joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4589b0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
test esi, esi
jle 0x458a9c
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
inc edi
nop word [eax + eax]
cmp esi, 3
jl 0x458a2d
movzx ecx, byte [edi - 1]
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], al
mov eax, ecx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 2], al
add edx, 3
and ecx, 0x3f
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
jmp 0x458a81
movzx eax, byte [edi - 1]
shl eax, 0x10
cmp esi, 2
jne 0x458a41
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], cl
cmp esi, 1
jne 0x458a6b
lea eax, [esi + 0x3c]
jmp 0x458a78
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 2], al
add edx, 3
mov byte [edx], 0x3d
sub esi, 3
add ebx, 4
add edi, 3
inc edx
test esi, esi
jg 0x4589d0
pop edi
pop esi
mov eax, ebx
mov byte [edx], 0
pop ebx
ret
mov eax, dword [esp + 0xc]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
ret
Function at 0x45bf40
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.00463700
mov ecx, dword [esp + 0x28]
mov edx, ecx
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x2c]
cmp esi, 0x10
jb 0x45bfc0
mov eax, esi
shr eax, 4
mov dword [esp + 0x10], eax
nop
mov eax, edi
sub edx, ebp
sub eax, ebp
mov ecx, ebp
mov dword [esp + 0x14], eax
mov ebx, 4
mov esi, eax
mov eax, dword [edx + ecx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
mov dword [esi + ecx - 4], eax
sub ebx, 1
jne 0x45bf83
push dword [esp + 0x34]
push edi
push edi
call dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov edx, edi
sub esi, 0x10
add esp, 0xc
add ebp, 0x10
mov dword [esp + 0x30], esi
add edi, 0x10
sub dword [esp + 0x10], 1
jne 0x45bf70
mov ecx, dword [esp + 0x38]
test esi, esi
je 0x45c0cc
mov ebx, edi
mov ecx, edx
sub ebx, ebp
sub ecx, ebp
mov dword [esp + 0x14], ebx
xor eax, eax
mov ebx, 1
mov dword [esp + 0x20], ecx
sub ebx, ebp
mov dword [esp + 0x10], ebx
mov ebx, 2
sub ebx, ebp
mov dword [esp + 0x18], ebx
mov ebx, 3
sub ebx, ebp
mov dword [esp + 0x1c], ebx
nop dword [eax + eax]
cmp eax, esi
jae 0x45c072
mov esi, dword [esp + 0x14]
lea ebx, [eax + ebp]
mov cl, byte [ecx + ebx]
xor cl, byte [ebx]
mov byte [esi + ebx], cl
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x30]
add ecx, ebx
cmp ecx, esi
jae 0x45c071
mov cl, byte [eax + ebp + 1]
xor cl, byte [eax + edx + 1]
mov byte [edi + eax + 1], cl
mov ecx, dword [esp + 0x18]
add ecx, ebx
cmp ecx, esi
jae 0x45c06c
mov cl, byte [eax + ebp + 2]
xor cl, byte [eax + edx + 2]
mov byte [edi + eax + 2], cl
mov ecx, dword [esp + 0x1c]
add ecx, ebx
cmp ecx, esi
jae 0x45c067
mov cl, byte [eax + ebp + 3]
xor cl, byte [eax + edx + 3]
mov byte [edi + eax + 3], cl
add eax, 4
mov ecx, dword [esp + 0x20]
cmp eax, 0x10
jb 0x45c000
jmp 0x45c091
add eax, 3
jmp 0x45c072
add eax, 2
jmp 0x45c072
inc eax
cmp eax, 0x10
jae 0x45c091
mov ebx, 0x10
lea ecx, [eax + edi]
sub edx, edi
sub ebx, eax
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub ebx, 1
jne 0x45c083
push dword [esp + 0x34]
push edi
push edi
call dword [esp + 0x48]
add esp, 0xc
mov edx, edi
cmp esi, 0x10
jbe 0x45c0ba
sub esi, 0x10
add ebp, 0x10
add edi, 0x10
mov dword [esp + 0x30], esi
test esi, esi
jne 0x45bfc8
mov eax, dword [esp + 0x38]
movups xmm0, xmmword [edx]
pop edi
pop esi
pop ebp
movups xmmword [eax], xmm0
pop ebx
add esp, 0x14
ret
movups xmm0, xmmword [edx]
pop edi
pop esi
pop ebp
movups xmmword [ecx], xmm0
pop ebx
add esp, 0x14
ret
Function at 0x45c200
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.00463700
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov edi, dword [edi]
mov dword [esp + 0x14], edi
test edi, edi
je 0x45c24d
mov edx, dword [esp + 0x30]
test esi, esi
je 0x45c24d
mov al, byte [edi + edx]
dec esi
xor al, byte [ecx]
inc edi
mov byte [ebp], al
inc ecx
inc ebp
mov dword [esp + 0x10], ecx
and edi, 0xf
mov dword [esp + 0x14], edi
jne 0x45c230
mov ebx, dword [esp + 0x2c]
movzx edx, byte [ebx + 0xc]
movzx eax, byte [ebx + 0xd]
shl edx, 8
or edx, eax
movzx eax, byte [ebx + 0xe]
shl edx, 8
or edx, eax
movzx eax, byte [ebx + 0xf]
shl edx, 8
or edx, eax
mov dword [esp + 0x24], edx
cmp esi, 0x10
jb 0x45c307
mov edi, ebx
nop
mov ebx, esi
shr ebx, 4
add edx, ebx
mov dword [esp + 0x24], edx
cmp edx, ebx
jae 0x45c297
sub ebx, edx
xor edx, edx
mov dword [esp + 0x24], edx
push edi
push dword [esp + 0x2c]
push ebx
push ebp
push ecx
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, edx
mov byte [edi + 0xf], dl
shr eax, 0x18
mov byte [edi + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 0xd], al
mov eax, edx
shr eax, 8
mov byte [edi + 0xe], al
test edx, edx
jne 0x45c2e9
mov edx, 0xc
mov ecx, 1
movzx eax, byte [edx + edi - 1]
dec edx
add ecx, eax
mov byte [edx + edi], cl
shr ecx, 8
test edx, edx
jne 0x45c2d3
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
shl ebx, 4
sub esi, ebx
add ecx, ebx
add ebp, ebx
mov dword [esp + 0x10], ecx
cmp esi, 0x10
jae 0x45c280
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x2c]
test esi, esi
je 0x45c375
mov eax, dword [esp + 0x30]
xorps xmm0, xmm0
push ebx
push dword [esp + 0x2c]
push 1
push eax
push eax
movups xmmword [eax], xmm0
call dword [esp + 0x4c]
mov ecx, dword [esp + 0x38]
add esp, 0x14
inc ecx
mov eax, ecx
mov byte [ebx + 0xf], cl
shr eax, 0x18
mov byte [ebx + 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 0xd], al
mov eax, ecx
shr eax, 8
mov byte [ebx + 0xe], al
test ecx, ecx
jne 0x45c352
push ebx
call fcn.0045c3c0
add esp, 4
mov eax, dword [esp + 0x30]
sub ebp, eax
mov edx, dword [esp + 0x10]
sub edx, eax
lea ecx, [edi + eax]
add edi, esi
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebp - 1], al
sub esi, 1
jne 0x45c363
mov eax, dword [esp + 0x34]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x45c9d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx + 0x38]
or eax, dword [ebx + 0x3c]
je 0x45c9e4
mov eax, 0xfffffffe
pop ebx
ret
push esi
mov esi, dword [esp + 0x14]
xor ecx, ecx
mov eax, esi
add eax, dword [ebx + 0x30]
adc ecx, dword [ebx + 0x34]
cmp ecx, 0x20000000
ja 0x45ca99
jb 0x45ca09
test eax, eax
jne 0x45ca99
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [ebx + 0x16c]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], ecx
test edi, edi
je 0x45ca49
nop
test esi, esi
je 0x45ca35
mov al, byte [ebp]
dec esi
xor byte [edi + ebx + 0x40], al
inc ebp
inc edi
and edi, 0xf
jne 0x45ca20
jmp 0x45ca39
test edi, edi
jne 0x45ca8c
lea eax, [ebx + 0x60]
push eax
lea eax, [ebx + 0x40]
push eax
call fcn.0045dcf0
add esp, 8
mov eax, esi
and eax, 0xfffffff0
mov dword [esp + 0x14], eax
je 0x45ca6e
push eax
push ebp
lea eax, [ebx + 0x60]
push eax
lea eax, [ebx + 0x40]
push eax
call fcn.0045dab0
add ebp, dword [esp + 0x24]
add esp, 0x10
sub esi, dword [esp + 0x14]
test esi, esi
je 0x45ca8c
xor ecx, ecx
mov edi, esi
test esi, esi
je 0x45ca8c
nop word [eax + eax]
mov al, byte [ecx + ebp]
xor byte [ebx + ecx + 0x40], al
inc ecx
cmp ecx, esi
jb 0x45ca80
mov dword [ebx + 0x16c], edi
xor eax, eax
pop edi
pop ebp
pop esi
pop ebx
ret
pop esi
or eax, 0xffffffff
pop ebx
ret
Function at 0x45dcf0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.00463700
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
movzx ecx, byte [eax + 0xf]
mov esi, dword [esp + 0x28]
mov ebp, ecx
and ecx, 0xf
mov dword [esp + 0x24], 0
add ecx, ecx
and ebp, 0xfffffff0
push edi
mov ebx, dword [esi + ecx*8]
mov edi, dword [esi + ecx*8 + 4]
mov edx, dword [esi + ecx*8 + 8]
mov ecx, dword [esi + ecx*8 + 0xc]
mov esi, edx
shrd edx, ecx, 4
and esi, 0xf
mov dword [esp + 0x14], ebx
or dword [esp + 0x28], edx
shl dword [esp + 0x14], 0x1c
shrd ebx, edi, 4
mov edx, dword [esi*4 + 0x4c62a8]
mov esi, dword [esp + 0x2c]
shr ecx, 4
or dword [esp + 0x14], ecx
xor ecx, ecx
shr edi, 4
xor ecx, ebx
xor ecx, dword [esi + ebp]
xor edx, edi
xor edx, dword [esi + ebp + 4]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x14]
xor edi, dword [esi + ebp + 8]
xor ebx, dword [esi + ebp + 0xc]
mov dword [esp + 0x18], edx
mov edx, 0xe
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
nop dword [eax + eax]
movzx edx, byte [edx + eax]
xor esi, esi
mov ebp, dword [esp + 0x10]
mov ecx, edx
shr ecx, 4
and edx, 0xf
mov dword [esp + 0x20], ecx
add edx, edx
mov ecx, edi
shl ebp, 0x1c
shrd edi, ebx, 4
and ecx, 0xf
mov dword [esp + 0x28], 0
shr ebx, 4
or esi, edi
or ebp, ebx
xor edi, edi
mov ebx, dword [ecx*4 + 0x4c62a8]
mov ecx, dword [esp + 0x18]
shrd dword [esp + 0x10], ecx, 4
xor edi, dword [esp + 0x10]
shr ecx, 4
xor ebx, ecx
mov ecx, dword [esp + 0x2c]
xor ebx, dword [ecx + edx*8 + 4]
xor ebp, dword [ecx + edx*8 + 0xc]
xor edi, dword [ecx + edx*8]
xor esi, dword [ecx + edx*8 + 8]
mov edx, edi
shrd edi, ebx, 4
mov ecx, esi
shl edx, 0x1c
shrd esi, ebp, 4
and ecx, 0xf
shr ebx, 4
or dword [esp + 0x28], esi
shr ebp, 4
or edx, ebp
xor ebp, ebp
mov ecx, dword [ecx*4 + 0x4c62a8]
xor ebp, edi
xor ecx, ebx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x20]
mov ebx, ebp
add edx, edx
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x2c]
xor ebx, dword [ebp + edx*8]
xor ecx, dword [ebp + edx*8 + 4]
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x28]
xor ebx, dword [ebp + edx*8 + 8]
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0x14]
xor ebx, dword [ebp + edx*8 + 0xc]
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x28]
sub edx, 1
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
jns 0x45dd90
mov edx, dword [esp + 0x18]
shr ecx, 0x18
mov byte [eax], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 1], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 2], cl
mov byte [eax + 3], dl
mov edx, dword [esp + 0x10]
mov ecx, edx
shr ecx, 0x18
mov byte [eax + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 5], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 6], cl
mov ecx, ebx
shr ecx, 0x18
mov byte [eax + 8], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [eax + 9], cl
mov ecx, ebx
shr ecx, 8
mov byte [eax + 0xa], cl
mov byte [eax + 7], dl
mov edx, edi
mov ecx, edx
mov byte [eax + 0xb], bl
shr ecx, 0x18
mov byte [eax + 0xc], cl
mov ecx, edx
shr ecx, 0x10
pop edi
mov byte [eax + 0xd], cl
mov ecx, edx
pop esi
shr ecx, 8
pop ebp
mov byte [eax + 0xe], cl
mov byte [eax + 0xf], dl
pop ebx
add esp, 0x14
ret
Function at 0x461980
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [0x4e78a8]
test edi, edi
je 0x4619ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [edi]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x4619ba
mov edi, dword [ebx + 0xc]
mov eax, edi
mov ebx, dword [ebx + 0x10]
mov edx, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
call fcn.004626a0
mov edi, eax
mov ebx, edx
test edi, edi
je 0x461a3c
or dword [edi + 0x94], 1
mov dword [edi + 0x84], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ebp, [edi + 8]
push 2
push 0
push 0
push ebp
mov dword [edi + 0x98], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x461a1e
push ebx
push edi
call fcn.00462ab0
add esp, 8
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
ret
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [edi + 0x88], eax
push edi
push dword [0x4e78a8]
call fcn.00461a50
add esp, 8
mov eax, edi
mov edx, ebx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x461a50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [0x4e78a8]
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
mov edi, dword [esp + 0x34]
cmp edi, ebx
je 0x461a85
call fcn.00461980
mov esi, eax
mov dword [esp + 0x14], edx
test esi, esi
jne 0x461abc
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x20
ret
test ebx, ebx
je 0x461aae
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebx]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x461aae
mov esi, dword [ebx + 0xc]
mov eax, dword [ebx + 0x10]
jmp 0x461ab8
test ebp, ebp
je 0x461a78
mov esi, dword [ebp]
mov eax, dword [ebp + 4]
mov dword [esp + 0x14], eax
xor ebx, ebx
test edi, edi
je 0x461b3b
test esi, esi
je 0x461b28
cmp dword [edi + 4], ebx
je 0x461b28
test ebp, ebp
je 0x461b28
lea eax, [esp + 0x20]
push eax
lea eax, [edi + 8]
push eax
call fcn.00462490
lea eax, [esp + 0x18]
push eax
lea eax, [esi + 0x1c]
push eax
call fcn.00462490
mov eax, dword [esi + 0x30]
add esp, 0x10
test eax, eax
je 0x461b01
cmp dword [eax + 4], edi
je 0x461b0d
mov eax, dword [eax + 8]
test eax, eax
jne 0x461af5
push edi
push esi
call fcn.00462b30
add esp, 8
mov ebx, eax
lea eax, [esp + 0x10]
push eax
call fcn.00462510
lea eax, [esp + 0x24]
push eax
call fcn.00462510
add esp, 8
test ebx, ebx
jne 0x461b3b
push ebp
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
mov ecx, 0xb
cmove ebx, ecx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x20
ret
Function at 0x461d00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x10
cmp dword [0x4e78a4], 0
je 0x461e06
push edi
mov edi, dword [0x4e78a8]
test edi, edi
je 0x461dfc
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [edi]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x461df1
push dword [edi + 0x10]
push dword [edi + 0xc]
call fcn.00461e70
lea eax, [esp + 0x10]
push eax
lea eax, [edi + 0x20]
push eax
call fcn.00462490
lea eax, [esp + 0x18]
mov dword [edi + 0x18], 6
push eax
call fcn.00462510
add esp, 0x14
cmp dword [edi + 0x7c], 0
je 0x461dcb
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetEvent]
nop dword [eax]
mov eax, dword [edi + 0x7c]
mov esi, dword [eax]
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0xc]
mov dword [esi + 0xc], edi
mov ebx, dword [ecx + 0xc]
test ebx, ebx
je 0x461d9b
mov eax, dword [ecx + 8]
mov dword [ebx + 8], eax
mov ebx, dword [ecx + 8]
test ebx, ebx
je 0x461da8
mov eax, dword [ecx + 0xc]
mov dword [ebx + 0xc], eax
cmp dword [edx + 0x7c], ecx
jne 0x461db3
mov eax, dword [ecx + 0xc]
mov dword [edx + 0x7c], eax
mov eax, dword [esi + 0x18]
or ecx, 0xffffffff
add eax, 4
xchg dword [eax], ecx
push dword [esi + 0x14]
call ebp
cmp dword [edi + 0x7c], 0
jne 0x461d80
pop ebp
pop ebx
cmp dword [edi + 0x84], 1
jne 0x461df1
push dword [edi + 0x10]
push dword [edi + 0xc]
call fcn.004629e0
mov eax, dword [0x4e78a8]
add esp, 8
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
mov eax, 1
pop edi
add esp, 0x10
ret
mov eax, 1
pop edi
add esp, 0x10
ret
mov eax, 1
add esp, 0x10
ret
Function at 0x4627b0
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x4e78a4], 0
je 0x4627bf
mov eax, 1
ret
push esi
push edi
push 0x10
push 1
mov dword [0x4e78a4], 1
xor edi, edi
call fcn.00472da6
mov esi, eax
add esp, 8
test esi, esi
jne 0x4627f2
mov dword [0x4e78a8], esi
call fcn.00462880
mov eax, dword [0x4e78a4]
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x46280f
push esi
mov edi, 0xb
call fcn.0046c157
add esp, 4
xor esi, esi
mov dword [0x4e78a8], esi
test edi, edi
jne 0x462865
push 0x10
push 1
call fcn.00472da6
mov esi, eax
add esp, 8
test esi, esi
jne 0x46283e
mov dword [0x4e78ac], esi
call fcn.00462880
mov eax, dword [0x4e78a4]
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x46285b
push esi
mov edi, 0xb
call fcn.0046c157
add esp, 4
xor esi, esi
mov dword [0x4e78ac], esi
test edi, edi
je 0x46286a
call fcn.00462880
mov eax, dword [0x4e78a4]
pop edi
pop esi
ret

Function at 0x478549
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004783c8

Function at 0x47c28c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047bf4c
Function at 0x480640
Capabilities:
Connect udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
jmp 0x481b10
sub esp, 0x2c
mov eax, dword [0x4d31c4]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
mov ebp, dword [esp + 0x44]
push edi
or edi, 0xffffffff
or ebx, edi
cmp dword [esp + 0x44], 0
jne 0x481d0a
mov eax, dword [esp + 0x3c]
cmp eax, 2
je 0x481b47
cmp eax, 1
jne 0x481d0a
test ebp, ebp
jne 0x481b6b
push 0x2726
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004634b5
add esp, 0x2c
ret
push esi
push 0
push dword [esp + 0x48]
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
js 0x481cf4
xorps xmm0, xmm0
mov eax, 2
movups xmmword [esp + 0x18], xmm0
push 0x7f000001
mov word [esp + 0x1c], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x1c], eax
xor eax, eax
mov word [esp + 0x1a], ax
lea eax, [esp + 0x18]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x481cc2
push 1
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x481cc2
push 0
push dword [esp + 0x48]
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
test edi, edi
js 0x481cc2
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x10
push eax
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x481cc2
cmp dword [esp + 0x10], 0x10
jne 0x481cb8
push 0x10
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x481cc2
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x10
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov ebx, eax
test ebx, ebx
js 0x481cc2
cmp dword [esp + 0x10], 0x10
jne 0x481cb8
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x481cc2
cmp dword [esp + 0x10], 0x10
jne 0x481cb8
mov ax, word [esp + 0x18]
cmp ax, word [esp + 0x28]
jne 0x481cb8
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x2c]
jne 0x481cb8
mov ax, word [esp + 0x1a]
cmp ax, word [esp + 0x2a]
jne 0x481cb8
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
mov dword [ebp], edi
xor eax, eax
pop edi
mov dword [ebp + 4], ebx
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004634b5
add esp, 0x2c
ret
mov dword [esp + 0x14], 0x2745
jmp 0x481ccc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 0x14], eax
mov ebp, dword [sym.imp.WS2_32.dll_closesocket]
cmp esi, 0xffffffff
je 0x481cda
push esi
call ebp
cmp edi, 0xffffffff
je 0x481ce2
push edi
call ebp
cmp ebx, 0xffffffff
je 0x481cea
push ebx
call ebp
push dword [esp + 0x14]
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop esi
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004634b5
add esp, 0x2c
ret
push 0x273f
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [esp + 0x34]
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004634b5
add esp, 0x2c
ret
Function at 0x480650
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x10], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x480689
push esi
push str.fcntl__d__F_GETFL_
push esi
call fcn.004973b0
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret

Function at 0x481340
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x20
push ebx
push esi
or ebx, 0xffffffff
push edi
test eax, eax
je 0x48135f
movups xmm0, xmmword [eax]
movups xmmword [esp + 0xc], xmm0
movups xmm0, xmmword [eax + 0x10]
jmp 0x48136f
xorps xmm0, xmm0
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x10], 0
mov esi, dword [esp + 0x3c]
lea eax, [esp + 0x38]
mov edi, dword [esp + 0x34]
push eax
push esi
lea eax, [esp + 0x14]
push eax
push edi
push dword [esp + 0x40]
movups xmmword [esp + 0x30], xmm0
call fcn.00481f70
add esp, 0x14
test eax, eax
je 0x4814a8
cmp eax, 8
je 0x4814a8
cmp eax, 0x2af9
je 0x4814a8
cmp dword [0x4e858c], 0
jne 0x4813be
call fcn.00482a60
cmp dword [0x4e8584], 0
push ebp
je 0x481414
test edi, edi
je 0x481414
cmp dword [esp + 0x18], 0
jne 0x481414
push edi
call fcn.00482920
mov ebx, eax
add esp, 4
mov dword [esp + 0x3c], ebx
test ebx, ebx
js 0x481414
cmp dword [esp + 0x34], 0
mov ebp, 1
jne 0x481410
lea eax, [esp + 0x3c]
push eax
push esi
lea eax, [esp + 0x18]
push eax
push edi
push 0
call fcn.00481f70
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret
xor edi, edi
jmp 0x481416
xor ebp, ebp
cmp dword [0x4e858c], 0
jne 0x481424
call fcn.00482a60
cmp dword [0x4e8588], 0
je 0x48143a
lea eax, [esp + 0x10]
push eax
call fcn.00482a00
add esp, 4
and dword [esp + 0x10], 0x7fffffff
lea eax, [esp + 0x10]
push esi
push eax
push edi
push dword [esp + 0x40]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, eax
test ebp, ebp
je 0x481463
push esi
push ebx
call fcn.00482b80
add esp, 8
cmp dword [0x4e858c], 0
jne 0x481471
call fcn.00482a60
cmp dword [0x4e8588], 0
je 0x4814a5
push dword [esi]
call fcn.00482bf0
add esp, 4
test eax, eax
jns 0x4814a5
push dword [esi]
call fcn.004814b0
add esp, 4
mov dword [esi], 0
mov eax, 8
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x4819d0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x10]
push edi
cmp dword [esi], ebx
jge 0x481a2c
movzx eax, word [ebp]
push ebx
push 1
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
mov dword [esi], edi
test edi, edi
js 0x481a86
lea eax, [esp + 0x14]
mov ebx, 1
push eax
push 0x8004667e
push edi
mov dword [esp + 0x20], ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x481a2c
push edi
push str.fcntl__d__F_GETFL_
push edi
call fcn.004973b0
add esp, 0xc
jmp 0x481a78
push dword [esp + 0x1c]
push ebp
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x481a95
push dword [esi]
call fcn.004806c0
add esp, 4
cmp eax, 0x2733
je 0x481a8e
cmp eax, 0x2714
je 0x481a8e
cmp eax, 0x2734
je 0x481a8e
cmp eax, 0x2726
je 0x481a8e
cmp eax, 0x274d
jne 0x481a74
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
ret
test ebx, ebx
je 0x481a86
push dword [esi]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], 0xffffffff
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret