joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b450
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [eax], edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 4], eax
test eax, eax
jne 0x42b5b7
push esi
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x42b5a3
push ebx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x42b49e
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42b492
sub eax, edx
inc eax
jmp 0x42b4a0
xor eax, eax
cmp dword [esi + 4], 2
mov dword [ebp - 8], eax
jne 0x42b544
cmp dword [esi + 0x18], 0
je 0x42b544
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x42b544
cmp ecx, 0x10
jb 0x42b544
add eax, 0x30
push eax
call dword [0x73166c]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x42b595
mov ecx, dword [esi]
lea edx, [ebx + 0x20]
mov dword [ebx], ecx
mov ecx, dword [esi + 4]
mov dword [ebx + 4], ecx
mov ecx, dword [esi + 8]
mov dword [ebx + 8], ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 8]
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 0x10
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x18], edx
mov eax, dword [esi + 0x18]
movups xmm0, xmmword [eax]
movups xmmword [edx], xmm0
test ecx, ecx
je 0x42b532
lea eax, [edx + 0x10]
push ecx
mov dword [ebx + 0x14], eax
push dword [esi + 0x14]
push eax
call fcn.00614e90
add esp, 0xc
mov eax, dword [ebp - 0xc]
test edi, edi
cmove edi, ebx
test eax, eax
je 0x42b541
mov dword [eax + 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x42b488
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
pop ebx
test eax, eax
je 0x42b561
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test esi, esi
je 0x42b59f
test edi, edi
je 0x42b586
nop dword [eax]
mov esi, dword [edi + 0x1c]
push edi
call dword [0x731670]
add esp, 4
mov edi, esi
test esi, esi
jne 0x42b570
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [eax], edi
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov esi, 8
mov dword [ebp - 4], esi
jmp 0x42b552
test edi, edi
jne 0x42b5af
mov esi, 0x2af9
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x430e20
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x730b1c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x1c], 0x10
push edi
lea ecx, [ebp - 0x1c]
or ebx, 0xffffffff
push ecx
mov eax, dword [esi + 0x424]
lea ecx, [ebp - 0x14]
mov edi, dword [esi]
push ecx
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x430e77
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.WS2_32.dll_accept]
mov ebx, eax
mov edx, dword [ebp - 0x18]
mov ecx, esi
call fcn.00428d10
cmp ebx, 0xffffffff
jne 0x430eaa
push str.Error_accept__ing_server_connect
push edi
call fcn.004512d0
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00610840
mov esp, ebp
pop ebp
ret
push str.Connection_accepted_from_server_n
push edi
call fcn.004511c0
add esp, 8
mov byte [esi + 0x526], 0
lea eax, [ebp - 0x18]
mov dword [esi + 0x424], ebx
mov dword [ebp - 0x18], 1
push eax
push 0x8004667e
push ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov byte [esi + 0x539], 1
cmp dword [edi + 0x608], 0
je 0x430f7d
mov eax, dword [edi + 0x7c]
test eax, eax
jne 0x430efe
mov eax, dword [edi + 0x78]
test eax, eax
je 0x430f05
mov byte [eax + 0xe6], 1
mov eax, dword [edi + 0x608]
push 1
push ebx
push dword [edi + 0x60c]
call eax
mov ecx, dword [edi + 0x7c]
add esp, 0xc
mov edx, eax
test ecx, ecx
je 0x430f2b
mov byte [ecx + 0xe6], 0
jmp 0x430f39
mov eax, dword [edi + 0x78]
test eax, eax
je 0x430f39
mov byte [eax + 0xe6], 0
test edx, edx
je 0x430f7d
mov edx, dword [esi + 0x424]
cmp edx, 0xffffffff
je 0x430f59
mov ecx, esi
call fcn.00428d10
mov dword [esi + 0x424], 0xffffffff
mov byte [esi + 0x515], 0
mov eax, 0x2a
mov byte [esi + 0x517], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00610840
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00610840
mov esp, ebp
pop ebp
ret
Function at 0x4312e0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x52d], 0
mov esi, dword [edi]
je 0x431318
push str.Doing_the_SSL_TLS_handshake_on_the_data_stream_n
push esi
call fcn.004511c0
add esp, 8
mov edx, 1
mov ecx, edi
call fcn.00470680
test eax, eax
jne 0x43151c
cmp dword [edi + 0x694], 0x21
jne 0x4314ea
mov edx, dword [esi + 0x108c]
mov ecx, dword [esi + 0x1088]
mov eax, dword [esi + 0xbb4]
test edx, edx
jl 0x431346
jg 0x431341
test ecx, ecx
jb 0x431346
or eax, 0x20
jmp 0x431357
xorps xmm0, xmm0
and eax, 0xffffffdf
movlpd qword [ebp - 0x10], xmm0
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0xbb4], eax
mov dword [esi + 0xb90], ecx
mov dword [esi + 0xb94], edx
mov eax, dword [0x73ad54]
mov ebx, dword [edi + 0x424]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x4313b4
sub esp, 8
call fcn.004699f0
add esp, 8
test al, al
je 0x4313a8
mov dword [0x73ad54], 2
jmp 0x4313f5
mov dword [0x73ad54], 1
jmp 0x4313b9
cmp eax, 2
je 0x4313f5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
push ebx
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4313de
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x4313f5
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x138]
mov eax, dword [ecx + 0x568]
test byte [eax + 0x40], 3
je 0x431417
cmp dword [edx + 0x1b0], 1
jne 0x431417
mov al, 1
jmp 0x431419
xor al, al
cmp byte [ecx + 0x531], 0
jne 0x431441
cmp dword [ecx + 0x3e8], 0x14
je 0x431441
test al, al
jne 0x431441
mov dword [ecx + 0x58c], 0xffffffff
mov eax, dword [ecx + 0x424]
jmp 0x43144d
mov eax, dword [ecx + 0x424]
mov dword [ecx + 0x58c], eax
mov dword [ecx + 0x590], eax
mov byte [esi + 0x58b], 0
mov dword [esi + 0x88], 0xffffffff
mov dword [esi + 0x8c], 0xffffffff
mov byte [esi + 0x584], 0
cmp byte [esi + 0xb40], 0
jne 0x431509
cmp byte [esi + 0x1114], 0
je 0x4314e1
mov eax, dword [ecx + 0x568]
test byte [eax + 0x40], 3
je 0x4314d7
cmp dword [edx + 0x1b0], 2
jne 0x4314d7
lea eax, [ebp - 0x18]
mov dword [esi + 0x108], 1
push eax
call fcn.0045e520
add esp, 4
mov ecx, esi
movups xmm0, xmmword [eax]
movups xmmword [esi + 0xf8], xmm0
mov eax, dword [esi + 0xaf4]
cdq
push edx
push eax
xor edx, edx
call fcn.0044b6d0
add esp, 8
jmp 0x431509
mov dword [esi + 0x108], 2
or dword [esi + 0x124], 2
jmp 0x431509
push 0xffffffffffffffff
push 0
push dword [edi + 0x69c]
mov edx, 1
mov ecx, esi
push dword [edi + 0x698]
call fcn.00460930
add esp, 0x10
mov byte [edi + 0x618], 1
xor eax, eax
mov dword [edi + 0x690], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4334b0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [edx - 0xc8]
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov ecx, dword [edi]
cmp eax, 0x64
jb 0x4334e2
push str.Couldnt_set_desired_mode
push ecx
call fcn.004512d0
add esp, 8
lea eax, [esi + 0x11]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edx, 0xc8
je 0x4334f9
push edx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ecx
call fcn.004511c0
add esp, 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x13
jne 0x433511
mov ecx, edi
call fcn.00432340
mov esi, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x14
jne 0x43361f
mov ebx, dword [edi]
xor edx, edx
mov dword [ebp - 8], edx
cmp dword [ebx + 0x938], 2
jne 0x433588
mov eax, dword [ebx + 0x138]
mov eax, dword [eax]
test eax, eax
je 0x433588
push 3
push edx
lea ecx, [ebp - 4]
mov dword [ebp - 4], edx
push ecx
push edx
mov edx, eax
call fcn.0042f3f0
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x43363d
mov esi, dword [ebp - 4]
push 0x2f
push esi
call fcn.00614980
add esp, 8
test eax, eax
je 0x43357c
sub eax, esi
mov ecx, 1
mov edx, esi
cmovne ecx, eax
mov dword [ebp - 8], edx
mov byte [ecx + esi], 0
jmp 0x433588
push esi
call dword [0x731670]
add esp, 4
xor edx, edx
mov ecx, dword [ebx + 0x97c]
test ecx, ecx
jne 0x4335a6
cmp byte [ebx + 0xb31], 0
mov ecx, str.NLST
mov eax, str.LIST
cmove ecx, eax
mov esi, 0x70c6f4
test edx, edx
mov eax, esi
cmovne eax, edx
push eax
mov eax, 0x7130b4
cmove eax, esi
push eax
push ecx
push 0x716f98
call fcn.00447430
push dword [ebp - 8]
mov ebx, eax
call dword [0x731670]
add esp, 0x14
test ebx, ebx
jne 0x4335e7
mov esi, 0x1b
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [edi + 0x608]
push 0x70c8cc
push eax
call fcn.0044caa0
add esp, 0xc
mov esi, eax
push ebx
call dword [0x731670]
add esp, 4
test esi, esi
jne 0x43363d
mov dword [edi + 0x690], 0x1f
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x15
jne 0x433628
push 0xd
jmp 0x43362f
cmp eax, 0x16
jne 0x43363d
push 0xe
mov dl, 1
mov ecx, edi
call fcn.004327e0
add esp, 4
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4375d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ecx
push esi
push edi
lea esi, [ebx + 1]
push esi
push ebx
call dword [0x731668]
mov edi, eax
add esp, 8
test edi, edi
je 0x43762c
push esi
push edi
push dword [ebp - 4]
mov dword [ebp - 8], edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
je 0x437648
cmp esi, ebx
je 0x437648
cmp esi, 0x8000
ja 0x437648
cmp esi, ebx
jb 0x43763f
push esi
push edi
call dword [0x731668]
mov edi, eax
add esp, 8
test edi, edi
jne 0x4375f2
mov ebx, dword [ebp - 8]
push ebx
call dword [0x731670]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [0x731670]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438be0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0xd4
mov edi, edx
call dword [0x73166c]
mov esi, eax
add esp, 4
test esi, esi
jne 0x438c09
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esi + 0xc]
mov dword [esi], fcn.00507b00
lea eax, [ecx + 0x5c]
mov dword [esi + 4], ecx
push ecx
mov dword [esi + 8], eax
call fcn.00507b00
cmp ebx, 0x40
jbe 0x438c5c
push ebx
push edi
push dword [esi + 4]
call fcn.00508490
mov edi, dword [esi + 8]
push dword [esi + 4]
add edi, 0x5c
push edi
call fcn.00508350
push dword [esi + 4]
mov ebx, 0x10
mov dword [ebp + 8], ebx
call fcn.00507b00
push dword [esi + 8]
call fcn.00507b00
add esp, 0x20
jmp 0x438c6d
push dword [esi + 8]
call fcn.00507b00
add esp, 8
xor eax, eax
test ebx, ebx
je 0x438cb3
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
movzx eax, byte [edi]
xor al, 0x36
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 4]
call fcn.00508490
movzx eax, byte [edi]
lea edi, [edi + 1]
xor al, 0x5c
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 8]
call fcn.00508490
add esp, 0x18
sub ebx, 1
jne 0x438c73
cmp dword [ebp + 8], 0x40
jae 0x438ce6
mov eax, dword [ebp - 0xc]
mov edi, 0x40
sub edi, eax
nop word [eax + eax]
push 1
push 0x71085a
push dword [esi + 4]
call fcn.00508490
push 1
push 0x710859
push dword [esi + 8]
call fcn.00508490
add esp, 0x18
sub edi, 1
jne 0x438cc0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x447490
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
push edi
xor ecx, ecx
mov dword [ebp - 8], 0
mov edi, dword [esi]
mov eax, dword [edi + 0x138]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x420]
cmp eax, dword [esi + 0x424]
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
sete cl
push edx
push ecx
push esi
mov eax, dword [esi + ecx*4 + 0x440]
call eax
mov ebx, eax
add esp, 0x14
test ebx, ebx
jns 0x4474ef
mov esi, dword [ebp - 8]
test esi, esi
je 0x447546
cmp esi, 0x51
jne 0x447577
xor ebx, ebx
xor esi, esi
cmp byte [edi + 0xb42], 0
je 0x447577
cmp dword [edi + 0x600], esi
je 0x44754d
mov eax, dword [edi + 0x7c]
test eax, eax
jne 0x447510
mov eax, dword [edi + 0x78]
test eax, eax
je 0x447517
mov byte [eax + 0xe6], 1
push dword [edi + 0x594]
mov eax, dword [edi + 0x600]
push ebx
push dword [ebp - 4]
push 2
push edi
call eax
mov eax, dword [edi + 0x7c]
add esp, 0x14
test eax, eax
jne 0x44753d
mov eax, dword [edi + 0x78]
test eax, eax
je 0x447575
mov byte [eax + 0xe6], 0
jmp 0x447575
mov esi, 0x37
jmp 0x447577
push dword [edi + 0x590]
push 1
push 2
push 0x711642
call fcn.00629d40
push dword [edi + 0x590]
push 1
push ebx
push dword [ebp - 4]
call fcn.00629d40
add esp, 0x20
xor esi, esi
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x4475ac
sub edi, ebx
push edi
call dword [0x73166c]
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x4475b5
mov ecx, dword [ebp - 4]
push edi
add ecx, ebx
push ecx
push eax
call fcn.00614e90
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x1b
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x448360
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0xe8
push 1
call dword [0x731678]
mov edi, eax
add esp, 8
test edi, edi
jne 0x448380
pop edi
mov esp, ebp
pop ebp
ret
push esi
lea ecx, [edi + 0x44]
mov dword [edi], 0xbab1e
call fcn.00439830
test eax, eax
jne 0x4484b1
push 0x10
mov dword [edi + 0x64], 0x448310
mov dword [edi + 0x68], 0x448330
mov dword [edi + 0x6c], 0x448350
mov dword [edi + 0x74], eax
mov dword [edi + 0x70], 1
call dword [0x73166c]
add esp, 4
mov dword [edi + 0x60], eax
test eax, eax
je 0x4484aa
lea ecx, [edi + 0x78]
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0x438720
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.00426800
test eax, eax
jne 0x4484b1
push ebx
lea ebx, [edi + 0xdc]
mov dword [edi + 0x20], eax
push ebx
push ecx
mov dword [edi + 0x1c], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov byte [edi + 0xe4], 1
mov dword [edi + 0xb0], 0xffffffff
mov dword [edi + 0xd8], 0x64
mov byte [edi + 0xe7], al
call fcn.00457e20
add esp, 8
test eax, eax
js 0x448491
mov esi, dword [sym.imp.WS2_32.dll_ioctlsocket]
lea eax, [ebp - 4]
push eax
push 0x8004667e
push dword [ebx]
mov dword [ebp - 4], 1
call esi
test eax, eax
js 0x44847f
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 0x8004667e
push dword [edi + 0xe0]
call esi
test eax, eax
jns 0x4484a1
push dword [ebx]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push dword [edi + 0xe0]
call esi
mov dword [edi + 0xe0], 0xffffffff
mov dword [ebx], 0xffffffff
pop ebx
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov dword [edi + 0x70], 0
lea ecx, [edi + 0x60]
call fcn.00438980
lea ecx, [edi + 0x44]
call fcn.00438980
lea ecx, [edi + 0x78]
test ecx, ecx
je 0x4484cd
call fcn.00438980
lea ecx, [edi + 0x14]
xor edx, edx
call fcn.00444160
lea ecx, [edi + 0x24]
xor edx, edx
call fcn.00444160
push edi
call dword [0x731670]
add esp, 4
xor eax, eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x44c870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x38]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x44c895
mov eax, 0x37
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x40], 0
lea ebx, [edi + 0x3c]
mov esi, dword [eax]
je 0x44c8a5
mov eax, dword [ebx]
mov byte [eax], 0
push dword [ebp + 8]
lea ecx, [esp + 0x1c]
mov dword [ebx + 4], 0
push edx
mov edx, 0x447360
mov dword [esp + 0x20], ebx
mov byte [esp + 0x24], 0
call fcn.00446770
add esp, 8
cmp eax, 0xffffffff
je 0x44ca70
cmp byte [esp + 0x1c], 0
jne 0x44ca70
push 2
mov edx, 0x716b00
mov ecx, ebx
call fcn.0042f040
add esp, 4
test eax, eax
jne 0x44ca98
mov eax, dword [edi + 0x40]
mov dword [esp + 0x18], eax
mov eax, dword [ebx]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0x38]
mov dword [edi + 8], 0
mov eax, dword [eax]
mov eax, dword [eax + 0xd34]
mov dword [edi + 0xc], eax
lea eax, [esp + 0x20]
push eax
mov byte [edi + 0x10], 1
call fcn.0045e520
mov edx, dword [esp + 0x10]
add esp, 4
mov ebx, dword [esp + 0x18]
xor ecx, ecx
mov dword [esp + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [edi + 0x20], xmm0
mov eax, dword [edx + 0x420]
cmp eax, dword [edx + 0x424]
lea eax, [esp + 0x14]
push eax
push ebx
push dword [esp + 0x18]
sete cl
push ecx
push edx
mov eax, dword [edx + ecx*4 + 0x440]
call eax
add esp, 0x14
mov dword [esp + 0xc], eax
test eax, eax
jns 0x44c98d
mov eax, dword [esp + 0x14]
test eax, eax
je 0x44c889
cmp eax, 0x51
jne 0x44ca98
xor eax, eax
mov dword [esp + 0xc], eax
cmp byte [esi + 0xb42], 0
je 0x44c9db
cmp dword [esi + 0x600], 0
je 0x44ca0f
mov ecx, dword [esi + 0x7c]
test ecx, ecx
jne 0x44c9ad
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x44c9b4
mov byte [ecx + 0xe6], 1
push dword [esi + 0x594]
push eax
push dword [esp + 0x18]
mov eax, dword [esi + 0x600]
push 2
push esi
call eax
mov eax, dword [esi + 0x7c]
add esp, 0x14
test eax, eax
je 0x44c9fb
mov byte [eax + 0xe6], 0
mov esi, dword [esp + 0xc]
cmp esi, ebx
je 0x44ca3e
mov eax, dword [esp + 0x10]
mov dword [edi + 0x1c], ebx
sub ebx, esi
mov dword [edi + 0x14], eax
xor eax, eax
mov dword [edi + 0x18], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x78]
mov esi, dword [esp + 0xc]
test eax, eax
je 0x44c9df
mov byte [eax + 0xe6], 0
jmp 0x44c9df
push dword [esi + 0x590]
push 1
push 2
push 0x711642
call fcn.00629d40
push dword [esi + 0x590]
mov esi, dword [esp + 0x20]
push 1
push esi
push dword [esp + 0x2c]
call fcn.00629d40
add esp, 0x20
jmp 0x44c9df
lea eax, [esp + 0x20]
mov dword [edi + 0x14], 0
push eax
mov dword [edi + 0x1c], 0
mov dword [edi + 0x18], 0
call fcn.0045e520
add esp, 4
movups xmm0, xmmword [eax]
xor eax, eax
movups xmmword [edi + 0x20], xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esp + 0x18]
push dword [esi]
call dword [0x731670]
add esp, 4
mov dword [esi], 0
mov dword [esi + 8], 0
mov eax, 0x1b
mov dword [esi + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f690
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x730b1c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x28]
mov edi, edx
push eax
mov esi, ecx
call fcn.0045e520
add esp, 4
mov ecx, esi
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
call fcn.0042c1e0
mov esi, eax
mov ecx, edi
mov dword [ebp - 8], esi
call fcn.0042c1e0
mov ebx, eax
push 1
push ebx
push esi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x44f7fe
cmp byte [0x73b8c8], 0
je 0x44f73b
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push ebx
push dword [0x73b8c4]
push dword [0x73b8c0]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.006713b0
mov edi, ebx
pop ebx
push 0
push 0xf4240
push edi
push ecx
mov esi, eax
mov ebx, edx
call fcn.00612660
push dword [0x73b8c4]
push dword [0x73b8c0]
push edx
push eax
call fcn.00671020
mov ecx, eax
jmp 0x44f75f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
xor ebx, ebx
mov eax, 0x10624dd3
mul edi
mov esi, edx
shr esi, 6
imul ecx, esi, 0x3e8
sub edi, ecx
imul ecx, edi, 0x3e8
sub esi, dword [ebp - 0x28]
sbb ebx, dword [ebp - 0x24]
cmp ebx, 0x20c49b
jg 0x44f82b
jl 0x44f77f
cmp esi, 0xa5e353f7
jae 0x44f82b
cmp ebx, 0xffdf3b64
jl 0x44f82b
jg 0x44f799
cmp esi, 0x5a1cac09
jbe 0x44f82b
sub ecx, dword [ebp - 0x20]
mov eax, 0x10624dd3
imul ecx
push 0
sar edx, 6
mov eax, edx
shr eax, 0x1f
push 0x3e8
add eax, edx
cdq
push ebx
push esi
mov edi, eax
mov dword [ebp - 0x10], edx
call fcn.00612660
add edi, eax
mov eax, dword [ebp - 0x10]
adc eax, edx
js 0x44f82b
jg 0x44f7d0
test edi, edi
jb 0x44f82b
test eax, eax
jg 0x44f82b
jl 0x44f7de
cmp edi, 0x3e8
ja 0x44f82b
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x44f6e4
test esi, esi
je 0x44f80b
push esi
call fcn.00619ae0
add esp, 4
test ebx, ebx
je 0x44f818
push ebx
call fcn.00619ae0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00610840
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
test eax, eax
je 0x44f83b
push eax
call fcn.00619ae0
add esp, 4
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x44f84b
push eax
call fcn.00619ae0
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00610840
mov esp, ebp
pop ebp
ret
Function at 0x4513d0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x730b1c]
xor eax, esp
mov dword [esp + 0x130], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x14], eax
push esi
push edi
mov eax, dword [ebx + edx*4 + 0x420]
lea esi, [ebx + 0x448]
mov edi, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, edx
shl eax, 4
add esi, eax
mov dword [esp + 0x14], edi
mov eax, dword [ebx + 0x568]
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 8]
test byte [eax + 0x40], 3
mov dword [esp + 0x18], ecx
je 0x451523
cmp dword [ebx + edx*4 + 0x438], 0x4515d0
jne 0x451523
cmp dword [esi], 0
je 0x451451
test ecx, ecx
je 0x451523
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x451523
push 0
push 0
mov edx, 1
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x2c], 0x700
call fcn.00450cc0
mov edx, eax
add esp, 8
test edx, edx
jle 0x4514a6
mov eax, dword [esp + 0x26]
mov ecx, eax
and ecx, 0x303
neg ecx
sbb ecx, ecx
neg ecx
mov edx, ecx
or edx, 4
and eax, 0x604
cmove edx, ecx
mov eax, edx
cmp edx, 0xffffffff
je 0x451523
test al, 1
je 0x451523
mov ecx, dword [esi]
test ecx, ecx
jne 0x451505
mov eax, dword [ebx]
mov eax, dword [eax + 0x91c]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x73166c]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
test ecx, ecx
je 0x4514e7
mov eax, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
jmp 0x451509
mov dword [edi], 0x1b
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.00610840
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
push 0
push eax
mov eax, dword [esi + 8]
add eax, ecx
push eax
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x451523
add dword [esi + 8], eax
push 0
push dword [ebp + 0x14]
push dword [esp + 0x24]
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
mov dword [edi], 0
cmp esi, 0xffffffff
jne 0x4515ab
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x451576
mov eax, dword [esp + 0x14]
xor esi, esi
mov dword [eax], 0x51
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.00610840
mov esp, ebp
pop ebp
ret
push 0x100
lea edx, [esp + 0x3c]
mov ecx, edi
call fcn.0045a2e0
add esp, 4
push eax
push str.Send_failure:__s
push dword [ebx]
call fcn.004512d0
mov eax, dword [ebx]
add esp, 0xc
mov dword [eax + 0xd9c], edi
mov eax, dword [esp + 0x14]
mov dword [eax], 0x37
mov ecx, dword [esp + 0x13c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00610840
mov esp, ebp
pop ebp
ret