joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411b40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e46ae
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x537700]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0
mov dword [edi], vtable.boost::asio::detail::win_iocp_io_context.0
mov dword [ebp - 4], 0
mov dword [edi + 0x14], 0
lea esi, [edi + 0x18]
mov dword [edi + 0x1c], 0
mov dword [esi], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0xffffffff
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
lea ecx, [edi + 0x38]
mov byte [ebp - 4], 3
mov dword [edi + 0x34], 0
call fcn.00411da0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov ecx, dword [ebp + 0xc]
mov dword [edi + 0x5c], ecx
mov dword [edi + 0x60], 0
or eax, 0xffffffff
mov byte [ebp - 4], 6
test ecx, ecx
cmovns eax, ecx
push eax
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [edi + 0x14], eax
test eax, eax
jne 0x411c73
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x537028
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402f30
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], str.E:_repoyjscloudclinkClientOfCSP_agent_boost_1.85.0libs_asioinclude_boost_asio_detail_impl_win_iocp_io_context.ipp
mov dword [ebp - 0x28], str.__thiscall_boost::asio::detail::win_iocp_io_context::win_iocp_io_context_class_boost::asio::execution_context__int_bool_
mov dword [ebp - 0x24], 0x66
mov dword [ebp - 0x20], 0x1a
test al, 1
je 0x411c73
cmp eax, 1
jne 0x411d0a
cmp dword [ebp - 0x1c], 0
setne al
test al, al
jne 0x411d0a
cmp byte [ebp + 0x10], 0
je 0x411cf4
lock inc dword [esi]
push 0xc
call fcn.004b80fd
mov esi, eax
add esp, 4
mov dword [ebp + 0x10], esi
mov byte [ebp - 4], 7
test esi, esi
je 0x411cd4
push 0x10
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.004b80fd
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x411cc7
push 0
push eax
mov ecx, esi
mov dword [eax], vtable.boost::asio::detail::win_thread::func_struct_boost::asio::detail::win_iocp_io_context::thread_function_.0
mov dword [eax + 0xc], edi
call fcn.00429c70
jmp 0x411cd6
xor eax, eax
mov ecx, esi
push eax
push eax
call fcn.00429c70
jmp 0x411cd6
xor esi, esi
mov ebx, dword [edi + 0x60]
test ebx, ebx
je 0x411cf1
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc
push ebx
call fcn.004b812d
add esp, 8
mov dword [edi + 0x60], esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp - 0x2c]
push eax
push str.iocp
lea eax, [ebp - 0x1c]
push eax
call fcn.00404ed0
int3
Function at 0x415660
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
cmp dword [esi + 0x14], 0xf
mov ecx, dword [esi + 0x10]
jbe 0x415677
add ecx, dword [esi]
mov esi, dword [esi]
jmp 0x415679
add ecx, esi
sub ecx, esi
xor ebp, ebp
mov edi, 0x734297e9
mov ebx, ecx
xor ebx, edi
xor ebp, 0x8c858963
mov edx, 0xe35e67b1
cmp ecx, 4
jb 0x4156c2
mov eax, ecx
shr eax, 2
mov dword [esp + 0x14], eax
nop
mov eax, dword [esi]
sub edi, 0x61c88647
add eax, edi
add esi, 4
mul edx
sub ecx, 4
xor ebp, edx
xor ebx, eax
sub dword [esp + 0x14], 1
mov edx, 0xe35e67b1
jne 0x4156a0
xor edx, edx
cmp ecx, 1
jb 0x4156f6
lea edx, [ecx - 1]
shr ecx, 1
and edx, 2
movzx eax, byte [ecx + esi]
shl ecx, 3
shl eax, cl
lea ecx, [edx*8]
mov dword [esp + 0x14], eax
movzx eax, byte [edx + esi]
mov edx, dword [esp + 0x14]
shl eax, cl
or edx, eax
movzx eax, byte [esi]
or edx, eax
lea eax, [edx - 0x61c88647]
mov ecx, 0xe35e67b1
add eax, edi
mul ecx
lea ecx, [edi + 0x3c6ef372]
xor ebp, edx
xor ebx, eax
add ecx, ebx
lea eax, [ebp + 0x1fcd5b23]
add eax, edi
mul ecx
pop edi
pop esi
xor edx, ebp
xor eax, ebx
pop ebp
xor eax, edx
pop ebx
ret 4
Function at 0x41faf0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, dword [ecx]
push edi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x41fb3f
lea edx, [esi + 8]
mov edi, eax
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x41fb02
mov eax, dword [esi]
jmp 0x41fc28
cmp eax, 0x4e0
jb 0x41fc28
push ebx
mov ebx, dword [esi + 0x9c4]
lea edi, [esi + 0x9c4]
push ebp
mov ebp, 0xe3
nop dword [eax]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x41fb60
mov ebx, dword [esi + 0xd50]
lea edi, [esi + 0xd50]
mov ebp, 0x18c
nop dword [eax]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x41fbb0
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
pop ebx
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret
Function at 0x4217c0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
cmp esi, 0xffffffff
je 0x4219a3
cmp byte [esp + 0x1c], 0
push ebp
mov ebp, dword [esp + 0x1c]
je 0x42181d
mov al, byte [ebp]
test al, 8
je 0x42181d
or al, 8
xor ecx, ecx
push 4
mov byte [ebp], al
lea eax, [esp + 0x1c]
push eax
push 0x80
push 0xffff
push esi
mov dword [esp + 0x2c], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
setne al
movzx eax, al
push eax
lea eax, [esp + 0xc]
push eax
call fcn.00424970
add esp, 8
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x421840
mov ecx, dword [esp + 0x24]
xorps xmm0, xmm0
pop ebp
pop esi
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
add esp, 0xc
ret
push ebx
push edi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x537028
push eax
lea ecx, [esp + 0x18]
call fcn.00402f30
mov ecx, dword [esp + 0x2c]
movq xmm0, qword [eax]
movq qword [ecx], xmm0
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
mov ebx, dword [0x537030]
mov edi, dword [0x537034]
cmp ebx, 0x257edfd1
jne 0x421885
cmp edi, 0xb2ab117a
je 0x421895
cmp ebx, 0x257edfd0
jne 0x421899
cmp edi, 0xb2ab117a
jne 0x421899
mov al, 1
jmp 0x4218bd
mov eax, dword [0x537028]
mov ecx, 0x537028
push 0x2733
mov eax, dword [eax + 0x18]
call eax
mov edi, dword [0x537034]
mov ebx, dword [0x537030]
mov ecx, dword [esp + 0x2c]
movzx eax, al
add eax, 2
mov dword [esp + 0x10], 0x2733
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x1c], 0x537028
call fcn.00414ed0
add esp, 8
test al, al
jne 0x42195d
cmp ebx, 0x257edfd1
jne 0x4218f9
cmp edi, 0xb2ab117a
je 0x421909
cmp ebx, 0x257edfd0
jne 0x42190d
cmp edi, 0xb2ab117a
jne 0x42190d
mov al, 1
jmp 0x421921
mov eax, dword [0x537028]
mov ecx, 0x537028
push 0x4d5
mov eax, dword [eax + 0x18]
call eax
mov edi, dword [esp + 0x2c]
movzx eax, al
add eax, 2
mov dword [esp + 0x10], 0x4d5
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x1c], 0x537028
call fcn.00414ed0
add esp, 8
test al, al
jne 0x421961
mov eax, dword [esp + 0x20]
pop edi
pop ebx
pop ebp
pop esi
add esp, 0xc
ret
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [ebp], 0xfc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
test esi, esi
setne cl
movzx ecx, cl
push ecx
push edi
call fcn.00424970
add esp, 8
mov eax, esi
pop edi
pop ebx
pop ebp
pop esi
add esp, 0xc
ret
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x421b00
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 8]
cmp ecx, 1
je 0x421b12
mov eax, dword [esi]
jmp 0x421b28
mov eax, dword [esi + 4]
xor edx, edx
push ebx
mov ebx, 0x1ffff7
div ebx
pop ebx
imul eax, edx, 0x3e8
add eax, dword [esi]
cmp eax, 0x4cf
jg 0x421c42
je 0x421bf3
cmp eax, 0x79
je 0x421b9e
cmp eax, 0x4c9
jne 0x421ca0
mov ecx, dword [0x537030]
mov eax, dword [0x537034]
cmp ecx, 0x257edfd1
jne 0x421b63
cmp eax, 0xb2ab117a
je 0x421b72
cmp ecx, 0x257edfd0
jne 0x421b7f
cmp eax, 0xb2ab117a
jne 0x421b7f
mov al, 1
mov dword [esi], 0x274d
jmp 0x421c90
mov eax, dword [0x537028]
mov ecx, 0x537028
push 0x274d
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x274d
jmp 0x421c90
mov ecx, dword [0x537030]
mov eax, dword [0x537034]
cmp ecx, 0x257edfd1
jne 0x421bb8
cmp eax, 0xb2ab117a
je 0x421bc7
cmp ecx, 0x257edfd0
jne 0x421bd4
cmp eax, 0xb2ab117a
jne 0x421bd4
mov al, 1
mov dword [esi], 0x274c
jmp 0x421c90
mov eax, dword [0x537028]
mov ecx, 0x537028
push 0x274c
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x274c
jmp 0x421c90
mov ecx, dword [0x537030]
mov eax, dword [0x537034]
cmp ecx, 0x257edfd1
jne 0x421c0d
cmp eax, 0xb2ab117a
je 0x421c1c
cmp ecx, 0x257edfd0
jne 0x421c26
cmp eax, 0xb2ab117a
jne 0x421c26
mov al, 1
mov dword [esi], 0x2743
jmp 0x421c90
mov eax, dword [0x537028]
mov ecx, 0x537028
push 0x2743
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x2743
jmp 0x421c90
cmp eax, 0x4d0
jne 0x421ca0
mov ecx, dword [0x537030]
mov eax, dword [0x537034]
cmp ecx, 0x257edfd1
jne 0x421c63
cmp eax, 0xb2ab117a
je 0x421c72
cmp ecx, 0x257edfd0
jne 0x421c76
cmp eax, 0xb2ab117a
jne 0x421c76
mov al, 1
jmp 0x421c8a
mov eax, dword [0x537028]
mov ecx, 0x537028
push 0x2751
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x2751
movzx ecx, al
add ecx, 2
mov dword [esi + 4], 0x537028
mov dword [esi + 8], ecx
test cl, 1
je 0x421cb7
cmp ecx, 1
jne 0x421d41
cmp dword [esi], 0
jne 0x421d41
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
jne 0x421d1a
mov ecx, dword [0x537030]
mov eax, dword [0x537034]
cmp ecx, 0x257edfd1
jne 0x421cda
cmp eax, 0xb2ab117a
je 0x421ce9
cmp ecx, 0x257edfd0
jne 0x421ced
cmp eax, 0xb2ab117a
jne 0x421ced
mov al, 1
jmp 0x421d01
mov eax, dword [0x537028]
mov ecx, 0x537028
push 0x2719
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x2719
movzx eax, al
mov dword [esi + 4], 0x537028
add eax, 2
pop edi
mov dword [esi + 8], eax
pop esi
ret
push 0
push 0
push 0x7010
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
setne al
movzx eax, al
push eax
push esi
call fcn.00424970
add esp, 8
pop edi
pop esi
ret
Function at 0x421d50
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x421dbe
mov ecx, dword [0x537030]
mov eax, dword [0x537034]
cmp ecx, 0x257edfd1
jne 0x421d76
cmp eax, 0xb2ab117a
je 0x421d85
cmp ecx, 0x257edfd0
jne 0x421d89
cmp eax, 0xb2ab117a
jne 0x421d89
mov al, 1
jmp 0x421d9d
mov eax, dword [0x537028]
mov ecx, 0x537028
push 0x2719
mov eax, dword [eax + 0x18]
call eax
mov ecx, dword [esp + 0x1c]
movzx eax, al
add eax, 2
mov dword [ecx], 0x2719
mov dword [ecx + 4], 0x537028
mov dword [ecx + 8], eax
or eax, 0xffffffff
add esp, 0xc
ret
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov esi, eax
test esi, esi
jne 0x421de7
mov ecx, dword [esp + 0x20]
xorps xmm0, xmm0
pop esi
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
add esp, 0xc
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x537028
push eax
lea ecx, [esp + 0xc]
call fcn.00402f30
mov ecx, dword [esp + 0x20]
movq xmm0, qword [eax]
movq qword [ecx], xmm0
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x425040
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x28
push ebx
push edi
push 0
push 0
lea eax, [esp + 0x13]
mov byte [esp + 0x13], 0
push 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 1
push eax
push dword [ecx + 4]
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_WSASend]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x537028
push eax
lea ecx, [esp + 0x2c]
call fcn.00402f30
mov ebx, 0x1ffff7
movq xmm0, qword [eax]
mov edi, dword [eax + 8]
movq qword [esp + 0x18], xmm0
mov ecx, dword [esp + 0x18]
cmp edi, 1
je 0x4250b1
mov eax, ecx
jmp 0x4250c1
mov eax, dword [esp + 0x1c]
xor edx, edx
div ebx
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x40
jne 0x425107
mov ecx, dword [0x537030]
mov eax, dword [0x537034]
cmp ecx, 0x257edfd1
jne 0x4250e0
cmp eax, 0xb2ab117a
je 0x42515f
cmp ecx, 0x257edfd0
jne 0x4250ef
cmp eax, 0xb2ab117a
je 0x42515f
mov eax, dword [0x537028]
mov ecx, 0x537028
push 0x2746
call dword [eax + 0x18]
pop edi
pop ebx
add esp, 0x28
ret
cmp edi, 1
jne 0x42511c
mov eax, dword [esp + 0x1c]
xor edx, edx
div ebx
imul eax, edx, 0x3e8
add ecx, eax
cmp ecx, 0x4d2
jne 0x42515f
mov ecx, dword [0x537030]
mov eax, dword [0x537034]
cmp ecx, 0x257edfd1
jne 0x42513e
cmp eax, 0xb2ab117a
je 0x42515f
cmp ecx, 0x257edfd0
jne 0x42514d
cmp eax, 0xb2ab117a
je 0x42515f
mov eax, dword [0x537028]
mov ecx, 0x537028
push 0x274d
call dword [eax + 0x18]
pop edi
pop ebx
add esp, 0x28
ret
Function at 0x425170
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x4251de
mov ecx, dword [0x537030]
mov eax, dword [0x537034]
cmp ecx, 0x257edfd1
jne 0x425196
cmp eax, 0xb2ab117a
je 0x4251a5
cmp ecx, 0x257edfd0
jne 0x4251a9
cmp eax, 0xb2ab117a
jne 0x4251a9
mov al, 1
jmp 0x4251bd
mov eax, dword [0x537028]
mov ecx, 0x537028
push 0x2719
mov eax, dword [eax + 0x18]
call eax
mov ecx, dword [esp + 0x20]
movzx eax, al
add eax, 2
mov dword [ecx], 0x2719
mov dword [ecx + 4], 0x537028
mov dword [ecx + 8], eax
or eax, 0xffffffff
add esp, 0xc
ret
push esi
mov esi, dword [esp + 0x20]
push edi
push esi
push dword [esp + 0x24]
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edi, eax
test edi, edi
js 0x425235
cmp dword [esp + 0x20], 0x8004667e
xorps xmm0, xmm0
mov ecx, dword [esp + 0x28]
movq qword [ecx], xmm0
mov dword [ecx + 8], 0
jne 0x42525c
cmp dword [esi], 0
mov ecx, dword [esp + 0x1c]
mov al, byte [ecx]
je 0x425229
or al, 1
mov byte [ecx], al
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret
and al, 0xfc
mov byte [ecx], al
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x537028
push eax
lea ecx, [esp + 0x10]
call fcn.00402f30
mov ecx, dword [esp + 0x28]
movq xmm0, qword [eax]
movq qword [ecx], xmm0
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret

Function at 0x4252c0
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0
mov eax, dword [esi + 8]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, 0x53b390
lock xadd dword [ecx], eax
mov ecx, dword [esi + 4]
push 0
push ecx
test eax, eax
je 0x42530e
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
add esp, 8
ret
push sym.ClientofCSP.exe_public_virtual:_void___thiscall_DuiLib::CTreeViewUI::Notify_struct_DuiLib::tagTNotifyUI__
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
add esp, 8
ret
Function at 0x428f30
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x2c]
push 0
push 0
push dword [esp + 0x30]
mov dword [esp + 0x38], 0
push eax
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
call dword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x537028
push eax
lea ecx, [esp + 0x14]
call fcn.00402f30
mov ebp, 0x1ffff7
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
cmp eax, 1
je 0x428f96
mov eax, dword [esi]
mov ecx, eax
jmp 0x428fa7
mov eax, dword [esi + 4]
xor edx, edx
div ebp
mov ecx, dword [esi]
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x40
jne 0x428ffe
mov ecx, dword [0x537030]
mov eax, dword [0x537034]
cmp ecx, 0x257edfd1
jne 0x428fc6
cmp eax, 0xb2ab117a
je 0x428fd5
cmp ecx, 0x257edfd0
jne 0x428fe2
cmp eax, 0xb2ab117a
jne 0x428fe2
mov al, 1
mov dword [esi], 0x2746
jmp 0x429062
mov eax, dword [0x537028]
mov ecx, 0x537028
push 0x2746
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x2746
jmp 0x429062
cmp dword [esi + 8], 1
jne 0x429013
mov eax, dword [esi + 4]
xor edx, edx
div ebp
imul eax, edx, 0x3e8
add ecx, eax
cmp ecx, 0x4d2
jne 0x429072
mov ecx, dword [0x537030]
mov eax, dword [0x537034]
cmp ecx, 0x257edfd1
jne 0x429035
cmp eax, 0xb2ab117a
je 0x429044
cmp ecx, 0x257edfd0
jne 0x429048
cmp eax, 0xb2ab117a
jne 0x429048
mov al, 1
jmp 0x42905c
mov eax, dword [0x537028]
mov ecx, 0x537028
push 0x274d
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x274d
movzx eax, al
add eax, 2
mov dword [esi + 4], 0x537028
mov dword [esi + 8], eax
test ebx, ebx
je 0x429080
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x2c]
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi + 8], 0
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x429670
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
push 1
push 0
push 0
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4296cd
cmp dword [esp + 0x18], 0x17
xorps xmm0, xmm0
mov ecx, dword [esp + 0x24]
movq qword [ecx], xmm0
mov dword [ecx + 8], 0
jne 0x4296c6
push 4
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, esi
pop esi
add esp, 0x10
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x537028
push eax
lea ecx, [esp + 0x10]
call fcn.00402f30
mov ecx, dword [esp + 0x24]
pop esi
movq xmm0, qword [eax]
movq qword [ecx], xmm0
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
or eax, 0xffffffff
add esp, 0x10
ret
Function at 0x42af00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e5f15
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x537700]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 8]
test al, 1
je 0x42af8f
cmp eax, 1
jne 0x42af3e
cmp dword [esi], 0
je 0x42af8f
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.0042c720
movq xmm0, qword [esi]
mov eax, dword [esi + 8]
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x24], eax
push 0
lea eax, [ebp - 0x64]
mov dword [ebp - 4], 0
push eax
mov eax, dword [edi]
add eax, 0x44
push eax
call fcn.0042c0c0
add esp, 0xc
lea ecx, [ebp - 0x64]
call fcn.0042d370
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], edi
mov ecx, dword [eax]
lea ebx, [eax + 4]
mov dword [ebp - 0x10], ecx
lea ecx, [eax + 0x44]
mov eax, dword fs:[0x2c]
mov dword [ebp + 0x10], ecx
mov ecx, dword [0x53c078]
mov esi, dword [eax + ecx*4]
cmp byte [esi + 0xc], 0
jne 0x42afc2
call fcn.004b89f4
mov eax, dword [esi + 4]
test eax, eax
je 0x42afd1
mov eax, dword [eax + 4]
jmp 0x42afd3
xor eax, eax
push 8
push 0x98
push eax
push dword [ebp + 8]
call fcn.0040ac00
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x18], esi
mov ecx, dword [ebx]
xorps xmm0, xmm0
mov dword [esi + 0x38], ecx
lea ecx, [esi + 0x40]
movq qword [esi + 0x20], xmm0
push edi
mov dword [ebp - 4], 1
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x4318e0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0x423f50
mov byte [esi + 0x3c], 0
call fcn.0042c720
push dword [ebp + 0x10]
lea ecx, [esi + 0x78]
push 0
push 0
call fcn.0040e9b0
mov eax, dword [ebp + 0xc]
mov edx, 0x1c
push esi
push esi
mov ecx, 0x10
mov dword [ebp - 0x14], esi
cmp word [eax], 2
cmovne ecx, edx
push ecx
mov ecx, dword [ebp - 0x10]
push eax
push 1
push dword [ebx + 0x1c]
add ecx, 0x14
push ebx
call fcn.00429770
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 2
call fcn.004327d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc