joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49bae2
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x564eee
mov eax, dword fs:[0]
push eax
sub esp, 0x1b8
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x1c8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x49bd8f
and dword [esp + 0xc4], 0
xor ecx, ecx
mov dword [esp + 0xc8], 7
mov word [esp + 0xb4], cx
and dword [esp + 0x1d0], ecx
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
mov dword [esp + 0x10], eax
jmp 0x49bc1c
lea ebx, [eax + 0xc]
lea eax, [esp + 0xec]
push 0x586990
push eax
call fcn.004100e9
add ebx, 0x1c
lea ecx, [esp + 0x110]
push ebx
push ecx
mov ecx, eax
mov byte [esp + 0x1e0], 1
call fcn.004102a9
push 0x5a2e74
push eax
lea eax, [esp + 0xe8]
mov byte [esp + 0x1e8], 2
call fcn.004101e0
add esp, 0x18
push 0
push eax
or eax, 0xffffffff
lea esi, [esp + 0xbc]
mov byte [esp + 0x1d8], 3
call fcn.0040eb30
push 1
xor edi, edi
lea esi, [esp + 0xd4]
call fcn.0040412d
push 1
lea esi, [esp + 0x10c]
call fcn.0040412d
push 1
lea esi, [esp + 0xf0]
mov byte [esp + 0x1d4], 0
call fcn.0040412d
lea eax, [esp + 0x10]
call fcn.004293bc
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x10]
cmp eax, ecx
jne 0x49bb6d
mov eax, dword [esp + 0xc4]
add eax, 0xfffffffe
lea ecx, [esp + 0xb4]
call fcn.0040da2b
lea eax, [esp + 0x124]
push eax
call fcn.00403689
mov esi, eax
push str.HTTP_request_headers:
push esi
mov byte [esp + 0x1d8], 4
call fcn.00405d65
push esi
lea ecx, [esp + 0xc0]
call fcn.00411926
add esp, 0xc
lea eax, [esp + 0xd0]
push eax
mov eax, esi
call fcn.004036f3
mov byte [esp + 0x1d0], 5
cmp dword [esp + 0xe4], 8
mov eax, dword [esp + 0xd0]
jae 0x49bc9b
lea eax, [esp + 0xd0]
push eax
push 4
pop ecx
call fcn.00492cc7
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xd4]
call fcn.0040412d
lea eax, [esp + 0x124]
mov byte [esp + 0x1d0], 0
call fcn.0040262a
cmp dword [esp + 0xc8], 8
mov eax, dword [esp + 0xb4]
jae 0x49bce1
lea eax, [esp + 0xb4]
push 0x20000000
push 0xffffffffffffffff
push eax
push dword [esp + 0x20]
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x49bd7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [esp + 0x1c]
push eax
call fcn.00403689
mov edi, eax
push str.WinHttpAddRequestHeaders_failed_with
push edi
mov byte [esp + 0x1d8], 6
call fcn.00405d65
pop ecx
pop ecx
push esi
push edi
call fcn.0041058a
lea eax, [esp + 0xec]
push eax
mov eax, edi
call fcn.004036f3
mov byte [esp + 0x1d0], 7
test esi, esi
jle 0x49bd52
and esi, 0xffff
or esi, 0x80070000
push 0xd9
push esi
lea eax, [esp + 0xf4]
push eax
lea eax, [esp + 0x130]
push eax
call fcn.0049b453
push 0x5c9938
lea eax, [esp + 0x128]
push eax
call fcn.0051eb2a
push 1
xor edi, edi
lea esi, [esp + 0xb8]
call fcn.0040412d
mov ecx, dword [esp + 0x1c8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1b0]
xor ecx, esp
call fcn.005146df
mov esp, ebp
pop ebp
ret
Function at 0x49dd39
Capabilities:
Read file on windows

Disassembly:
push 0x444
mov eax, 0x564d65
call fcn.00523a34
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [eax + 0x14], 8
mov edi, ecx
mov dword [ebp - 0x440], eax
mov dword [eax + 0x10], ebx
jb 0x49dd63
mov eax, dword [eax]
xor ecx, ecx
push 0xc
mov word [eax], cx
call fcn.00515827
mov esi, eax
pop ecx
mov dword [ebp - 0x444], esi
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x49ddcf
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov eax, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.0049d8de
test al, al
jne 0x49ddcd
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x43c], str.HashImplementation::reset_failed
call fcn.00514f60
push 0x5c95c0
lea eax, [ebp - 0x450]
push eax
mov dword [ebp - method.std::logic_error.virtual_0], vtable.std::runtime_error.0
call fcn.0051eb2a
mov ebx, esi
mov dword [ebp - 0x43c], ebx
mov byte [ebp - 4], 2
cmp dword [edi + 0x14], 8
jb 0x49dde3
mov eax, dword [edi]
jmp 0x49dde5
mov eax, edi
push 0x5a58dc
push eax
call fcn.00516425
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x49de12
test ebx, ebx
je 0x49de0a
mov esi, ebx
call fcn.0049dce6
push ebx
call fcn.00515779
pop ecx
xor al, al
call fcn.00523a90
ret
push esi
call fcn.0051abe1
pop ecx
push esi
test eax, eax
jne 0x49de54
push 0x400
lea eax, [ebp - 0x41c]
push 1
push eax
call fcn.00516686
add esp, 0x10
test eax, eax
je 0x49de12
push eax
lea eax, [ebp - 0x41c]
push eax
mov eax, ebx
call fcn.0049d92d
test al, al
jne 0x49de12
push esi
call fcn.005169f5
pop ecx
jmp 0x49ddf8
call fcn.005169f5
pop ecx
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x43c]
call fcn.0049dd20
mov ebx, eax
mov eax, dword [ebp - 0x440]
mov byte [ebp - 4], 3
call fcn.00404022
push 1
xor edi, edi
lea esi, [ebp - 0x438]
call fcn.0040412d
mov esi, dword [ebp - 0x43c]
test esi, esi
je 0x49dea2
call fcn.0049dce6
push esi
call fcn.00515779
pop ecx
mov al, 1
jmp 0x49de0c
Function at 0x4e5193
Capabilities:
Get file version info

Disassembly:
push 0xe0
mov eax, 0x558b0d
call fcn.005239fe
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x4c]
mov edi, ecx
push eax
push edi
mov ebx, edx
mov byte [ebp - 0x31], 1
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov esi, eax
test esi, esi
jne 0x4e51e2
push str.updtDispDevEnumClass::GetBasicFileVersion_failed
push 2
pop ecx
call fcn.00492cc7
pop ecx
xor al, al
jmp 0x4e534c
push esi
call fcn.00515451
pop ecx
push eax
push esi
push 0
push edi
mov dword [ebp - 0x38], eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
jne 0x4e5284
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0xec]
push eax
call fcn.00403689
mov esi, eax
and dword [ebp - 4], 0
push str.GetBasicFileVersion::GetFileVersionInfo_failedError_code_
push esi
call fcn.00405d65
pop ecx
pop ecx
push edi
push esi
call fcn.0041058a
lea eax, [ebp - 0x30]
push eax
mov eax, esi
call fcn.004036f3
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x4e5248
lea eax, [ebp - 0x30]
push eax
push 2
pop ecx
call fcn.00492cc7
pop ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00403372
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xec]
call fcn.0040262a
cmp dword [ebp - 0x38], 0
je 0x4e51db
push dword [ebp - 0x38]
call fcn.0051576e
jmp 0x4e51da
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x584ab8
push dword [ebp - 0x38]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4e52c8
mov eax, dword [ebp - 0x48]
mov cx, word [eax + 0xa]
mov edx, dword [ebp - 0x44]
mov word [ebx], cx
mov cx, word [eax + 8]
mov word [edx], cx
mov cx, word [eax + 0xe]
mov edx, dword [ebp - 0x3c]
mov word [edx], cx
mov ax, word [eax + 0xc]
mov ecx, dword [ebp - 0x40]
mov word [ecx], ax
jmp 0x4e533a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0xec]
push eax
call fcn.00403689
mov esi, eax
push 2
pop ebx
mov dword [ebp - 4], ebx
push str.GetBasicFileVersion::VerQueryValue_failedError_code__0x_x_n
push esi
call fcn.00405d65
pop ecx
pop ecx
push edi
push esi
call fcn.0041058a
lea eax, [ebp - 0x30]
push eax
mov eax, esi
call fcn.004036f3
mov byte [ebp - 4], 3
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x4e5313
lea eax, [ebp - 0x30]
push eax
mov ecx, ebx
call fcn.00492cc7
pop ecx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x30]
call fcn.00403372
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xec]
call fcn.0040262a
mov byte [ebp - 0x31], 0
cmp dword [ebp - 0x38], 0
je 0x4e5349
push dword [ebp - 0x38]
call fcn.0051576e
pop ecx
mov al, byte [ebp - 0x31]
call fcn.00523a81
ret 0xc
Function at 0x4e9ab3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc4
mov eax, 0x55892e
call fcn.005239fe
push str.Enter_updtShimAPIClass::GetVerifierInfo
push 3
pop ecx
call fcn.00492cc7
lea eax, [edi + 0x1bc]
xor ebx, ebx
mov dword [esp], str.Unknown
lea esi, [edi + 0x1b8]
push eax
mov dword [esi], ebx
mov byte [edi + 0x1d8], bl
call fcn.00404104
lea eax, [ebp - 0x34]
push eax
push 0x20019
push ebx
push dword [0x5f8880]
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x4e9b8d
lea eax, [ebp - 0xd0]
push eax
call fcn.00403689
mov esi, eax
mov dword [ebp - 4], ebx
push str._GetVerifierInfo__Open_key:
push esi
call fcn.00405d65
push dword [0x5f8880]
push esi
call fcn.00405d65
push str._failed
push esi
call fcn.00405d65
add esp, 0x18
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
call fcn.004036f3
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x4e9b62
lea eax, [ebp - 0x2c]
push eax
push 2
pop ecx
call fcn.00492cc7
pop ecx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2c]
call fcn.00403372
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xd0]
call fcn.0040262a
xor al, al
jmp 0x4e9c4a
lea eax, [ebp - 0x30]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push ebx
push str.VerifyDriverLevel
push dword [ebp - 0x34]
mov dword [ebp - 0x30], 4
call esi
test eax, eax
je 0x4e9bbf
push str.Query_VerifyDriverLevel_failed
push 2
pop ecx
call fcn.00492cc7
pop ecx
jmp 0x4e9c22
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push str.VerifyDrivers
push dword [ebp - 0x34]
mov dword [ebp - 0x30], ebx
call esi
cmp eax, ebx
jne 0x4e9c22
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x30]
shr eax, 1
inc eax
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x38], ebx
call fcn.00426faa
mov dword [ebp - 4], 2
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x20]
push ebx
push ebx
push str.VerifyDrivers
push dword [ebp - 0x34]
call esi
push dword [ebp - 0x20]
lea eax, [edi + 0x1bc]
push eax
call fcn.00404104
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x20]
call fcn.004e7046
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [edi + 0x1b8], ebx
push str.Exit_updtShimAPIClass::GetVerifierInfo
setne al
push 3
pop ecx
mov byte [edi + 0x1d8], al
call fcn.00492cc7
pop ecx
mov al, 1
call fcn.00523a81
ret
Function at 0x4ea35e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x5f7350]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x58]
push eax
push 0x20019
xor esi, esi
push esi
push str.SOFTWARENVIDIA_CorporationGlobalNvBackend
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x58], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4ea396
xor al, al
jmp 0x4ea3d3
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push str.Link
push dword [ebp - 0x58]
mov dword [ebp - 0x5c], 0x4e
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4ea392
cmp dword [ebp - 0x58], esi
je 0x4ea3c7
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x54]
push eax
push edi
call fcn.0040d9a0
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005146df
leave
ret
Function at 0x4eb27c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x20
mov eax, 0x553dde
call fcn.00523995
push str.Unknown
push dword [ebp + 8]
xor ebx, ebx
call fcn.00404104
lea eax, [ebp - 0x14]
push eax
push 1
push ebx
push str.SOFTWARENVIDIA_Corporation_nForce
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4eb344
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
mov edi, str.PackageVersion
push edi
push dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
call esi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
shr eax, 1
inc eax
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x18], ebx
call fcn.00426faa
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], ebx
jne 0x4eb305
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x2c]
push ebx
push ebx
push edi
push dword [ebp - 0x14]
call esi
cmp eax, ebx
je 0x4eb322
push str.Unsupported
push dword [ebp + 8]
call fcn.00404104
push str.Cannot_get_PackageVersion
push 2
pop ecx
call fcn.00492cc7
pop ecx
jmp 0x4eb32d
push dword [ebp - 0x2c]
push dword [ebp + 8]
call fcn.00404104
push dword [ebp - 0x14]
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x2c]
call fcn.004e7046
mov al, bl
call fcn.00523a6d
ret
Function at 0x4fcdcd
Capabilities:
Get storage device properties

Disassembly:
push 0xd0
mov eax, 0x5582a9
call fcn.005239fe
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
lea edx, [ebp - 0x40]
push edx
push dword [eax + 4]
mov dword [ebp - 0x20], ebx
push eax
push 0xc
lea eax, [ebp - 0x20]
push eax
push 0x2d1400
push ecx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, ebx
jne 0x4fce76
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0xdc]
push eax
call fcn.00403689
mov esi, eax
mov dword [ebp - 4], ebx
push str.IOCTL_STORAGE_QUERY_PROPERTY_ec
push esi
call fcn.00405d65
pop ecx
pop ecx
push edi
push esi
call fcn.0041058a
lea eax, [ebp - 0x3c]
push eax
mov eax, esi
call fcn.004036f3
mov byte [ebp - 4], 1
cmp dword [ebp - 0x28], 8
mov eax, dword [ebp - 0x3c]
jae 0x4fce4e
lea eax, [ebp - 0x3c]
push eax
push 2
pop ecx
call fcn.00492cc7
pop ecx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3c]
call fcn.00403372
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xdc]
call fcn.0040262a
xor al, al
jmp 0x4fce78
mov al, 1
call fcn.00523a81
ret 4
Function at 0x50a611
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x560a43
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor eax, eax
mov edi, ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], eax
mov byte [esp + 0x38], al
push 1
mov dword [esp + 0x84], eax
push esi
lea eax, [esp + 0x40]
push eax
call fcn.00509501
test al, al
jne 0x50a6d2
push 0x5c0ebc
lea edx, [esp + 0x3c]
call fcn.00436bca
pop ecx
test al, al
je 0x50a6c2
xor bl, bl
push 0
push 1
lea ecx, [esp + 0x40]
call fcn.00403fde
mov al, bl
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.005146df
mov esp, ebp
pop ebp
ret 8
push 7
push str.http:__
lea ecx, [esp + 0x40]
call fcn.004042d9
push str.http:__
lea edx, [esp + 0x3c]
call fcn.00436bca
pop ecx
test al, al
je 0x50a6e9
push 0x50
jmp 0x50a701
push str.https:__
lea edx, [esp + 0x3c]
call fcn.00436bca
pop ecx
test al, al
je 0x50a70d
push 0x1bb
push 0xe
pop eax
mov ecx, esi
call fcn.004da5b5
jmp 0x50a780
push str.http_over_pipe:__
lea edx, [esp + 0x3c]
call fcn.00436bca
pop ecx
test al, al
je 0x50a737
push 0x5c1094
lea ecx, [edi + 0x8c]
call fcn.00403f45
mov bl, 1
jmp 0x50a693
cmp dword [ebx + 0x14], 0x10
jb 0x50a741
mov eax, dword [ebx]
jmp 0x50a743
mov eax, ebx
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0048f055
pop ecx
pop ecx
mov byte [esp + 0x80], 1
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x50a767
lea eax, [esp + 0x1c]
push eax
push 4
push esi
call fcn.005063f4
add esp, 0xc
push 1
xor edi, edi
lea esi, [esp + 0x20]
call fcn.0040412d
cmp dword [ebx + 0x14], 0x10
jb 0x50a78a
mov edi, dword [ebx]
jmp 0x50a78c
mov edi, ebx
xor eax, eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov byte [esp + 0x80], 2
jmp 0x50a7cb
inc eax
push 0x5c10c4
push eax
call fcn.0052d5b0
pop ecx
pop ecx
mov dword [esp + 0x14], eax
test eax, eax
je 0x50a7e0
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx - 4]
mov cl, byte [ecx]
cmp cl, byte [eax]
je 0x50a7dc
lea eax, [esp + 0x14]
lea esi, [esp + 0x1c]
call fcn.00494252
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x50a7a8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov esi, dword [eax - 4]
add ecx, 0x8c
cmp byte [esi], 0x2f
jne 0x50a829
push esi
call fcn.00403f45
sub esi, edi
push esi
push edi
lea esi, [esp + 0x5c]
call fcn.0040fc13
mov esi, eax
mov edi, ebx
mov byte [esp + 0x80], 3
call fcn.00403e11
push 0
push 1
lea ecx, [esp + 0x5c]
call fcn.00403fde
jmp 0x50a833
push 0x5c1094
call fcn.00403f45
cmp dword [esp + 0x1c], 0
je 0x50a730
push dword [esp + 0x1c]
call fcn.00515779
pop ecx
jmp 0x50a730
Function at 0x50dcf3
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5606ef
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov dword [esp + 0x10], ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
xor eax, eax
cmp ebx, eax
jne 0x50dd36
or eax, 0xffffffff
jmp 0x50de4a
mov dword [esp + 0x1c], eax
push eax
mov dword [esp + 0x44], eax
push eax
xor edi, edi
lea esi, [esp + 0x20]
mov dword [esp + 0x20], vtable.GFE::Windows::Event.0
call fcn.0049d7a8
push 0x14
xor esi, esi
lea eax, [esp + 0x24]
push esi
push eax
mov dword [esp + 0x4c], 1
call fcn.00517bf0
mov edi, dword [esp + 0x28]
add esp, 0xc
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], edi
mov eax, dword [ebx]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x50de37
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x50de37
cmp eax, 0x3e5
jne 0x50de32
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x50ddcc
mov eax, dword [eax]
mov dword [esp + 0x10], edi
mov eax, dword [eax]
push 0xffffffffffffffff
mov dword [esp + 0x18], eax
push esi
lea eax, [esp + 0x18]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
jmp 0x50dde9
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 0x50]
push 7
pop edx
call fcn.00506997
push eax
call fcn.00506eb5
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub eax, esi
je 0x50de01
dec eax
push dword [ebx]
je 0x50ddf9
sub eax, 0x101
jne 0x50de2c
call dword [sym.imp.KERNEL32.dll_CancelIo]
jmp 0x50de3a
mov eax, dword [ebx]
push esi
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x28]
push ecx
push eax
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x50de37
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x50de37
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CancelIo]
or esi, 0xffffffff
jmp 0x50de3a
xor esi, esi
inc esi
or dword [esp + 0x40], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.0049d8bc
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x50ede5
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
cmp dword [0x602778], ebx
jne 0x50ee40
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x50ee26
xor al, al
jmp 0x50ee48
cmp byte [esp + 0x10], 2
jne 0x50ee38
mov eax, dword [esp + 0x10]
shr eax, 8
cmp al, 2
je 0x50ee40
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x50ee22
inc dword [0x602778]
mov al, 1
mov byte [esi + 0x1c], al
cmp al, bl
jne 0x50ee64
xor ecx, ecx
push 0x5c22ec
inc ecx
call fcn.00492cc7
pop ecx
push 0xffffffffffffffff
call fcn.0051ea1b
or dword [esi + 0x64], 0xffffffff
push 0x10
lea edi, [esi + 0x20]
push ebx
push edi
mov byte [esi + 0x1d], bl
mov dword [esi + 8], ebx
call fcn.00517bf0
add esp, 0xc
push 2
pop eax
mov word [edi], ax
mov dword [esi + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x10
mov dword [esi + 0x6c], eax
push ebx
add esi, 0x30
push esi
call fcn.00517bf0
mov ecx, dword [esp + 0x1b0]
add esp, 0xc
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005146df
mov esp, ebp
pop ebp
ret

Function at 0x50f0a1
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5f7350]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebx + 0x64], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
jne 0x50f0de
mov eax, dword [ebx + 0x5c]
mov ecx, eax
xor edx, edx
dec ecx
je 0x50f0ce
dec ecx
jne 0x50f0d1
push 0x11
jmp 0x50f0d0
push 6
pop edx
push edx
push eax
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x64]
cmp eax, 0xffffffff
jne 0x50f0ed
xor al, al
jmp 0x50f172
cmp byte [ebx + 0x68], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x50f120
push 1
lea ecx, [ebp - 0x15]
push ecx
push 4
push 0xffff
push eax
mov byte [ebx + 0x68], 1
mov byte [ebp - 0x15], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x50f120
call edi
mov dword [ebx + 0x60], eax
push esi
push 0x10
pop esi
push esi
push dword [ebp - 0x1c]
push dword [ebx + 0x64]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x50f13d
call edi
mov dword [ebx + 0x60], eax
jmp 0x50f156
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 0x64]
mov dword [ebp - 0x20], esi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x50f15a
xor al, al
jmp 0x50f170
cmp dword [ebx + 0x5c], 2
lea edi, [ebx + 0x20]
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jne 0x50f16e
mov byte [ebx + 0x1d], 1
mov al, 1
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005146df
leave
ret 4