joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4095d0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x49d140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, edx
mov dword [ebp - 0x150], eax
push edi
mov edx, ecx
mov dword [ebp - 0x14c], ebx
xor edi, edi
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x164], 0x67452301
mov dword [ebp - 0x160], 0xefcdab89
mov dword [ebp - 0x15c], 0x98badcfe
mov dword [ebp - 0x158], 0x10325476
mov dword [ebp - 0x154], 0xc3d2e1f0
cmp ebx, 0x40
jb 0x4096a3
lea eax, [edi + 0x40]
cmp edi, eax
jae 0x409685
lea eax, [edx + 2]
mov ebx, 0x10
add eax, edi
lea esi, [ebp - 0x144]
add edi, 0x40
movzx edx, byte [eax - 2]
lea esi, [esi + 4]
movzx ecx, byte [eax - 1]
lea eax, [eax + 4]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 4]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 3]
shl edx, 8
or edx, ecx
mov dword [esi - 4], edx
sub ebx, 1
jne 0x409652
mov ebx, dword [ebp - 0x14c]
lea edx, [ebp - 0x144]
lea ecx, [ebp - 0x164]
call fcn.004092b0
mov edx, dword [ebp - 0x148]
lea eax, [ebx - 0x40]
cmp edi, eax
jbe 0x409638
sub ebx, edi
mov eax, 0xf
nop word [eax + eax]
mov dword [ebp + eax*4 - 0x144], 0
sub eax, 1
jns 0x4096b0
xor esi, esi
lea ecx, [esi + 3]
test ebx, ebx
je 0x4096fa
add edi, edx
nop dword [eax + eax]
mov eax, esi
lea edx, [ebp - 0x144]
shr eax, 2
lea edx, [edx + eax*4]
mov eax, esi
and eax, 3
sub ecx, eax
movzx eax, byte [edi + esi]
shl ecx, 3
inc esi
shl eax, cl
mov ecx, 3
or dword [edx], eax
cmp esi, ebx
jb 0x4096d0
mov eax, esi
lea edx, [ebp - 0x144]
shr eax, 2
and esi, 3
lea edx, [edx + eax*4]
sub ecx, esi
shl ecx, 3
mov eax, 0x80
shl eax, cl
or dword [edx], eax
cmp ebx, 0x38
jb 0x409750
lea edx, [ebp - 0x144]
lea ecx, [ebp - 0x164]
call fcn.004092b0
xorps xmm0, xmm0
movups xmmword [ebp - 0x144], xmm0
movups xmmword [ebp - 0x134], xmm0
movups xmmword [ebp - 0x124], xmm0
movups xmmword [ebp - 0x114], xmm0
nop
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x144]
shl eax, 3
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x108], eax
call fcn.004092b0
mov esi, dword [ebp - 0x150]
mov edx, 0x13
nop dword [eax + eax]
mov eax, edx
mov ecx, edx
and eax, 0xfffffffc
not ecx
and ecx, 3
shl ecx, 3
mov eax, dword [ebp + eax - 0x164]
shr eax, cl
mov byte [esi + edx], al
sub edx, 1
jns 0x409780
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00458460
mov esp, ebp
pop ebp
ret
Function at 0x40c7a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c816
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword fs:[0x2c]
mov edi, eax
mov edx, dword [ecx]
mov ecx, dword [0x4a2a0c]
cmp ecx, dword [edx + 4]
jle 0x40c806
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], esi
jne 0x40c806
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
add esp, 4
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x49dc28
test edi, edi
jne 0x40c81e
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0x48e444
lea ecx, [esp + 8]
call fcn.0040c570
int3

Function at 0x40c9d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [0x4a2a14]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40c9fa
mov ecx, dword [eax + 4]
mov edx, dword [ebp + 8]
push ecx
push dword [ebp - 4]
call fcn.0041fb60
add esp, 8
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
xor ecx, ecx
push ecx
push dword [ebp - 4]
call fcn.0041fb60
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x40ca10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [0x4a2a14]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40ca28
mov ecx, dword [eax + 4]
jmp 0x40ca2a
xor ecx, ecx
push esi
mov esi, dword [ebp + 0xc]
cmp esi, 0x3fc
ja 0x40ca4f
test ecx, ecx
je 0x40ca4f
xor eax, eax
nop dword [eax]
cmp dword [ecx + eax*4], 0
lea edx, [ecx + eax*4]
je 0x40ca5d
inc eax
cmp eax, 2
jl 0x40ca40
push dword [ebp + 8]
call fcn.00458abe
add esp, 4
pop esi
pop ebp
ret
mov ecx, dword [ebp + 8]
mov al, byte [ecx + esi]
mov byte [ecx], al
mov dword [edx], ecx
pop esi
pop ebp
ret

Function at 0x40cfa0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, 0x4a2970
lock xadd dword [ecx], eax
mov ecx, dword [esi + 4]
test eax, eax
push 0
setne al
push ecx
test al, al
je 0x40cff3
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
mov esp, ebp
pop ebp
ret
push method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_56
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d010
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
push 0
push 0
push 1
mov edi, ecx
push 0
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, dword [ebp + 8]
mov esi, eax
mov dword [ebx + 4], esi
test esi, esi
jne 0x40d0ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov dword [esp + 0x18], eax
call dword [edx]
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4a2a0c]
mov edx, dword [eax]
cmp ecx, dword [edx + 4]
jle 0x40d094
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], 0xffffffff
jne 0x40d094
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x49dc28
test eax, eax
jne 0x40d211
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
add edi, 8
mov dword [edi], eax
mov dword [ebx + 8], eax
cmp dword [edi], 0
jne 0x40d13e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov dword [esp + 0x18], eax
call dword [edx]
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4a2a0c]
mov edx, dword [eax]
cmp ecx, dword [edx + 4]
jle 0x40d126
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], 0xffffffff
jne 0x40d126
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
mov edi, dword [esp + 0x14]
add esp, 4
add edi, 8
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x49dc28
test eax, eax
jne 0x40d21f
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 0
push ebx
push 0x40d240
push dword [ebp + 0xc]
push 0
call fcn.00461131
mov ecx, dword [esp + 0x28]
add esp, 0x18
mov dword [ecx + 4], eax
test eax, eax
jne 0x40d1f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov dword [esp + 0x18], eax
call dword [edx]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40d18e
push esi
call ebx
mov eax, dword [edi]
test eax, eax
je 0x40d197
push eax
call ebx
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4a2a0c]
cmp eax, dword [ecx + 4]
jle 0x40d1dc
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], 0xffffffff
jne 0x40d1dc
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x49dc28
test eax, eax
jne 0x40d22d
jmp 0x40d1f8
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40d208
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, str.thread.entry_event
lea ecx, [esp + 0x14]
call fcn.0040c570
mov edx, str.thread.exit_event
lea ecx, [esp + 0x14]
call fcn.0040c570
mov edx, str.thread
lea ecx, [esp + 0x14]
call fcn.0040c570
int3
Function at 0x40d3a0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e0ae
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x49d140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.asio::detail::win_iocp_io_context.0
mov dword [esi + 0x14], 0
lea ebx, [esi + 0x18]
mov dword [esi + 0x1c], 0
mov dword [ebx], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call fcn.0040e130
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x38]
mov dword [esi + 0x34], 0
call fcn.0040cb90
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x60], 0
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [esi + 0x14], eax
test eax, eax
jne 0x40d4dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword fs:[0x2c]
mov edi, eax
mov edx, dword [ecx]
mov ecx, dword [0x4a2a0c]
cmp ecx, dword [edx + 4]
jle 0x40d4ce
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], 0xffffffff
jne 0x40d4ce
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
add esp, 4
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x49dc28
test edi, edi
jne 0x40d55a
cmp byte [ebp + 0x10], 0
je 0x40d544
lock inc dword [ebx]
push 0xc
call fcn.00458728
mov edi, eax
add esp, 4
mov dword [ebp + 0x10], edi
mov byte [ebp - 4], 7
push 0x10
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.00458728
add esp, 4
mov dword [ebp + 8], eax
mov ecx, edi
mov dword [eax], vtable.asio::detail::win_thread::func_struct_asio::detail::win_iocp_io_context::thread_function_.0
push 0
push eax
mov dword [eax + 0xc], esi
call fcn.0040d010
mov ebx, dword [esi + 0x60]
test ebx, ebx
je 0x40d541
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc
push ebx
call fcn.00458ac3
add esp, 8
mov dword [esi + 0x60], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, str.iocp
lea ecx, [ebp - 0x1c]
call fcn.0040c570
int3
Function at 0x40d8c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e115
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x49d140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edx, edx
lea eax, [esi + 0x18]
lock xadd dword [eax], edx
test edx, edx
jne 0x40d922
call fcn.0040da50
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0x49dbf8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], 0
push eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.00456aaf
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
add esp, 4
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x4c], xmm0
movups xmmword [ebp - 0x3c], xmm0
mov ecx, esi
mov dword [ebp - 4], 0
push dword [0x4a2a14]
neg ecx
lea eax, [esi + 0x14]
sbb ecx, ecx
and ecx, eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push dword [0x4a2a14]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push ebx
push eax
push ecx
mov ecx, esi
mov byte [ebp - 4], 1
xor edi, edi
call fcn.0040dc30
test eax, eax
je 0x40d9cc
cmp edi, 0xffffffff
lea eax, [edi + 1]
push ebx
cmove eax, edi
mov edi, eax
lea eax, [ebp - 0x4c]
push eax
push ecx
mov ecx, esi
call fcn.0040dc30
test eax, eax
jne 0x40d9b0
push dword [ebp - 0x10]
push dword [0x4a2a14]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor esi, esi
nop dword [eax]
mov eax, dword [ebp + esi*4 - 0x4c]
test eax, eax
je 0x40d9f1
push eax
call fcn.00458abe
add esp, 4
inc esi
cmp esi, 0xa
jl 0x40d9e0
lea eax, [ebp - 0x20]
push eax
call fcn.00456b9a
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40e6f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
push esi
push edi
cmp ebx, 0xffffffff
je 0x40e85d
cmp byte [ebp + 8], 0
je 0x40e74a
mov al, byte [edx]
test al, 8
je 0x40e74a
or al, 8
mov dword [ebp - 0xc], 0x49dbf8
push 4
mov byte [edx], al
xor ecx, ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], ecx
push eax
push 0x80
push 0xffff
push ebx
mov dword [ebp - 0x10], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea ecx, [ebp - 0x10]
setne dl
call fcn.0040e5f0
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edi, dword [ebp + 0xc]
mov esi, eax
test esi, esi
mov ecx, edi
setne dl
call fcn.0040e5f0
test esi, esi
je 0x40e854
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4a2a0c]
mov edx, dword [eax]
mov dword [ebp - 4], edx
cmp ecx, dword [edx + 4]
jle 0x40e7be
push 0x4a2a0c
call fcn.004584c4
mov ecx, dword [0x4a2a0c]
add esp, 4
cmp ecx, 0xffffffff
jne 0x40e7bb
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
mov ecx, dword [0x4a2a0c]
add esp, 4
mov edx, dword [ebp - 4]
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
cmp eax, dword [0x49dc2c]
jne 0x40e7d4
cmp dword [edi], 0x2733
je 0x40e822
cmp ecx, dword [edx + 4]
jle 0x40e80c
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], 0xffffffff
jne 0x40e80c
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
add esp, 4
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
cmp eax, dword [0x49dc2c]
jne 0x40e854
cmp dword [edi], 0x4d5
jne 0x40e854
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x8004667e
push ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp - 8]
push ebx
and byte [eax], 0xfc
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
mov ecx, edi
test esi, esi
setne dl
call fcn.0040e5f0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e870
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
cmp ecx, 0xffffffff
jne 0x40e8d6
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4a2a0c]
cmp eax, dword [ecx + 4]
jle 0x40e8bf
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], 0xffffffff
jne 0x40e8bf
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
add esp, 4
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x2719
mov dword [eax + 4], 0x49dc28
or eax, 0xffffffff
pop esi
pop ecx
pop ebp
ret
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.WS2_32.dll_connect]
mov ecx, dword [ebp + 0xc]
mov esi, eax
test esi, esi
setne dl
call fcn.0040e5f0
mov eax, esi
pop esi
pop ecx
pop ebp
ret
Function at 0x40e900
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov edi, dword fs:[0x2c]
mov eax, dword [esi]
cmp eax, 0x4cf
jg 0x40ea09
je 0x40e9c3
cmp eax, 0x79
je 0x40e97a
cmp eax, 0x4c9
jne 0x40ea61
mov ecx, dword [edi]
mov eax, dword [0x4a2a0c]
cmp eax, dword [ecx + 4]
jle 0x40e970
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], 0xffffffff
jne 0x40e970
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
add esp, 4
mov eax, 0x274d
jmp 0x40ea58
mov ecx, dword [edi]
mov eax, dword [0x4a2a0c]
cmp eax, dword [ecx + 4]
jle 0x40e9b9
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], 0xffffffff
jne 0x40e9b9
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
add esp, 4
mov eax, 0x274c
jmp 0x40ea58
mov ecx, dword [edi]
mov eax, dword [0x4a2a0c]
cmp eax, dword [ecx + 4]
jle 0x40ea02
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], 0xffffffff
jne 0x40ea02
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
add esp, 4
mov eax, 0x2743
jmp 0x40ea58
cmp eax, 0x4d0
jne 0x40eab5
mov ecx, dword [edi]
mov eax, dword [0x4a2a0c]
cmp eax, dword [ecx + 4]
jle 0x40ea53
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], 0xffffffff
jne 0x40ea53
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
add esp, 4
mov eax, 0x2751
mov dword [esi + 4], 0x49dc28
mov dword [esi], eax
test eax, eax
jne 0x40eab5
cmp ebx, 0xffffffff
jne 0x40eab9
mov ecx, dword [edi]
mov eax, dword [0x4a2a0c]
cmp eax, dword [ecx + 4]
jle 0x40eaa8
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], ebx
jne 0x40eaa8
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
add esp, 4
mov dword [esi], 0x2719
mov dword [esi + 4], 0x49dc28
pop edi
pop esi
pop ebx
ret
push 0
push 0
push 0x7010
push 0xffff
push ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
pop edi
test eax, eax
mov ecx, esi
pop esi
setne dl
pop ebx
jmp fcn.0040e5f0

Function at 0x40ee60
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, edx
push edi
cmp ecx, 0xffffffff
jne 0x40eeca
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4a2a0c]
cmp eax, dword [ecx + 4]
jle 0x40eeb2
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], 0xffffffff
jne 0x40eeb2
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
add esp, 4
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x2719
mov dword [eax + 4], 0x49dc28
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
mov ebx, dword [ebp + 0xc]
push ebx
push 0x8004667e
push ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov ecx, dword [ebp + 0x10]
mov edi, eax
mov edx, edi
shr edx, 0x1f
call fcn.0040e5f0
test edi, edi
js 0x40ef03
cmp dword [ebx], 0
mov al, byte [esi]
je 0x40eeff
or al, 1
mov byte [esi], al
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
and al, 0xfc
mov byte [esi], al
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40fb70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0
push 0
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 1
push eax
push dword [ecx + 4]
mov dword [ebp - 8], 0
call dword [sym.imp.WS2_32.dll_WSASend]
mov eax, dword fs:[0x2c]
mov esi, dword [eax]
mov eax, dword [0x4a2a0c]
cmp eax, dword [esi + 4]
jle 0x40fbed
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], 0xffffffff
jne 0x40fbed
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x14], 0x49dc28
cmp eax, 0x40
je 0x40fc06
cmp eax, 0x4d2
jne 0x40fc43
mov eax, dword [0x4a2a0c]
cmp eax, dword [esi + 4]
jle 0x40fc43
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], 0xffffffff
jne 0x40fc43
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40fc50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
mov eax, dword [0x49d140]
xor eax, esp
mov dword [esp + 0x420], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x10], ecx
push ebx
mov dword [esp + 0x1c], eax
mov eax, dword fs:[0x2c]
push esi
push edi
mov dword [esp + 0x20], 0x400
mov ebx, dword [eax]
nop dword [eax]
push 0
push 0
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], 0
push eax
push 1
lea eax, [esp + 0x34]
push eax
push dword [ecx]
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ecx, dword [0x4a2a0c]
mov dword [esp + 0x18], eax
cmp ecx, dword [ebx + 4]
jle 0x40fcff
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], 0xffffffff
jne 0x40fcff
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
mov edi, 0x49dc28
cmp esi, 0x40
jne 0x40fd5c
mov eax, dword [0x4a2a0c]
cmp eax, dword [ebx + 4]
jle 0x40fd4e
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], 0xffffffff
jne 0x40fd4e
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
add esp, 4
mov edi, 0x49dc28
mov esi, 0x2746
mov eax, edi
jmp 0x40fdcc
cmp esi, 0x4d2
jne 0x40fdaf
mov eax, dword [0x4a2a0c]
cmp eax, dword [ebx + 4]
jle 0x40fda1
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], 0xffffffff
jne 0x40fda1
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
add esp, 4
mov edi, 0x49dc28
mov esi, 0x274d
mov eax, edi
jmp 0x40fdcc
cmp esi, 0x2738
je 0x40fea3
mov eax, 0x49dc28
cmp esi, 0xea
je 0x40fea3
cmp dword [esp + 0x18], 0
je 0x40fea8
or eax, 0xffffffff
test eax, eax
jg 0x40fec4
je 0x40fe8c
mov eax, dword [0x4a2a0c]
cmp eax, dword [ebx + 4]
jle 0x40fe25
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], 0xffffffff
jne 0x40fe25
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
add esp, 4
mov eax, dword [edi + 4]
cmp eax, dword [0x49dc2c]
jne 0x40fe3c
cmp esi, 0x2733
je 0x40fec4
mov eax, dword [0x4a2a0c]
cmp eax, dword [ebx + 4]
jle 0x40fe79
push 0x4a2a0c
call fcn.004584c4
add esp, 4
cmp dword [0x4a2a0c], 0xffffffff
jne 0x40fe79
push 0x484d10
call fcn.00458aa9
add esp, 4
push 0x4a2a0c
call fcn.00458473
add esp, 4
mov eax, dword [edi + 4]
cmp eax, dword [0x49dc2c]
jne 0x40fe8c
cmp esi, 0x4d5
je 0x40fec4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.00458460
mov esp, ebp
pop ebp
ret
mov eax, 0x49dc28
mov edi, eax
xor esi, esi
mov eax, dword [esp + 0x10]
cmp eax, 0x400
jne 0x40fdda
mov ecx, dword [esp + 0x1c]
jmp 0x40fc90
mov ecx, dword [esp + 0x42c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00458460
mov esp, ebp
pop ebp
ret