joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c6d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
test edx, edx
jle 0x43c6eb
mov ecx, dword [esp + 4]
mov edi, edi
xor byte [eax + ecx], 0x5a
add eax, 1
cmp eax, edx
jl 0x43c6e0
ret

Function at 0x43d790
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x483e02
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4aeda0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea edi, [esi + 8]
mov ecx, edi
call fcn.0043c920
lea ebp, [esi + 0xc]
mov ecx, ebp
mov dword [esp + 0x20], 0
call fcn.0043c920
lea ebx, [esi + 0x14]
mov ecx, ebx
mov byte [esp + 0x20], 1
call fcn.0043c920
lea ecx, [esi + 0x18]
mov byte [esp + 0x20], 2
call fcn.0043c920
lea ecx, [esi + 0x1c]
mov byte [esp + 0x20], 3
call fcn.0043c920
lea ecx, [esi + 0x20]
mov byte [esp + 0x20], 4
call fcn.0043c920
push 0x49b9c7
mov ecx, edi
mov byte [esp + 0x24], 5
call fcn.0043cfe0
push 0x49b9c7
mov ecx, ebp
call fcn.0043cfe0
push 0x49b9c7
mov ecx, ebx
call fcn.0043cfe0
push 0x49b9c7
lea ecx, [esi + 0x18]
call fcn.0043cfe0
push 0x49b9c7
lea ecx, [esi + 0x1c]
call fcn.0043cfe0
mov eax, 1
xor ebx, ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov eax, 0x4ae220
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x43d870
sub eax, ecx
lea edi, [eax + 1]
push edi
call fcn.0045077b
add esp, 4
cmp eax, ebx
mov dword [esi], eax
je 0x43d8c9
lea ecx, [edi - 1]
push ecx
push 0x4ae220
push eax
call fcn.00455980
mov edx, dword [esi]
push 9
mov byte [edx + edi - 1], bl
call fcn.0045077b
add esp, 0x10
cmp eax, ebx
mov dword [esi + 4], eax
je 0x43d8c9
push 8
push str.aucache_
push eax
call fcn.00455980
mov eax, dword [esi + 4]
add esp, 0xc
mov byte [eax + 8], bl
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x43f810
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
xor edx, edx
push esi
mov dword [esp + 0x10], edx
mov al, 1
push edi
nop
mov byte [ecx + edx + 0x204], al
movzx esi, al
mov byte [esi + ecx + 0x304], dl
mov dl, al
and dl, 0x80
neg dl
sbb dl, dl
mov bl, al
add bl, bl
and edx, 0x1b
xor dl, bl
xor al, dl
mov edx, dword [esp + 0x14]
add edx, 1
cmp edx, 0x100
mov dword [esp + 0x14], edx
jb 0x43f820
mov byte [ecx + 0x305], 0
mov al, 1
lea esi, [ecx + 0x604]
mov edi, 0xa
lea esp, [esp]
movzx edx, al
mov dword [esi], edx
mov dl, al
and dl, 0x80
neg dl
sbb dl, dl
add al, al
add esi, 4
and edx, 0x1b
xor al, dl
sub edi, 1
jne 0x43f870
xor ebx, ebx
nop
test ebx, ebx
je 0x43f8ac
movzx eax, byte [ebx + ecx + 0x304]
mov edx, ecx
sub edx, eax
mov al, byte [edx + 0x303]
mov byte [esp + 0x10], al
jmp 0x43f8b5
mov byte [esp + 0x10], 0
mov al, byte [esp + 0x10]
mov dl, al
rol dl, 2
rol al, 1
xor dl, al
mov al, dl
rol al, 2
xor al, dl
xor al, byte [esp + 0x10]
xor al, 0x63
mov byte [ecx + ebx + 0x404], al
movzx eax, al
mov byte [eax + ecx + 0x504], bl
add ebx, 1
cmp ebx, 0x100
jb 0x43f890
lea ebp, [ecx + 0x504]
mov dword [esp + 0x14], ebp
lea esi, [ecx + 0xa2c]
mov dword [esp + 0x20], 0x100
jmp 0x43f905
mov ebp, dword [esp + 0x14]
mov bl, byte [ebp - 0x100]
test bl, bl
mov byte [esp + 0x10], bl
je 0x43f927
mov edx, dword [esp + 0x10]
push edx
mov al, 2
call fcn.0043f7e0
add esp, 4
movzx edi, al
jmp 0x43f929
xor edi, edi
test bl, bl
je 0x43f941
mov eax, dword [esp + 0x10]
push eax
mov al, 3
call fcn.0043f7e0
add esp, 4
movzx eax, al
jmp 0x43f943
xor eax, eax
shl eax, 8
movzx edx, bl
or eax, edx
shl eax, 8
or eax, edx
shl eax, 8
or eax, edi
mov edx, eax
rol edx, 8
mov dword [esi], edx
mov edx, eax
rol edx, 0x10
mov dword [esi - 0x400], eax
rol eax, 0x18
mov dword [esi + 0x400], edx
mov dword [esi + 0x800], eax
mov bl, byte [ebp]
test bl, bl
mov byte [esp + 0x10], bl
mov ebp, dword [esp + 0x10]
je 0x43f999
push ebp
mov al, 0xe
call fcn.0043f7e0
movzx eax, al
add esp, 4
mov dword [esp + 0x1c], eax
jmp 0x43f9a1
mov dword [esp + 0x1c], 0
test bl, bl
je 0x43f9b9
push ebp
mov al, 9
call fcn.0043f7e0
movzx edx, al
add esp, 4
mov dword [esp + 0x18], edx
jmp 0x43f9c1
mov dword [esp + 0x18], 0
test bl, bl
je 0x43f9d5
push ebp
mov al, 0xd
call fcn.0043f7e0
add esp, 4
movzx edi, al
jmp 0x43f9d7
xor edi, edi
test bl, bl
je 0x43f9eb
push ebp
mov al, 0xb
call fcn.0043f7e0
add esp, 4
movzx eax, al
jmp 0x43f9ed
xor eax, eax
shl eax, 8
or eax, edi
shl eax, 8
or eax, dword [esp + 0x18]
add esi, 4
shl eax, 8
or eax, dword [esp + 0x1c]
mov edx, eax
rol edx, 8
mov dword [esi + 0xffc], edx
mov edx, eax
mov dword [esi + 0xbfc], eax
rol edx, 0x10
rol eax, 0x18
mov dword [esi + 0x17fc], eax
mov eax, 1
add dword [esp + 0x14], eax
sub dword [esp + 0x20], eax
mov dword [esi + 0x13fc], edx
jne 0x43f901
pop edi
pop esi
pop ebp
mov dword [ecx + 0x262c], eax
pop ebx
add esp, 0x14
ret
Function at 0x4414c0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 8], 0x67452301
ret

Function at 0x441650
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x1098
call fcn.004575f0
mov eax, dword [0x4aeda0]
xor eax, esp
mov dword [esp + 0x1094], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4417e2
mov eax, dword [esp + 0x14]
cmp eax, 2
jne 0x4416a3
push 0xfff
push str.security.dll
lea ecx, [esp + 0xa0]
push ecx
jmp 0x4416be
cmp eax, 1
jne 0x4417e2
push 0xfff
push str.secur32.dll
lea edx, [esp + 0xa0]
push edx
call fcn.00455980
add esp, 0xc
cmp dword [esi + 0x14], 0
mov byte [esp + 0x1097], 0
jne 0x4416ed
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x14], eax
je 0x4417e2
cmp dword [esi + 0x18], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x441708
mov ecx, dword [esi + 0x14]
push str.FreeCredentialsHandle
push ecx
call edi
mov dword [esi + 0x18], eax
cmp dword [esi + 0x1c], 0
jne 0x44171c
mov edx, dword [esi + 0x14]
push str.QuerySecurityPackageInfoA
push edx
call edi
mov dword [esi + 0x1c], eax
cmp dword [esi + 0x20], 0
jne 0x441730
mov eax, dword [esi + 0x14]
push str.AcquireCredentialsHandleA
push eax
call edi
mov dword [esi + 0x20], eax
cmp dword [esi + 0x24], 0
jne 0x441744
mov ecx, dword [esi + 0x14]
push str.FreeContextBuffer
push ecx
call edi
mov dword [esi + 0x24], eax
cmp dword [esi + 0x28], 0
jne 0x441758
mov edx, dword [esi + 0x14]
push str.InitializeSecurityContextA
push edx
call edi
mov dword [esi + 0x28], eax
cmp dword [esi + 0x2c], 0
jne 0x44176c
mov eax, dword [esi + 0x14]
push str.CompleteAuthToken
push eax
call edi
mov dword [esi + 0x2c], eax
cmp dword [esi + 0x30], 0
jne 0x441780
mov ecx, dword [esi + 0x14]
push str.EnumerateSecurityPackagesA
push ecx
call edi
mov dword [esi + 0x30], eax
cmp dword [esi + 0x34], 0
jne 0x441794
mov edx, dword [esi + 0x14]
push str.DeleteSecurityContext
push edx
call edi
mov dword [esi + 0x34], eax
cmp dword [esi + 0x18], 0
pop edi
je 0x4417d1
cmp dword [esi + 0x1c], 0
je 0x4417d1
cmp dword [esi + 0x20], 0
je 0x4417d1
cmp dword [esi + 0x28], 0
je 0x4417d1
cmp dword [esi + 0x30], 0
je 0x4417d1
cmp dword [esi + 0x34], 0
je 0x4417d1
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1094]
xor ecx, esp
call fcn.004504a7
add esp, 0x1098
ret
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x14], 0
mov ecx, dword [esp + 0x1098]
pop esi
xor ecx, esp
or eax, 0xffffffff
call fcn.004504a7
add esp, 0x1098
ret
Function at 0x441cb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4841df
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4aeda0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
push fcn.0043cdd0
push 4
push 4
lea eax, [esi + 0x44]
push eax
mov dword [esp + 0x24], 4
call fcn.004576c4
push fcn.0043cdd0
push 4
push 4
lea ecx, [esi + 0x34]
push ecx
mov byte [esp + 0x24], 3
call fcn.004576c4
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 2
call fcn.0043cdd0
lea ecx, [esi + 0x28]
mov byte [esp + 0x14], 1
call fcn.0043cdd0
lea ecx, [esi + 0x14]
mov byte [esp + 0x14], 0
call fcn.0043cb70
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.0043cb70
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x444720
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [esp + 0x28]
movzx ecx, byte [eax + 4]
mov edx, dword [eax]
mov byte [esp + 0x10], cl
movzx ecx, byte [eax + 5]
mov byte [esp + 0x11], cl
movzx ecx, byte [eax + 6]
mov al, byte [eax + 7]
mov byte [esp + 0x13], al
mov byte [esp + 0x12], cl
mov esi, dword [esp + 0x10]
mov eax, esi
shr eax, 4
xor eax, edx
and eax, 0xf0f0f0f
xor edx, eax
shl eax, 4
xor esi, eax
mov eax, edx
shr eax, 4
xor eax, esi
and eax, 0x1010101
xor esi, eax
shl eax, 4
xor edx, eax
mov eax, edx
shr eax, 9
xor eax, edx
and eax, 0x550055
mov ecx, eax
shl ecx, 9
xor ecx, eax
xor edx, ecx
mov eax, esi
shr eax, 9
xor eax, esi
and eax, 0x550055
mov ecx, eax
shl ecx, 9
xor ecx, eax
xor esi, ecx
mov eax, edx
shr eax, 0x12
xor eax, edx
and eax, 0x3333
mov ecx, eax
shl ecx, 0x12
xor ecx, eax
mov eax, esi
shr eax, 0x12
xor eax, esi
and eax, 0x3333
xor edx, ecx
mov ecx, eax
shl ecx, 0x12
xor ecx, eax
xor esi, ecx
mov eax, esi
shr eax, 0x10
xor eax, esi
and eax, 0xff
mov ecx, eax
shl ecx, 0x10
xor ecx, eax
mov eax, dword [esp + 0x2c]
xor esi, ecx
mov dword [esp + 0x14], 0x48ed90
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0x10
jmp 0x444800
mov ecx, dword [esp + 0x14]
and edx, 0xfffffff
and esi, 0xfffffff
cmp byte [ecx], 0
mov eax, edx
mov ecx, esi
je 0x444827
shl eax, 0x1a
shr edx, 2
shl ecx, 0x1a
shr esi, 2
jmp 0x444831
shl eax, 0x1b
shr edx, 1
shl ecx, 0x1b
shr esi, 1
or edx, eax
or esi, ecx
mov ecx, edx
shr ecx, 8
movzx edi, cl
mov ebx, edi
shr ebx, 5
movzx ecx, dl
mov dword [esp + 0x20], ecx
and ecx, 0xc0
or ecx, ebx
shr ecx, 2
mov eax, edx
shr eax, 0x10
movzx eax, al
mov ebp, eax
mov ebx, edx
shr ebx, 0x18
and ebx, 0xe
or ecx, ebx
mov ecx, dword [ecx*4 + 0x48f0a0]
mov ebx, eax
shr ebx, 5
and ebx, 4
and eax, 0x1d
and ebp, 0x40
or ebx, ebp
shr ebx, 1
or ebx, eax
or ecx, dword [ebx*4 + 0x48efa0]
mov eax, dword [esp + 0x20]
and eax, 0x3f
shr edi, 1
and edi, 0x3f
or ecx, dword [edi*4 + 0x48eea0]
mov dword [esp + 0x10], esi
or ecx, dword [eax*4 + 0x48eda0]
movzx ebp, byte [esp + 0x10]
mov eax, esi
shr eax, 0x10
movzx edi, al
mov dword [esp + 0x20], ebp
shr ebp, 4
mov ebx, edi
and ebx, 0xc0
and ebp, 8
or ebp, ebx
mov eax, esi
shr eax, 8
movzx eax, al
mov ebx, esi
shr ebx, 0x18
and ebx, 0xd
shr ebp, 2
or ebp, ebx
mov ebx, eax
shr ebx, 6
and eax, 0x3d
and ebx, 2
or ebx, eax
mov eax, dword [ebp*4 + 0x48f4a0]
or eax, dword [ebx*4 + 0x48f2a0]
mov ebx, dword [esp + 0x20]
and ebx, 0x3f
or eax, dword [ebx*4 + 0x48f1a0]
and edi, 0x3f
or eax, dword [edi*4 + 0x48f3a0]
movzx edi, cx
mov ebx, eax
shl ebx, 0x10
and eax, 0xffff0000
or ebx, edi
mov edi, dword [esp + 0x18]
shr ecx, 0x10
or eax, ecx
mov dword [edi + 4], eax
mov eax, 1
add dword [esp + 0x14], eax
mov dword [edi], ebx
add edi, 8
mov dword [esp + 0x18], edi
sub dword [esp + 0x1c], eax
jne 0x444800
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x444e20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x484768
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4aeda0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00449340
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
xor edi, edi
cmp ecx, edi
mov dword [esp + 0x18], edi
mov dword [esi], vtable.PR_HTTP::TmInputSocketStream.0
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edx
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
je 0x444eae
mov eax, dword [ecx]
mov edx, dword [eax + 0x3c]
call edx
mov eax, dword [esi + 0x18]
cmp eax, edi
jle 0x444eae
cmp dword [esi + 0x30], edi
jl 0x444eae
push eax
call fcn.0045077b
add esp, 4
cmp eax, edi
mov dword [esi + 0x14], eax
jne 0x444ebc
mov eax, 1
mov dword [esi + 0xc], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0xc

Function at 0x445c30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x484985
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4aeda0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
push 4
push 0x10
call fcn.0043cb40
push 4
push 0x10
lea ecx, [esi + 0x14]
mov dword [esp + 0x1c], 0
call fcn.0043cb40
lea ecx, [esi + 0x28]
mov byte [esp + 0x14], 1
call fcn.0043c920
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 2
call fcn.0043c920
push fcn.0043cdd0
push fcn.0043c920
push 4
push 4
lea eax, [esi + 0x34]
push eax
mov byte [esp + 0x28], 3
call fcn.00457727
push fcn.0043cdd0
push fcn.0043c920
push 4
push 4
lea ecx, [esi + 0x44]
push ecx
mov byte [esp + 0x28], 4
call fcn.00457727
mov edx, dword [esp + 0x1c]
push edx
mov ecx, esi
mov byte [esp + 0x18], 5
call fcn.00445350
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x445e60
Capabilities:
Resolve dns

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x1c], ecx
je 0x445f04
cmp word [ecx + 8], 2
push ebx
push ebp
push edi
jne 0x445ed5
cmp word [ecx + 0xa], 4
jne 0x445ed5
mov edi, dword [ecx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x445ed5
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov edx, dword [eax]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebx
push ebp
call fcn.00445df0
test eax, eax
mov dword [esi], eax
je 0x445ef8
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x445eb0
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x24]
push 0x400
push ecx
push 0x401
push edx
call fcn.004577cc
add esp, 0x10
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0x18
pop edi
pop ebp
pop ebx
mov eax, 8
pop esi
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x445f14.11001
jmp dword [eax*4 + 0x445f38]
mov eax, 0x2af9
pop esi
ret 0x18
mov eax, 0x2afa
pop esi
ret 0x18
mov eax, 0x2afb
pop esi
ret 0x18
Function at 0x446770
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
mov eax, dword [0x4aeda0]
xor eax, esp
mov dword [esp + 0x22c], eax
cmp dword [0x4b2220], 0
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x4461c0
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x4464b0
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.00446170
je 0x4467e2
movzx eax, word [esp + 0x234]
mov eax, dword [eax*8 + 0x4ae864]
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.004504a7
add esp, 0x230
ret 4
push 0x104
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4468df
push ebx
push ebp
push esi
push edi
lea edx, [esp + 0x134]
push edx
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.0045053a
push str.ws2_32
lea ecx, [esp + 0x38]
push 0x10c
push ecx
call fcn.00457b07
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x44685d
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x4468a4
push esi
call ebp
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x2c]
push 0x10c
push ecx
call fcn.0045053a
push str.wship6
lea edx, [esp + 0x38]
push 0x10c
push edx
call fcn.00457b07
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call edi
mov esi, eax
test esi, esi
je 0x4468db
push str.getaddrinfo
push esi
call ebx
test eax, eax
je 0x44690f
xor edi, edi
mov ecx, dword [esp + edi*8 + 0x10]
push ecx
push esi
call ebx
test eax, eax
mov dword [esp + edi*8 + 0x14], eax
je 0x44690f
add edi, 1
cmp edi, 3
jl 0x4468a6
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [0x4ae864], edx
mov dword [0x4ae86c], eax
mov dword [fcn.00446170], ecx
pop edi
pop esi
pop ebp
pop ebx
movzx edx, word [esp + 0x234]
mov ecx, dword [esp + 0x22c]
mov eax, dword [edx*8 + 0x4ae864]
xor ecx, esp
mov dword [0x4b2220], 1
call fcn.004504a7
add esp, 0x230
ret 4
push esi
call ebp
jmp 0x4468db

Function at 0x446920
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x4aeda0]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
push 0x101
mov dword [esi], vtable.PR_HTTP::TmSocket.0
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [esp + 0x194]
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 1
mov dword [esi + 4], 0xffffffff
mov eax, esi
pop esi
xor ecx, esp
call fcn.004504a7
add esp, 0x194
ret
Function at 0x4469b0
Capabilities:
Connect socket

Disassembly:
sub esp, 0x30
mov eax, dword [0x4aeda0]
xor eax, esp
mov dword [esp + 0x2c], eax
xor eax, eax
push esi
mov esi, dword [esp + 0x38]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 8], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 4], eax
mov dword [esp + 0xc], eax
mov byte [esp + 0x28], al
mov dword [esp + 0x29], eax
mov word [esp + 0x2d], ax
mov byte [esp + 0x2f], al
movzx eax, word [esp + 0x3c]
push edi
push eax
mov edi, ecx
lea ecx, [esp + 0x30]
push 0x48e18c
push ecx
mov dword [esp + 0x20], 1
call fcn.00452d03
mov eax, dword [0x4b2224]
add esp, 0xc
test eax, eax
jne 0x446a35
push eax
call fcn.00446770
mov dword [0x4b2224], eax
lea edx, [esp + 8]
push edx
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x34]
push edx
push esi
call eax
mov esi, eax
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
test esi, esi
je 0x446a70
mov dword [edi + 0xc], 0xfffffffb
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004504a7
add esp, 0x30
ret 8
mov eax, dword [esp + 8]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x18]
mov eax, dword [edi + 4]
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
mov esi, dword [esp + 8]
jne 0x446ac3
mov dword [edi + 0xc], 0xfffffff9
mov eax, dword [0x4b2228]
test eax, eax
jne 0x446aab
push 2
call fcn.00446770
mov dword [0x4b2228], eax
push esi
call eax
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004504a7
add esp, 0x30
ret 8
mov eax, dword [0x4b2228]
test eax, eax
jne 0x446ad8
push 2
call fcn.00446770
mov dword [0x4b2228], eax
push esi
call eax
mov ecx, dword [esp + 0x34]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.004504a7
add esp, 0x30
ret 8

Function at 0x446b00
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 4]
sub eax, 1
push esi
mov esi, ecx
je 0x446b9b
sub eax, 1
je 0x446b72
sub eax, 1
je 0x446b20
xor eax, eax
pop esi
ret 0x10
mov eax, dword [esi + 4]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_setsockopt]
push edi
mov edi, dword [esp + 0x1c]
push edi
push ebx
push 0x1006
push 0xffff
push eax
call ebp
test eax, eax
jne 0x446b69
mov ecx, dword [esi + 4]
push edi
push ebx
push 0x1005
push 0xffff
push ecx
call ebp
test eax, eax
jne 0x446b69
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
ret 0x10
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0x10
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
push 0x1005
mov ecx, dword [esi + 4]
push 0xffff
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
neg eax
sbb eax, eax
add eax, 1
pop esi
ret 0x10
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
push 0x1006
jmp 0x446b81
Function at 0x446bf0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x124
mov eax, dword [esp + 0x128]
push esi
push edi
mov edi, ecx
xor esi, esi
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], esi
mov dword [edi + 0xc], esi
mov dword [esp + 0x2c], esi
call fcn.00455e32
add esp, 4
cmp dword [esp + 0x134], esi
jle 0x446d36
push ebx
push ebp
mov edi, edi
cmp dword [edi + 0xc], 0
jne 0x446d34
lea edx, [esp + 0x28]
push edx
call fcn.00455e32
mov ebp, dword [esp + 0x2c]
mov ecx, dword [edi + 0x10]
mov esi, dword [esp + 0x30]
add esp, 4
mov ebx, ebp
sub ebx, dword [esp + 0x18]
mov eax, ecx
sbb esi, dword [esp + 0x1c]
cdq
cmp esi, edx
jl 0x446c75
jg 0x446c69
cmp ebx, eax
jbe 0x446c75
mov dword [edi + 0xc], 0xfffffff3
jmp 0x446d26
mov edx, dword [esp + 0x30]
xor eax, eax
test edx, edx
jbe 0x446c8f
mov esi, dword [edi + 4]
cmp dword [esp + eax*4 + 0x34], esi
je 0x446c8f
add eax, 1
cmp eax, edx
jb 0x446c82
cmp eax, edx
jne 0x446ca4
cmp edx, 0x40
jae 0x446ca4
mov edx, dword [edi + 4]
mov dword [esp + eax*4 + 0x34], edx
add dword [esp + 0x30], 1
mov edx, dword [edi + 4]
sub ecx, ebp
add ecx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
push 0
mov dword [esp + 0x28], ecx
push 0
lea ecx, [esp + 0x3c]
push ecx
add edx, 1
push edx
mov dword [esp + 0x38], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x446cde
mov dword [edi + 0xc], 0xfffffff3
jmp 0x446d26
jge 0x446ce9
mov dword [edi + 0xc], 0xfffffff5
jmp 0x446d26
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x13c]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [edi + 4]
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x446d34
jge 0x446d17
mov dword [edi + 0xc], 0xfffffff5
jmp 0x446d26
sub dword [esp + 0x13c], eax
add dword [esp + 0x10], eax
add dword [esp + 0x14], eax
cmp dword [esp + 0x13c], 0
jg 0x446c30
pop ebp
pop ebx
mov eax, dword [edi + 0xc]
test eax, eax
pop edi
pop esi
jne 0x446d43
mov eax, dword [esp + 4]
add esp, 0x124
ret 0xc