x43a335
push esi
call fcn.00436e20
add esp, 4
test eax, eax
je 0x43a335
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x43a325
call fcn.00541542
pop edi
pop esi
mov dword [eax], 0x2746
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x58]
test eax, 0x400
je 0x43a355
mov edi, dword [sym.imp.KERNEL32.dll_SleepEx]
push 1
push 0xffffffffffffffff
call edi
mov eax, dword [esi + 0x58]
test eax, 0x400
jne 0x43a345
test eax, 0x4000
je 0x43a3c4
push dword [esi + 0x6c]
call fcn.00448190
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x43a39f
cmp dword [ebp + 0x18], 0
mov ebx, ecx
jne 0x43a39f
mov eax, dword [ebp + 0x10]
cmp ecx, eax
cmovb eax, ecx
push eax
push dword [ebp + 0xc]
push dword [esi + 0x6c]
call fcn.00436b70
add esp, 0xc
mov ebx, eax
test byte [esi + 0x58], 0x20
jne 0x43a3a5
push dword [esi + 0x6c]
call fcn.00447ff0
add esp, 4
test byte [esi + 0x58], 0x20
je 0x43a3b4
push dword [esi + 0x6c]
call fcn.00448190
add esp, 4
test eax, eax
jne 0x43a3bb
and dword [esi + 0x58], 0xffffbfff
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
test al, al
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
jns 0x43a3ef
test eax, eax
jne 0x43a3df
call fcn.00541542
pop edi
pop esi
mov dword [eax], 0x2733
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x43a3f8
call fcn.00541542
mov dword [eax], 0x2714
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a7e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00447ed0
mov ecx, dword [ebp + 0x18]
mov edi, eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0x10
mov eax, dword [ecx + 4]
mov dword [ebp + 0x18], eax
movzx eax, word [ecx + 2]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x80]
mov dword [ebp + 8], eax
movzx eax, word [esi + 0x78]
test ax, ax
je 0x43a823
mov ebx, eax
jmp 0x43a8ad
mov ebx, dword [esi + 0x74]
xorps xmm0, xmm0
movups xmmword [ebp - 0x20], xmm0
mov eax, 2
mov dword [ebp - 8], 0x10
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x20]
push 0x10
push eax
push ebx
mov dword [ebp - 0x1c], 0
call dword [sym.imp.WS2_32.dll_bind]
push eax
call fcn.0053b400
add esp, 4
test eax, eax
je 0x43a874
push str.bind_failed__m
push 0x360003
call fcn.00424230
add esp, 8
xor eax, eax
jmp 0x43a8aa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_getsockname]
push eax
call fcn.0053b400
add esp, 4
test eax, eax
je 0x43a8a6
push str.getsockname_failed__m
push 0x360003
call fcn.00424230
add esp, 8
xor eax, eax
jmp 0x43a8aa
movzx eax, word [ebp - 0x1e]
movzx ebx, ax
push dword [ebp + 0x10]
mov word [esi + 0x78], bx
push dword [ebp + 0xc]
push edi
call fcn.00447de0
push dword [ebp + 0x18]
push dword [ebp + 8]
push dword [ebp - 0xc]
push ebx
push edi
call fcn.004488e0
push 0x11
push dword [ebp + 0x18]
push dword [ebp + 8]
push edi
call fcn.00448830
add esp, 0x30
cmp word [esi + 0x5c], 0
je 0x43a901
mov eax, dword [esi + 0x58]
and eax, 0x200000
shl eax, 4
push eax
push edi
call fcn.00447e70
add esp, 8
mov ebx, 0x20
jmp 0x43a906
mov ebx, 0x1c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.00447f10
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp - 0x10]
push esi
call fcn.0043a4d0
mov esi, eax
add esp, 0x1c
test esi, esi
jle 0x43a92e
sub esi, ebx
push edi
call fcn.00447db0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a940
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x601860
call fcn.00429200
mov eax, dword [ebp + 8]
push 0x601860
lea edi, [eax*4]
mov eax, dword [0x60188c]
mov esi, dword [edi + eax]
call fcn.00429210
add esp, 8
cmp dword [esi + 0x3c], 0
je 0x43a9db
cmp dword [esi + 0xc], 2
jne 0x43a9db
cmp word [esi + 0x5c], 0
je 0x43a9db
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x10
jae 0x43a9ad
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x43a9a0
call fcn.00541542
pop edi
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
pop ebp
ret
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [eax], 0x10
mov eax, 2
pop edi
movups xmmword [ecx], xmm0
mov word [ecx], ax
mov eax, dword [esi + 0x80]
mov dword [ecx + 4], eax
mov ax, word [esi + 0x78]
mov word [ecx + 2], ax
xor eax, eax
pop esi
pop ebp
ret
push 0x601860
call fcn.00429200
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [edi + eax]
call fcn.00429210
add esp, 8
cmp dword [esi + 0x3c], 0
jne 0x43aa1c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_getsockname]
push eax
call fcn.0053b400
add esp, 4
pop edi
pop esi
pop ebp
ret
or eax, 0xffffffff
push eax
call fcn.0053b400
add esp, 4
pop edi
pop esi
pop ebp
ret

Function at 0x43aa70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x601860
call fcn.00429200
mov ecx, dword [ebp + 8]
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [eax + ecx*4]
call fcn.00429210
mov eax, dword [esi + 0x58]
add esp, 8
test al, 0x40
je 0x43ab4e
test al, 1
je 0x43aadc
cmp dword [esi + 0x3c], 0
je 0x43aab8
cmp dword [esi + 0xc], 2
jne 0x43aab8
cmp word [esi + 0x5c], 0
jne 0x43aadc
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_recvfrom]
push eax
call fcn.0053b400
add esp, 4
pop esi
pop ebp
ret
test eax, reloc.WS2_32.dll_connect
jne 0x43ab16
cmp dword [esi + 0x3c], 0
je 0x43aaf6
cmp dword [esi + 0xc], 2
jne 0x43aaf6
cmp word [esi + 0x5c], 0
jne 0x43ab16
push eax
push str.invalid_type:__d
push 0x76d
push str.vsock_recvfrom
push 0x360202
call fcn.004245a0
add esp, 0x14
pop esi
pop ebp
ret
cmp dword [esi + 0xc], 0
jne 0x43ab33
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0043a210
add esp, 0x14
pop esi
pop ebp
ret
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0043a410
add esp, 0x18
pop esi
pop ebp
ret
push str.recvfrom_from_non_packet_socket
push 0x360000
call fcn.00424790
int3
Function at 0x43ab70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x601860
call fcn.00429200
mov ecx, dword [ebp + 8]
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [eax + ecx*4]
call fcn.00429210
mov eax, dword [esi + 0x58]
add esp, 8
test al, 0x40
jne 0x43abbd
push eax
push str.invalid_type:__d
push 0x72e
push str.vsock_send
push 0x360202
call fcn.004245a0
mov eax, dword [esi + 0x58]
add esp, 0x14
mov ecx, dword [esi + 0x3c]
test eax, reloc.WS2_32.dll_connect
jne 0x43ac1a
test ecx, ecx
je 0x43abd8
cmp dword [esi + 0xc], 2
jne 0x43abd8
cmp word [esi + 0x5c], 0
jne 0x43ac1a
test al, 1
je 0x43abfa
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_send]
push eax
call fcn.0053b400
add esp, 4
pop esi
pop ebp
ret
push eax
push str.invalid_type:__d
push 0x733
push str.vsock_send
push 0x360202
call fcn.004245a0
add esp, 0x14
pop esi
pop ebp
ret
test ecx, ecx
je 0x43ac61
cmp dword [esi + 0xc], 2
jne 0x43ac61
cmp word [esi + 0x5c], 0
je 0x43ac61
test eax, 0x1000000
je 0x43ac76
cmp dword [esi + 0x14], 0x11
lea eax, [esi + 0x94]
push 0x10
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
jne 0x43ac56
call fcn.0043a7e0
add esp, 0x18
pop esi
pop ebp
ret
call fcn.0043a730
add esp, 0x18
pop esi
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0043a4d0
add esp, 0x10
pop esi
pop ebp
ret
push str.cannot_use_send_when_socket_not_connected
push 0x360000
call fcn.00424790
int3
Function at 0x43ac90
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x601860
call fcn.00429200
mov ecx, dword [ebp + 8]
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [eax + ecx*4]
call fcn.00429210
mov eax, dword [esi + 0x58]
add esp, 8
test al, 0x40
je 0x43ad9c
test eax, reloc.WS2_32.dll_connect
jne 0x43ad23
cmp dword [esi + 0x3c], 0
je 0x43acdb
cmp dword [esi + 0xc], 2
jne 0x43acdb
cmp word [esi + 0x5c], 0
jne 0x43ad23
test al, 1
je 0x43ad03
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_sendto]
push eax
call fcn.0053b400
add esp, 4
pop esi
pop ebp
ret
push eax
push str.invalid_type:__d
push 0x783
push str.vsock_sendto
push 0x360202
call fcn.004245a0
add esp, 0x14
pop esi
pop ebp
ret
push edi
mov edi, dword [ebp + 0x18]
test edi, edi
jne 0x43ad42
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi]
call fcn.0043ab70
add esp, 0x10
pop edi
pop esi
pop ebp
ret
cmp dword [esi + 0xc], 2
jne 0x43adab
cmp dword [esi + 0x14], 0x11
jne 0x43ad7c
push esi
call fcn.0043b160
add esp, 4
test eax, eax
je 0x43ad62
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [ebp + 0x1c]
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0043a7e0
add esp, 0x18
pop edi
pop esi
pop ebp
ret
cmp dword [esi + 0x10], 3
jne 0x43adab
push dword [ebp + 0x1c]
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0043a730
add esp, 0x18
pop edi
pop esi
pop ebp
ret
push str.sendto_to_non_packet_socket
push 0x360000
call fcn.00424790
push str.invalid_socket_address
push 0x360000
call fcn.00424790
int3
Function at 0x43adc0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x601860
call fcn.00429200
mov ecx, dword [ebp + 8]
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [eax + ecx*4]
call fcn.00429210
mov ebx, dword [ebp + 0xc]
add esp, 8
mov edi, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
cmp ebx, 0xffff
jne 0x43ae25
cmp edx, 0x20
jne 0x43ae44
cmp edi, 4
jne 0x43aed1
mov ecx, dword [ebp + 0x14]
mov eax, dword [esi + 0x58]
mov ecx, dword [ecx]
neg ecx
sbb ecx, ecx
and eax, 0xffdfffff
and ecx, 0x200000
or ecx, eax
mov dword [esi + 0x58], ecx
jmp 0x43ae6f
test ebx, ebx
jne 0x43ae44
cmp edx, 0xc
jne 0x43ae44
cmp edi, 8
jne 0x43aee0
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
mov dword [esi + 0x8c], eax
jmp 0x43ae72
cmp edx, 0x19
jne 0x43ae6f
mov ecx, dword [esi + 0x58]
mov eax, ecx
and eax, reloc.WS2_32.dll_listen
cmp eax, 1
jne 0x43ae6f
test cl, 0x40
je 0x43ae6f
cmp dword [esi + 0xc], 2
jne 0x43ae6f
cmp dword [esi + 0x14], 0x11
je 0x43aea7
cmp dword [esi + 0x10], 3
je 0x43aea7
mov ecx, dword [ebp + 0x14]
cmp dword [esi + 0x3c], 0
je 0x43aeb6
cmp dword [esi + 0xc], 2
jne 0x43aeb6
cmp word [esi + 0x5c], 0
je 0x43aeb6
cmp edx, 4
je 0x43aeaf
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x43aea1
call fcn.00541542
mov dword [eax], 0x16
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push edi
push ecx
push edx
push ebx
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_setsockopt]
push eax
call fcn.0053b400
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
push str.incorrect_SO_BROADCAST_parameters
push 0x360000
call fcn.00424790
push str.incorrect_IP_ADD_MEMBERSHIP_parameters
push 0x360000
call fcn.00424790
int3
Function at 0x43b060
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push 0x601860
call fcn.00429200
mov ecx, dword [ebp + 8]
mov eax, dword [0x60188c]
push 0x601860
mov edi, dword [eax + ecx*4]
call fcn.00429210
add esp, 8
mov dword [ebp - 4], 0x10
test dword [edi + 0x58], 0x800000
lea esi, [edi + 0xec]
jne 0x43b130
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x60]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x43b0c2
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
movzx eax, word [ebp - 0x12]
mov dword [esi + 8], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0x10
push eax
push dword [edi + 0x60]
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x43b0b9
cmp dword [edi + 0x48], eax
je 0x43b0f8
movups xmm0, xmmword [edi + 0x44]
movups xmmword [ebp - 0x14], xmm0
mov eax, dword [ebp - 0x10]
mov dword [esi + 0xc], eax
mov ecx, dword [ebp - 0x14]
shr ecx, 0x10
cmp dword [ebp + 0xc], 0
mov dword [esi + 0x10], ecx
je 0x43b116
mov eax, dword [esi + 8]
mov dword [esi + 8], ecx
mov dword [esi + 0x10], eax
push esi
mov dword [esi], 5
call fcn.00439240
add esp, 4
test eax, eax
jne 0x43b0b9
or dword [edi + 0x58], 0x800000
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x443960
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00420ed0
add esp, 8
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push eax
call fcn.0053b430
xor ecx, ecx
add esp, 4
cmp eax, 0xffffffff
cmove eax, ecx
pop ebp
ret
Function at 0x443bb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x4c
push 0
push esi
call fcn.0053f310
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
push 0
push eax
push esi
mov dword [esi], eax
mov dword [esi + 4], ecx
call fcn.00443e90
push esi
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
call fcn.00443d40
add esp, 0x1c
test eax, eax
jne 0x443c5b
mov edi, dword [esi + 8]
lea eax, [ebp + 8]
push eax
push 0x40
push 0x32
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x443c5b
test edi, edi
je 0x443c5b
push dword [ebp + 0x10]
push dword [esi + 8]
push dword [esi + 0x18]
push edi
push esi
call fcn.00443fe0
movq xmm0, qword [edi]
lea edx, [ebp + 0x10]
mov ecx, dword [ebp + 8]
add esp, 0x14
movq qword [esi + 0x24], xmm0
movzx eax, word [edi + 8]
mov word [esi + 0x2c], ax
mov eax, dword [esi + 4]
push edx
push ecx
push 0x32
movq xmm0, qword [eax]
movq qword [esi + 0x42], xmm0
movzx eax, word [eax + 8]
push edi
mov word [esi + 0x4a], ax
mov dword [ebp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
xor eax, eax
pop esi
pop ebp
ret
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x443c77
push 0x8000
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esi + 0x10], 0
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret

Function at 0x443c80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
je 0x443d35
push edi
mov edi, dword [esi + 8]
lea eax, [ebp + 8]
push eax
push 0x40
push 0x32
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x443d12
test edi, edi
je 0x443d12
push dword [esi + 0x18]
push dword [esi + 0x10]
push edi
call fcn.0053f470
lea eax, [ebp - 4]
push eax
push 0xf
lea eax, [ebp - 0xc34]
push eax
push dword [esi + 0x20]
push 0x32
push dword [esi + 0xc]
push 0
push dword [esi + 8]
call fcn.00407290
add esp, 0x2c
cmp eax, 3
je 0x443cfe
lea eax, [ebp - 0xc34]
push eax
push dword [esi + 0x10]
push dword [esi + 0x18]
push edi
push dword [esi + 8]
call fcn.00443f10
add esp, 0x14
mov eax, dword [ebp + 8]
lea ecx, [ebp + 8]
push ecx
push eax
push 0x32
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [ebp + 0xc], 0
pop edi
je 0x443d35
mov eax, dword [esi + 0x10]
test eax, eax
je 0x443d35
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esi + 0x10], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x443d40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
lea eax, [ebp - 4]
push ebx
mov ebx, dword [ebp + 8]
push edi
push eax
push 0xf
lea eax, [ebp - 0xc34]
xor edi, edi
push eax
push dword [ebx + 0x20]
push 0x32
push dword [ebx + 0xc]
push edi
push dword [ebx + 8]
call fcn.00407290
add esp, 0x20
cmp eax, 3
je 0x443e87
push 0x40
push 0x1000
push 0x1e
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp + 8], eax
test eax, eax
je 0x443e87
cmp dword [ebx + 0x14], edi
jne 0x443d9d
mov dword [ebx + 0x14], eax
mov ecx, dword [ebx + 8]
mov eax, ecx
push esi
mov esi, dword [ebx + 4]
sub eax, esi
mov edx, esi
sub edx, ecx
cmp ecx, esi
mov esi, dword [ebp - 4]
cmovbe eax, edx
cmp eax, 0x80000000
sbb edx, edx
xor ecx, ecx
and edx, 0xfffffffb
add edx, 0xa
test esi, esi
je 0x443de0
lea eax, [ebp - 0xb74]
nop dword [eax]
cmp edi, edx
jge 0x443de0
add edi, dword [eax]
inc ecx
add eax, 0xd0
cmp ecx, esi
jb 0x443dd0
push edi
push dword [ebx + 0xc]
push dword [ebp + 8]
call fcn.0053f470
mov esi, dword [ebx + 8]
mov ecx, esi
mov edx, dword [ebx + 0x14]
sub ecx, edx
lea eax, [esi + edi]
push eax
lea eax, [edx + edi]
push eax
mov eax, edx
sub eax, esi
cmp edx, esi
mov esi, dword [ebp + 8]
cmovbe eax, ecx
cmp eax, 0x80000000
sbb eax, eax
and eax, 0xfffffffb
add eax, 0xa
push eax
lea eax, [esi + edi]
push eax
push ebx
call fcn.00443fe0
lea eax, [ebp - 0xc34]
push eax
push dword [ebx + 8]
push edi
push esi
push esi
call fcn.00443f10
add esp, 0x34
test eax, eax
jne 0x443e6f
mov ecx, dword [ebx + 0x14]
mov eax, ecx
mov dword [ebx + 0x10], esi
mov esi, dword [ebx + 8]
mov edx, esi
sub eax, esi
mov dword [ebx + 0x18], edi
sub edx, ecx
cmp ecx, esi
pop esi
cmovbe eax, edx
cmp eax, 0x80000000
sbb eax, eax
and eax, 0xfffffffb
add eax, 0xa
add eax, edi
mov dword [ebx + 0x1c], eax
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop esi
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret