joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d830
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x120], 1
cmp eax, 0xffffffff
jne 0x49d85d
xor eax, eax
jmp 0x49d86a
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x120]
push eax
inc ecx
push ecx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x49d897
push 0x637c4c
lea ecx, [ebp + 0x18]
push ecx
mov dword [ebp + 0x18], 0xff67697e
call sub.msvcrt.dll__CxxThrowException
jns 0x49d8b0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x637c4c
lea edx, [ebp + 0x18]
push edx
mov dword [ebp + 0x18], eax
call sub.msvcrt.dll__CxxThrowException
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebx]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [edi + 4]
push 0
push edx
push eax
push ecx
mov dword [ebp - 4], 0x10
call dword [sym.imp.WS2_32.dll_recvfrom]
mov esi, eax
test esi, esi
jne 0x49d8f0
push 0x637c4c
lea edx, [ebp + 0x18]
push edx
mov dword [ebp + 0x18], 0xff67697e
call sub.msvcrt.dll__CxxThrowException
jns 0x49d909
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 0x18], eax
push 0x637c4c
lea eax, [ebp + 0x18]
push eax
call sub.msvcrt.dll__CxxThrowException
call fcn.004574b0
sub eax, dword [edi + 8]
mov ecx, dword [ebp - 0x18]
mov dword [edi + 0xc], eax
push ecx
mov dword [ebx], esi
call dword [sym.imp.WS2_32.dll_ntohl]
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x1a]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
mov word [ecx], ax
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x49d9c0
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 2
mov esi, ecx
push 2
mov dword [esi], vtable.CUDPSocket.0
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x49d9f6
push 0x637c4c
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
xor ecx, ecx
mov dword [esi + 0x10], 0
mov word [esi + 0x14], cx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x49dc70
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x49dc9a
mov edx, dword [eax]
push esi
push 0
push ecx
mov ecx, dword [eax + 0x10]
lea esi, [eax + 0x10]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x49dc99
mov ecx, esi
mov edx, eax
pop esi
jmp fcn.0049dae0
pop esi
ret

Function at 0x49dca0
Capabilities:
Send data
Send data on socket

Disassembly:
cmp dword [ebx + 0x18], 0
push edi
mov edi, eax
mov ecx, esi
jne 0x49dcc1
mov eax, dword [ebx]
push 0
push edi
push esi
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x49dcd1
lea ecx, [eax + esi]
sub edi, eax
test edi, edi
je 0x49dcd1
push ecx
lea eax, [ebx + 0x10]
call fcn.0049dab0
add esp, 4
pop edi
ret
Function at 0x49f710
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e299b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 4]
push esi
push edi
mov dword [ebp - 0x10], esp
push 0
sub ecx, eax
push ecx
add edx, eax
mov eax, dword [ebx]
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x49f837
mov ecx, dword [ebx + 4]
add dword [ebx + 0xc], eax
mov byte [eax + ecx], 0
cmp dword [ebx + 0xc], 8
jb 0x49f840
mov edx, dword [ebx + 4]
mov eax, dword [edx + 4]
lea esi, [ebx + 4]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
lea edi, [eax + 8]
cmp dword [ebx + 0xc], edi
jae 0x49f7a9
cmp edi, 0x10000
ja 0x49f837
mov ebx, edi
call fcn.0049da80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x128], eax
mov ecx, dword [esi]
mov dword [ebp - 4], eax
mov dword [ebp - 0x11c], eax
mov al, 1
lea edx, [edi - 8]
mov byte [ebp - 0x14], al
mov byte [ebp - 4], al
lea eax, [ebp - 0x128]
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x120], edx
call fcn.0049f5b0
mov edx, edi
mov ecx, esi
call fcn.0049dae0
jmp 0x49f804
mov eax, dword [ebp - 0x124]
lea ecx, [ebp - 0x114]
mov dword [ebp - 4], 0xffffffff
cmp eax, ecx
je 0x49f763
cmp byte [ebp - 0x14], 0
jne 0x49f763
push eax
call fcn.0040107c
add esp, 4
jmp 0x49f763
push ebx
call fcn.0049ef80
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49fbf0
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp byte [0x6f1b1e], 0
je 0x49fc05
mov al, 1
mov esp, ebp
pop ebp
ret
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x6f1b20], eax
mov eax, dword [0x6f1b20]
cmp eax, 0xffffffff
je 0x49fcbf
call fcn.00459660
push eax
mov dword [0x6f1b24], eax
call fcn.004596a0
mov ecx, dword [0x6f1b20]
push ecx
call fcn.004a3eb0
mov edx, dword [0x6f1b20]
push edx
call fcn.004a3e80
add esp, 0xc
mov eax, 2
push 0x7f000001
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htonl]
push 0
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [0x6f1b20]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edx
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
js 0x49fcbf
mov edx, dword [0x6f1b20]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
push ecx
push edx
mov dword [ebp - 4], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x49fcc5
mov eax, dword [0x6f1b20]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x6f1b20], 0xffffffff
xor al, al
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x12]
push esi
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov edx, dword [ebp + 8]
mov word [0x6f1b1c], ax
mov dword [0x6f1b28], edx
xor esi, esi
push 0x100
call fcn.00459630
mov byte [esi + 0x6f1b0c], al
inc esi
add esp, 4
cmp esi, 0x10
jb 0x49fce1
mov eax, dword [0x6f1b20]
push 0x32
push eax
call dword [sym.imp.WS2_32.dll_listen]
call fcn.0049fb10
mov ecx, dword [0x6f1b24]
push ecx
call fcn.004596c0
add esp, 4
push 0
push 4
push 0
push 0
push 0
push 0x49fb00
call sub.MFC42.dll_AfxBeginThread
mov esi, eax
test esi, esi
jne 0x49fd3d
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
push 0
push 0x6f1b08
call edi
mov edx, dword [esi + 0x2c]
push eax
push edx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
mov byte [0x6f1b1e], 1
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a0760
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x4a079f
test esi, esi
je 0x4a079f
push esi
call fcn.004a3eb0
push esi
call fcn.004a3e80
push 0x80000
push esi
call fcn.004a3dc0
push 0x20000
push esi
call fcn.004a3de0
add esp, 0x18
mov eax, esi
pop esi
ret

Function at 0x4a07b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
push edi
mov edi, ecx
test esi, esi
je 0x4a07d8
mov ebx, dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebp + 8]
push 0
push esi
push edi
push eax
call ebx
test eax, eax
js 0x4a07df
add edi, eax
sub esi, eax
jne 0x4a07c4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 7
pop ebx
pop ebp
ret
Function at 0x4a0b00
Capabilities:
Check mutex on windows

Disassembly:
cmp byte [0x6f1c89], 0
jne 0x4a0b34
push 0
push 0
push 0
mov byte [0x6f1c89], 1
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push 0
push 0
push 0
mov dword [0x6f1ca8], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x6f1ca4], eax
mov eax, dword [0x6f1ca8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret

Function at 0x4a0c20
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
mov esi, dword [edi + 4]
mov ebx, ecx
inc esi
xor ecx, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x114], ecx
test ebx, ebx
jne 0x4a0c59
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x114]
mov esi, dword [ebp - 0x10]
xor eax, eax
test ecx, ecx
je 0x4a0c77
nop
mov ecx, dword [edi + 4]
cmp dword [ebp + eax*4 - 0x110], ecx
mov ecx, dword [ebp - 0x114]
je 0x4a0c77
inc eax
cmp eax, ecx
jb 0x4a0c60
cmp eax, ecx
jne 0x4a0c90
cmp ecx, 0x40
jae 0x4a0c90
mov edx, dword [edi + 4]
mov dword [ebp + eax*4 - 0x110], edx
inc dword [ebp - 0x114]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
call fcn.004a0ba0
cmp dword [ebp - 0x114], 0
jne 0x4a0cd3
mov eax, 0x10624dd3
imul dword [ebp - 8]
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x3e8
add ecx, edx
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
jmp 0x4a0ceb
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea ecx, [ebp - 0x114]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
call fcn.004a0b00
mov dl, byte [edi]
test dl, dl
jne 0x4a0c43
test esi, esi
jle 0x4a0d3c
mov eax, dword [edi + 4]
push eax
call fcn.004a3ee0
add esp, 4
test eax, eax
jne 0x4a0d3c
mov edx, dword [edi + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.004a07f0
mov cl, byte [edi]
test cl, cl
jne 0x4a0c43
test eax, eax
js 0x4a0d3c
add dword [ebp - 4], eax
sub ebx, eax
jne 0x4a0c50
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 7
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a2660
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push str.NetLink_socket
push 0x610c7c
call fcn.0051fa00
push str.nl_st_n
call fcn.005152d0
mov al, byte [esi]
add esp, 0xc
test al, al
jne 0x4a28e0
push ebx
push edi
call fcn.004a0b00
mov cl, byte [esi]
test cl, cl
jne 0x4a2857
push str.nl_st:c0_n
call fcn.005152d0
add esp, 4
mov byte [ebp - 4], 0
call fcn.004574b0
mov ebx, eax
call fcn.004a0760
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x4a2866
test eax, eax
je 0x4a2866
mov edx, dword [ebp - 4]
push edx
mov ecx, esi
call fcn.004a1c60
mov edi, eax
add esp, 4
test edi, edi
je 0x4a2712
call fcn.004574b0
lea ecx, [ebx + 0x2710]
cmp eax, ecx
ja 0x4a28b1
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov byte [ebp - 4], 1
jmp 0x4a26b8
mov al, byte [esi]
test al, al
jne 0x4a2874
push str.nl_st:c1_n
call fcn.005152d0
push 0
push 1
call fcn.004a17a0
mov ebx, dword [esi + 4]
add esp, 0xc
inc ebx
mov dword [ebp - 0x108], 0
call fcn.004a0b50
mov cl, byte [esi]
test cl, cl
jne 0x4a2883
cmp dword [0x6f1ee4], 0
jne 0x4a280e
mov ecx, dword [ebp - 0x108]
xor eax, eax
test ecx, ecx
je 0x4a2787
jmp 0x4a2770
mov edx, dword [esi + 4]
mov ecx, dword [ebp - 0x108]
cmp dword [ebp + eax*4 - 0x104], edx
je 0x4a2787
inc eax
cmp eax, ecx
jb 0x4a2770
cmp eax, ecx
jne 0x4a27a0
cmp ecx, 0x40
jae 0x4a27a0
mov ecx, dword [esi + 4]
mov dword [ebp + eax*4 - 0x104], ecx
inc dword [ebp - 0x108]
call fcn.004a0ba0
cmp dword [ebp - 0x108], 0
jne 0x4a27bd
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
jmp 0x4a27d3
push 0
push 0
push 0
lea edx, [ebp - 0x108]
push edx
push ebx
call dword [sym.imp.WS2_32.dll_select]
mov edi, eax
call fcn.004a0b00
mov al, byte [esi]
test al, al
jne 0x4a2892
test edi, edi
jle 0x4a28a1
mov ecx, dword [esi + 4]
push ecx
call fcn.004a3ee0
add esp, 4
test eax, eax
jne 0x4a28a1
push eax
push 2
call fcn.004a17a0
add esp, 8
jmp 0x4a2740
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [0x6f1ee4]
mov cl, byte [0x6f1c8a]
mov dword [esi + 4], 0xffffffff
mov dword [0x6f1eec], eax
mov dword [0x6f1ee4], 0
mov byte [0x6f1c8b], cl
mov byte [0x6f1c8a], 0
mov byte [0x6f1ef4], 0
mov dl, byte [esi]
test dl, dl
je 0x4a26a0
push str.nl_st:cn1_n
call fcn.005152d0
add esp, 4
jmp 0x4a28c6
push str.nl_st:sc_n
call fcn.005152d0
push 4
jmp 0x4a28bc
push str.nl_st:cn2_n
call fcn.005152d0
add esp, 4
jmp 0x4a28c6
push str.nl_st:cn3_n
call fcn.005152d0
add esp, 4
jmp 0x4a28c6
push str.nl_st:cn4_n
call fcn.005152d0
add esp, 4
jmp 0x4a28c6
push str.nl_st:se_n
call fcn.005152d0
push 7
push 2
jmp 0x4a28be
push str.nl_st:ctt_n
call fcn.005152d0
push edi
push 1
call fcn.004a17a0
add esp, 0xc
mov eax, dword [0x6f1ee0]
pop edi
pop ebx
cmp eax, esi
jne 0x4a28db
mov dword [0x6f1ee0], 0
call fcn.004a0ba0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x4a28f6
test eax, eax
je 0x4a28f6
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
push esi
call fcn.0040106c
push str.nl_st__n
call fcn.005152d0
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x4a2c90
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, eax
test eax, eax
jle 0x4a2cc7
mov ebx, dword [ebp + 8]
push 0
push esi
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x4a2cc4
sub esi, eax
add edi, eax
test esi, esi
jg 0x4a2ca5
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
ret
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4a3450
Capabilities:
Connect socket
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov eax, 2
mov edi, 1
sub dword [ebp + 0x18], edi
push ecx
mov word [ebp - 0x20], ax
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [ebp + 8]
push edx
mov word [ebp - 0x1e], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
xor ebx, ebx
push ebx
push edi
push 2
mov dword [ebp - 0x1c], eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
push esi
call fcn.004a2cd0
add esp, 4
push 0x10
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
lea ecx, [ebp - 0x10]
push ecx
push ebx
lea edx, [ebp - 0x124]
push edx
lea eax, [esi + 1]
push ebx
push eax
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x124], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, ebx
je 0x4a3612
jle 0x4a3612
mov edx, dword [ebp + 0x10]
mov eax, edx
lea edi, [eax + 1]
jmp 0x4a34f0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4a34f0
sub eax, edi
push eax
push edx
push esi
call fcn.004a2c90
add esp, 0xc
test eax, eax
je 0x4a3612
mov edi, dword [ebp + 0x14]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], 0xffffffff
lea esp, [esp]
lea eax, [ebp - 0x10]
push eax
push 0
push 0
lea ecx, [ebp - 0x124]
push ecx
lea eax, [esi + 1]
push eax
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x124], 1
mov dword [ebp - 0x10], 0x2d
mov dword [ebp - 0xc], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x4a360a
jle 0x4a3612
mov edx, dword [ebp + 0x18]
push 0
sub edx, ebx
push edx
lea eax, [ebx + edi]
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x4a35f3
js 0x4a3612
add ebx, eax
cmp ebx, dword [ebp + 0x18]
je 0x4a3612
cmp dword [ebp - 8], 0
jne 0x4a35db
push str._r_n_r_n
lea ecx, [ebx + edi]
push ecx
push edi
call fcn.004a2e50
add esp, 0xc
test eax, eax
je 0x4a35db
mov ecx, eax
push str._nContent_Length:
sub ecx, edi
push eax
add ecx, 4
push edi
mov dword [ebp - 8], ecx
call fcn.004a2e50
add esp, 0xc
test eax, eax
je 0x4a35db
add eax, 0x10
cmp byte [eax], 0x20
jne 0x4a35cf
inc eax
push eax
call sym.GameRanger.exe_unsigned_int___cdecl_str_u_char_const__
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x4a3520
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
cmp ebx, edx
jne 0x4a3520
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov byte [ebx + edi], 0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x4a3612
mov byte [ebx + edi], 0
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a3c00
Capabilities:
Resume thread

Disassembly:
push 0
push 4
push 0
push 0
push 0
push 0x4a3bb0
call sub.MFC42.dll_AfxBeginThread
mov eax, dword [eax + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret
cmp byte [0x6f201c], 0
jne 0x4a3c15
mov byte [0x6f201c], 1
jmp 0x4a3be0
ret
Function at 0x4a3d20
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push esi
push 0xffff
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
mov eax, dword [ebp - 4]
cmp eax, 0x2000
jg 0x4a3d5b
mov eax, 0x2000
cmp eax, ebx
jae 0x4a3daf
push 4
lea edx, [ebp - 8]
push edx
push esi
push 0xffff
push edi
mov dword [ebp - 8], ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push esi
push 0xffff
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
mov eax, dword [ebp - 4]
cmp eax, 0x2000
jg 0x4a3da7
mov eax, 0x2000
cmp eax, ebx
jae 0x4a3daf
shr ebx, 1
jmp 0x4a3d5f
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a3fc0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
push ecx
push edx
mov dword [ebp - 4], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x4a3ff9
cmp word [ebp - 0x14], 2
jne 0x4a3ff9
mov eax, dword [ebp - 0x12]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4a40d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx ecx, word [0x6f664c]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_htons]
push esi
push edi
mov eax, 2
push ecx
mov word [ebp - 0x1c], ax
call ebx
mov esi, dword [ebp + 8]
cmp byte [esi], 2
mov edi, dword [sym.imp.WS2_32.dll_htonl]
mov word [ebp - 0x1a], ax
jne 0x4a410d
mov edx, dword [0x6f6710]
push edx
jmp 0x4a4113
mov eax, dword [0x6f6714]
push eax
call edi
mov edx, dword [0x6f5e00]
mov cl, byte [esi]
push edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 0xc], cl
call edi
mov dword [ebp - 0xb], eax
mov eax, dword [0x6f5dfc]
push eax
call edi
movzx ecx, word [esi + 2]
push ecx
mov dword [ebp - 7], eax
call ebx
mov ecx, dword [esi + 4]
push 0x10
lea edx, [ebp - 0x1c]
push edx
push 0
mov word [ebp - 3], ax
push 0xb
lea eax, [ebp - 0xc]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
inc byte [esi + 1]
call fcn.004574b0
pop edi
pop esi
mov dword [0x6f25c4], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a4940
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
push esi
mov byte [ebp - 1], 0
call fcn.004a47b0
movzx edi, word [esi + 0x5b9c]
add esp, 8
xor bl, bl
movzx eax, bl
imul eax, eax, 0x5b8
cmp byte [eax + esi + 0x5ba0], 0
lea eax, [eax + esi + 0x5ba0]
jne 0x4a49a4
movzx edx, word [eax + 2]
push 0
push edx
add eax, 0xe
push eax
mov eax, dword [esi]
movzx ecx, di
push eax
mov dword [ebp - 8], ecx
call dword [sym.imp.WS2_32.dll_send]
inc bl
inc edi
mov byte [ebp - 1], 1
cmp bl, 0x10
jb 0x4a4964
test bl, bl
je 0x4a4a06
mov al, 0x10
sub al, bl
movzx edi, al
movzx ecx, bl
imul edi, edi, 0x5b8
imul ecx, ecx, 0x5b8
push edi
lea edx, [ecx + esi + 0x5ba0]
mov byte [ebp + 0xb], al
push edx
lea eax, [esi + 0x5ba0]
push eax
call dword [sym.imp.msvcrt.dll_memmove]
mov cl, byte [ebp + 0xb]
add esp, 0xc
cmp cl, 0x10
jae 0x4a49fb
mov dl, 0x10
sub dl, cl
lea eax, [edi + esi + 0x5ba0]
movzx ecx, dl
mov byte [eax], 1
add eax, 0x5b8
dec ecx
jne 0x4a49f0
mov eax, dword [ebp - 8]
inc eax
mov word [esi + 0x5b9c], ax
push 1
push esi
call fcn.004a47b0
mov al, byte [ebp - 1]
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a4bc0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
mov eax, 2
push ecx
mov word [ebp - 0x10], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov edx, dword [ebp + 0xc]
push edx
mov dword [ebp - 0xc], eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push 0x10
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x69fb40]
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
mov esp, ebp
pop ebp
ret

Function at 0x4a4c70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [0x6f671c]
mov eax, 2
push ecx
mov word [ebp - 0x10], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov edx, dword [ebp + 0xc]
push edx
mov dword [ebp - 0xc], eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push 0x10
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
mov esp, ebp
pop ebp
ret
Function at 0x4a5440
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
je 0x4a5523
cmp esi, 0xffffffff
je 0x4a5523
xor eax, eax
push ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, 2
push edi
mov word [ebp - 0x10], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov ebx, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea ecx, [ebp - 0x10]
push ecx
push esi
mov word [ebp - 0xe], ax
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x4a5504
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4a54f0
push esi
call fcn.004a3fc0
add esp, 4
mov word [edi], ax
test ax, ax
jne 0x4a54d0
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or esi, 0xffffffff
movzx edx, word [edi]
mov eax, dword [ebp - 0xc]
push 0
push edx
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.0045c890
add esp, 0x10
push 0
push esi
call fcn.004a4e90
add esp, 8
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push ebx
lea edx, [ebp - 0x110]
push edi
push edx
call fcn.0045c890
add esp, 0x10
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
or eax, 0xffffffff
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a5530
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
je 0x4a55fd
cmp esi, 0xffffffff
je 0x4a55fd
mov ecx, dword [0x6f671c]
xor eax, eax
mov dword [ebp - 0x10], eax
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, 2
push ecx
mov word [ebp - 0x10], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
test di, di
je 0x4a559d
push esi
call fcn.004a4ec0
add esp, 4
push ebx
push 0x10
lea edx, [ebp - 0x10]
push edx
push esi
call dword [sym.imp.WS2_32.dll_bind]
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
je 0x4a55bb
push esi
call ebx
or esi, 0xffffffff
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4a55f9
push esi
call fcn.004a3fc0
add esp, 4
mov word [edi], ax
test ax, ax
jne 0x4a55d9
push esi
call ebx
or esi, 0xffffffff
movzx eax, word [edi]
mov ecx, dword [ebp - 0xc]
push 0
push eax
push ecx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
lea edx, [ebp - 0x110]
push edx
call fcn.0045c890
add esp, 0x10
pop ebx
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret