joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4547e0
Capabilities:
Initialize winsock library

Disassembly:
mov al, byte [0x4b02f0]
sub esp, 0x218
test al, al
jne 0x4547f8
mov al, 1
add esp, 0x218
ret
push ebx
push ebp
push esi
mov ebp, dword [sym.imp.WS2_32.dll_WSAStartup]
push edi
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x98]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x98]
push eax
push 0x909
call ebp
mov esi, eax
cmp esi, 0x276c
jne 0x4548bd
mov ebx, 5
mov dword [esp + 0x10], 2
cmp ebx, 1
jl 0x454886
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jns 0x454855
mov dword [esp + 0x10], 9
dec ebx
test ebx, ebx
je 0x454886
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x98]
xor edx, edx
mov dh, byte [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x98]
mov dl, bl
push ecx
push edx
call ebp
mov esi, eax
cmp esi, 0x276c
je 0x45483c
test esi, esi
jne 0x4548c5
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x48]
push eax
push ebx
push str.Using_ws2_32.dll_version__d__d
push ecx
call fcn.00470124
mov ecx, dword [esp + 0x23c]
add esp, 0x10
lea eax, [esp + 0x48]
mov edx, dword [ecx]
push eax
push str.ws2_32_DLL_Version
call dword [edx + 0x28]
jmp 0x45496a
test esi, esi
je 0x45496a
cmp esi, 0x276b
jne 0x4548e0
mov ecx, dword [esp + 0x22c]
push str.The_underlying_network_subsystem_is_not_ready_for_network_communication.
mov edx, dword [ecx]
jmp 0x454967
cmp esi, 0x276c
jne 0x4548fb
mov ecx, dword [esp + 0x22c]
push str.The_version_of_Windows_Sockets_support_requested_is_not_provided_by_this_particular_Windows_Sockets_implementation.
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x45496a
cmp esi, 0x2734
jne 0x454913
mov ecx, dword [esp + 0x22c]
push str.A_blocking_Windows_Sockets_1.1_operation_is_in_progress.
mov edx, dword [ecx]
jmp 0x454967
cmp esi, 0x2753
jne 0x45492e
mov ecx, dword [esp + 0x22c]
push str.Limit_on_the_number_of_tasks_supported_by_the_Windows_Sockets_implementation_has_been_reached.
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x45496a
cmp esi, 0x271e
jne 0x454946
mov ecx, dword [esp + 0x22c]
push str.The_lpWSAData_is_not_a_valid_pointer.
mov edx, dword [ecx]
jmp 0x454967
push esi
lea eax, [esp + 0x18]
push str.WSAStartup_error:_0x_x
push eax
call fcn.00470124
mov ecx, dword [esp + 0x238]
add esp, 0xc
lea eax, [esp + 0x14]
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebp
mov byte [0x4b02f0], 0
pop ebx
sete al
add esp, 0x218
ret

Function at 0x4549b0
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 0x54]
cmp edx, 0xffffffff
je 0x454a15
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea ecx, [esi + 8]
test eax, eax
je 0x4549ea
cmp eax, 0x3e8
jb 0x4549ea
cmp eax, 0x1e8480
jae 0x4549ea
push 4
push ecx
push 0x1001
push 0xffff
push edx
call edi
mov eax, dword [esi + 0xc]
lea ecx, [esi + 0xc]
test eax, eax
je 0x454a15
cmp eax, 0x3e8
jb 0x454a15
cmp eax, 0x1e8480
jae 0x454a15
mov eax, dword [esi + 0x54]
push 4
push ecx
push 0x1002
push 0xffff
push eax
call edi
pop edi
pop esi
ret
Function at 0x454a20
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x489b78
push eax
mov al, byte [0x4b02f0]
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
mov esi, ecx
test al, al
je 0x454a59
push edi
call fcn.004547e0
add esp, 4
test al, al
je 0x454b3a
push edi
push 1
mov ecx, esi
call fcn.00456a20
push 0
push 1
push 2
mov bl, 1
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x54], eax
jne 0x454a8b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push edi
push eax
call fcn.00455000
add esp, 8
xor bl, bl
mov ecx, esi
call fcn.004549b0
mov al, byte [esp + 0x24]
test al, al
je 0x454b38
lea ebp, [esi + 0x100]
mov ecx, ebp
call fcn.00422090
test eax, eax
jne 0x454ab9
mov eax, dword [esi + 0x128]
test eax, eax
je 0x454b38
mov ebx, dword [edi]
mov ecx, ebp
call fcn.004220a0
push eax
push str.BindIpAddr
mov ecx, edi
call dword [ebx + 0x28]
mov eax, dword [esi + 0x128]
test eax, eax
je 0x454ae4
mov edx, dword [edi]
push eax
push str.BindPort
mov ecx, edi
call dword [edx + 0x2c]
push edi
mov ecx, ebp
call fcn.004220a0
push eax
mov ecx, esi
call fcn.00456930
mov bl, al
test bl, bl
jne 0x454b38
mov eax, dword [edi]
push str.Failed_to_bind_to_local_IP_address
mov ecx, edi
call dword [eax + 0x10]
lea ecx, [esp + 0x24]
call fcn.00423da0
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0
push ecx
push 2
mov ecx, esi
call fcn.00456a20
or eax, 0xffffffff
lea ecx, [esp + 0x24]
mov dword [esi + 0x54], eax
mov dword [esp + 0x18], eax
call fcn.00423de0
mov al, bl
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8
Function at 0x454d20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x489c1e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x10]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.00465860
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], ebx
call fcn.00465860
lea ecx, [esi + 0x5c]
mov byte [esp + 0x18], 1
mov byte [esi + 0x50], bl
mov dword [esi + 0x54], 0xffffffff
call fcn.00465750
lea ecx, [esi + 0x70]
mov byte [esp + 0x18], 2
call fcn.00465540
lea ecx, [esi + 0x98]
mov byte [esp + 0x18], 3
call fcn.00465540
lea ecx, [esi + 0xd0]
mov byte [esp + 0x18], 4
mov dword [esi + 0xc0], 0x7530
mov dword [esi + 0xc4], 0x1b58
mov dword [esi + 0xc8], ebx
call fcn.00419150
lea ecx, [esi + 0x100]
mov byte [esp + 0x18], 5
mov dword [esi + 0xf8], ebx
call fcn.00419150
lea ecx, [esp + 8]
mov byte [esp + 0x18], 6
mov dword [esi + 0x128], ebx
mov byte [esi + 0x12c], bl
mov dword [esi], vtable.ChilkatSocket.0
call fcn.00423da0
mov al, byte [0x4b02f0]
mov byte [esp + 0x18], 7
cmp al, bl
je 0x454e0b
lea eax, [esp + 8]
push eax
call fcn.004547e0
add esp, 4
mov dword [esi + 0x4c], 1
mov dword [esi + 0x2c], 2
mov ecx, dword [0x4b02ec]
mov byte [esp + 0x18], 6
mov dword [esi + 0x58], ecx
mov eax, dword [0x4b02ec]
inc eax
lea ecx, [esp + 8]
mov dword [0x4b02ec], eax
call fcn.00423de0
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x454e50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x489c8e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.ChilkatSocket.0
mov eax, dword [esi + 0x54]
mov dword [esp + 0x14], 6
cmp eax, 0xffffffff
je 0x454eb6
lea ecx, [esp + 4]
call fcn.00423da0
lea eax, [esp + 4]
mov ecx, esi
push eax
push 2
mov byte [esp + 0x1c], 7
call fcn.00456a20
lea ecx, [esp + 4]
mov dword [esi + 0x54], 0xffffffff
mov byte [esp + 0x14], 6
call fcn.00423de0
lea ecx, [esi + 0x100]
mov byte [esp + 0x14], 5
call fcn.00419440
lea ecx, [esi + 0xd0]
mov byte [esp + 0x14], 4
call fcn.00419440
lea ecx, [esi + 0x98]
mov byte [esp + 0x14], 3
call fcn.00465590
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 2
call fcn.00465590
lea ecx, [esi + 0x5c]
mov byte [esp + 0x14], 1
call fcn.004657b0
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 0
call fcn.004658b0
lea ecx, [esi + 0x10]
mov dword [esp + 0x14], 0xffffffff
call fcn.004658b0
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4564e0
Capabilities:
Get socket status

Disassembly:
mov eax, dword [ecx + 0x54]
sub esp, 0x10c
cmp eax, 0xffffffff
jne 0x45650a
mov ecx, dword [esp + 0x114]
push str.invalid_socket__not_ready_for_writing.
mov eax, dword [ecx]
call dword [eax + 0x10]
xor al, al
add esp, 0x10c
ret 8
mov ecx, dword [esp + 0x110]
test ecx, ecx
jne 0x45651a
mov ecx, 0x20f580
mov dword [esp], ecx
lea ecx, [esp]
push ecx
lea edx, [esp + 0xc]
push 0
push edx
push 0
push 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x456569
mov ecx, dword [esp + 0x114]
push str.select_returned_a_socket_error
mov eax, dword [ecx]
call dword [eax + 0x10]
xor al, al
add esp, 0x10c
ret 8
cmp eax, 1
jne 0x456579
mov al, al
add esp, 0x10c
ret 8
mov ecx, dword [esp + 0x114]
push str.socket_is_not_ready_for_writing.
mov edx, dword [ecx]
call dword [edx + 0x10]
xor al, al
add esp, 0x10c
ret 8

Function at 0x4565a0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x11c]
push esi
push edi
mov edi, dword [esp + 0x128]
mov byte [ebx], 0
mov byte [edi], 0
mov esi, dword [ecx + 0x54]
cmp esi, 0xffffffff
jne 0x4565e7
mov ecx, dword [esp + 0x120]
push str.invalid_socket__not_ready_for_writing.
mov eax, dword [ecx]
call dword [eax + 0x10]
mov byte [edi], 1
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x10c
ret 0x10
mov ecx, dword [esp + 0x11c]
test ecx, ecx
jne 0x4565f7
mov ecx, 0x80befc00
mov eax, 0x10624dd3
mov dword [esp + 0x18], esi
mul ecx
shr edx, 6
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], 1
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
sub ecx, edx
lea edx, [esp + 0x14]
lea eax, [ecx + ecx*4]
lea ecx, [esp + 0xc]
push ecx
push 0
lea eax, [eax + eax*4]
push edx
push 0
push 0
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esp + 0x24], eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x45666c
mov ecx, dword [esp + 0x120]
push str.select_returned_a_socket_error
mov eax, dword [ecx]
call dword [eax + 0x10]
mov byte [edi], 1
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x10c
ret 0x10
cmp eax, 1
jne 0x45667f
pop edi
pop esi
mov al, al
pop ebx
add esp, 0x10c
ret 0x10
mov ecx, dword [esp + 0x120]
push str.socket_is_not_ready_for_writing
mov edx, dword [ecx]
call dword [edx + 0x10]
pop edi
mov byte [ebx], 1
pop esi
xor al, al
pop ebx
add esp, 0x10c
ret 0x10
Function at 0x456b50
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x120]
push esi
push edi
mov edi, dword [esp + 0x124]
mov esi, ecx
test edi, edi
mov byte [ebp], 0
je 0x456ba6
push 0x78
push 0
mov ecx, edi
call fcn.00429430
mov ecx, edi
call fcn.004511e0
test al, al
je 0x456ba6
mov ecx, dword [esp + 0x12c]
push str.Wait_for_data_aborted_by_app
mov eax, dword [ecx]
call dword [eax + 0x10]
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x10c
ret 0x18
mov edi, dword [esi + 0x54]
cmp edi, 0xffffffff
jne 0x456bd1
mov ecx, dword [esp + 0x12c]
push str.Wait_for_data_passed_invalid_socket.
mov edx, dword [ecx]
call dword [edx + 0x10]
pop edi
mov byte [ebp], 1
pop esi
xor al, al
pop ebp
add esp, 0x10c
ret 0x18
mov ecx, dword [esp + 0x11c]
push ebx
mov bl, byte [esp + 0x124]
test bl, bl
jne 0x456bed
test ecx, ecx
jne 0x456bed
mov ecx, 0x14
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov eax, edx
neg eax
shl eax, 2
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*8]
cmp eax, 0x7a120
jbe 0x456c15
mov eax, 0x7a120
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
test bl, bl
pop ebx
jne 0x456c33
test edx, edx
jne 0x456c33
test eax, eax
jne 0x456c33
mov eax, 0x3e8
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], edx
push ecx
push 0
lea edx, [esp + 0x1c]
push 0
push edx
push 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x456ca6
mov ecx, dword [esp + 0x12c]
mov byte [ebp], 1
push str.The_peer_has_closed_the_socket__TCP__connection
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [esi + 0x54]
push 2
push ecx
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [esi + 0x54]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x54], 0xffffffff
mov byte [esi + 0x50], 0
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x10c
ret 0x18
test eax, eax
pop edi
pop esi
setne al
pop ebp
add esp, 0x10c
ret 0x18
Function at 0x456cc0
Capabilities:
Get socket status

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 0x110
push ebx
mov ebx, dword [esp + 0x118]
push ebp
push esi
mov esi, dword [esp + 0x12c]
push edi
mov edi, ecx
mov byte [eax], 0
mov ecx, dword [esp + 0x138]
mov byte [esi], 0
test ebx, ebx
mov byte [ecx], 0
je 0x456cfc
cmp ebx, 0x32
jae 0x456cfc
mov ebx, 0x32
mov ebp, dword [esp + 0x128]
test ebp, ebp
jne 0x456d0c
mov ebp, 0x80befc00
cmp dword [edi + 0x54], 0xffffffff
jne 0x456d35
mov ecx, dword [esp + 0x13c]
push str.Invalid_socket.
mov edx, dword [ecx]
call dword [edx + 0x10]
mov byte [esi], 1
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret 0x1c
xor eax, eax
mov cl, 1
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x456d49
cmp eax, ebp
jae 0x456e7e
test ebx, ebx
mov esi, ebx
jne 0x456d51
mov esi, ebp
test ebp, ebp
je 0x456d67
cmp ebp, eax
jbe 0x456d67
mov esi, ebp
sub esi, eax
test ebx, ebx
je 0x456d67
cmp esi, ebx
jbe 0x456d67
mov esi, ebx
test cl, cl
je 0x456d77
shr esi, 1
cmp esi, 0x32
jae 0x456d77
mov esi, 0x32
mov eax, 0x10624dd3
mov dword [esp + 0x1c], 1
mul esi
shr edx, 6
mov dword [esp + 0x14], edx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov ecx, eax
mov eax, esi
sub eax, ecx
lea ecx, [esp + 0x14]
push ecx
push 0
lea eax, [eax + eax*4]
push 0
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, dword [edi + 0x54]
shl edx, 3
mov dword [esp + 0x24], edx
lea edx, [esp + 0x28]
push edx
push 0
mov dword [esp + 0x34], eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x456e24
test eax, eax
jne 0x456e6f
mov ecx, dword [esp + 0x10]
add ecx, esi
test ebp, ebp
mov dword [esp + 0x10], ecx
je 0x456df1
mov eax, ecx
cmp eax, ebp
jae 0x456e7e
mov esi, dword [esp + 0x12c]
test esi, esi
je 0x456e19
test ebx, ebx
je 0x456e19
push 0x73
push ebx
mov ecx, esi
call fcn.004293c0
mov ecx, esi
call fcn.004511e0
test al, al
jne 0x456eb7
mov eax, dword [esp + 0x10]
xor cl, cl
jmp 0x456d3d
mov eax, dword [esp + 0x130]
mov ecx, dword [esp + 0x13c]
push str.Error_waiting_for_socket_to_become_ready_for_reading.
mov byte [eax], 1
mov edx, dword [ecx]
call dword [edx + 0x10]
mov eax, dword [edi + 0x54]
push 2
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov ecx, dword [edi + 0x54]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi + 0x54], 0xffffffff
mov byte [edi + 0x50], 0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret 0x1c
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x110
ret 0x1c
mov esi, dword [esp + 0x13c]
push str.Timeout_waiting_to_read_socket_or_accept_connection
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x10]
mov eax, dword [esi]
push ebp
push str.timeoutMs
mov ecx, esi
call dword [eax + 0x2c]
mov ecx, dword [esp + 0x138]
pop edi
pop esi
pop ebp
mov byte [ecx], 1
xor al, al
pop ebx
add esp, 0x110
ret 0x1c
mov edx, dword [esp + 0x134]
mov ecx, dword [esp + 0x13c]
push str.socket_operation_aborted_by_application_callback
mov byte [edx], 1
mov eax, dword [ecx]
call dword [eax + 0x10]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret 0x1c
Function at 0x457df0
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x489e18
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0x7d0
call fcn.0046fd5a
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x457e36
mov ecx, dword [esp + 0x54]
push str.Socket_receive_memory_allocation_failed.
mov eax, dword [ecx]
call dword [eax + 0x10]
xor al, al
jmp 0x457f47
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, esi
jae 0x457e52
mov dword [esp + 0x14], eax
jmp 0x457e5d
sub eax, esi
cmp eax, 0x64
ja 0x457f45
mov edx, dword [esp + 0x58]
lea ecx, [esp + 0x13]
lea ebx, [edi + 0x98]
push ecx
push edx
push 0
mov ecx, ebx
call fcn.00465620
mov al, byte [esp + 0x13]
test al, al
jne 0x457ee1
mov eax, dword [edi + 0x54]
push 0
push 0x7d0
push ebp
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
je 0x457ef3
cmp esi, 0xffffffff
je 0x457f2f
test esi, esi
jle 0x457ec5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], eax
mov al, byte [edi + 0x12c]
test al, al
je 0x457ec5
mov ecx, dword [esp + 0x58]
push ecx
push esi
lea ecx, [edi + 0x10]
call fcn.00465990
push esi
mov ecx, ebx
call fcn.004655c0
mov ecx, dword [esp + 0x50]
push esi
push ebp
call fcn.00422fd0
mov esi, dword [esp + 0x14]
jmp 0x457e42
mov ecx, dword [esp + 0x54]
push str.Aborted_by_application_while_download_throttling__3_
mov edx, dword [ecx]
call dword [edx + 0x10]
xor al, al
jmp 0x457f47
mov eax, dword [edi + 0x54]
push 2
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov ecx, dword [edi + 0x54]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
push ebp
mov dword [edi + 0x54], 0xffffffff
mov byte [edi + 0x50], 0
call fcn.0046f89f
mov ecx, dword [esp + 0x58]
add esp, 4
mov edx, dword [ecx]
push str.Socket_already_closed_by_peer.
call dword [edx + 0x10]
xor al, al
jmp 0x457f47
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x457f5c
push ebp
call fcn.0046f89f
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret 0xc
lea ecx, [esp + 0x18]
call fcn.00419150
push str.SOCKET_ERROR:
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4c], 0
call fcn.00418c40
lea ecx, [esp + 0x18]
call fcn.0041a6e0
mov esi, dword [esp + 0x54]
lea ecx, [esp + 0x18]
mov edi, dword [esi]
call fcn.004220a0
push eax
mov ecx, esi
call dword [edi + 0x10]
mov eax, dword [esi]
push str.Failed_to_accumulate_data_on_socket.
mov ecx, esi
call dword [eax + 0x10]
push ebp
call fcn.0046f89f
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], 0xffffffff
call fcn.00419440
xor al, al
jmp 0x457f47
Function at 0x45d810
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x48a25b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea edi, [esi + 8]
mov ecx, edi
call fcn.00419150
xor eax, eax
mov ecx, edi
push eax
mov dword [esp + 0x18], eax
mov dword [esi + 0x34], eax
mov dword [esi], vtable.ParseEngine.0
call fcn.00417f90
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x45d890
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x48a27b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea edi, [esi + 8]
mov ecx, edi
call fcn.00419150
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], 0
mov ecx, ebx
mov dword [esi + 0x34], 0
mov dword [esi], vtable.ParseEngine.0
call fcn.00422080
push eax
mov ecx, ebx
call fcn.004220a0
push eax
mov ecx, edi
call fcn.00418ed0
push 0
mov ecx, edi
call fcn.00417f90
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x30], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x460a30
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
sub esp, 0x4c
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov ecx, 0x10
mov eax, dword [ebp + 8]
lea edi, [esp + 0x1c]
cdq
and edx, 7
lea esi, [ebp + 0x18]
add eax, edx
mov ebx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, esi
sar ebx, 3
call fcn.00422080
cmp eax, 0x40
mov ecx, esi
jbe 0x460a84
call fcn.004220a0
test eax, eax
je 0x460ab5
mov ecx, esi
call fcn.004220a0
mov ecx, 0x10
mov esi, eax
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
jmp 0x460ab5
call fcn.004220a0
test eax, eax
je 0x460ab5
mov ecx, esi
call fcn.00422080
mov ecx, esi
mov edi, eax
call fcn.004220a0
mov esi, eax
mov eax, edi
lea edi, [esp + 0x1c]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov ecx, dword [ebp]
mov edx, dword [eax + 0x4b23ec]
mov dword [eax + ecx], edx
add eax, 4
cmp eax, 0x48
jl 0x460ab7
xor eax, eax
mov ecx, 0x100
mov edx, dword [ebp + 4]
mov esi, dword [eax + 0x4b2434]
mov dword [edx + eax], esi
add eax, 4
dec ecx
jne 0x460ad2
cmp eax, 0x1000
jl 0x460acd
xor esi, esi
xor edi, edi
mov eax, dword [ebp]
lea ecx, [edi + eax]
lea eax, [esi + 1]
cdq
idiv ebx
mov dword [esp + 0x18], ecx
xor ecx, ecx
lea eax, [esi + 2]
add edi, 4
mov cl, byte [esp + edx + 0x1c]
cdq
idiv ebx
mov ch, byte [esp + esi + 0x1c]
xor eax, eax
shl ecx, 8
mov al, byte [esp + edx + 0x1c]
or ecx, eax
lea eax, [esi + 3]
cdq
idiv ebx
xor eax, eax
shl ecx, 8
mov al, byte [esp + edx + 0x1c]
or ecx, eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
xor edx, ecx
mov dword [eax], edx
lea eax, [esi + 4]
cdq
idiv ebx
cmp edi, 0x48
mov esi, edx
jl 0x460aef
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, ebp
call fcn.00460230
mov eax, dword [ebp]
mov ecx, dword [esp + 0x10]
mov dword [esi + eax], ecx
mov edx, dword [ebp]
mov eax, dword [esp + 0x14]
mov dword [esi + edx + 4], eax
add esi, 8
cmp esi, 0x48
jl 0x460b4f
mov esi, 4
mov edi, 0x80
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, ebp
call fcn.00460230
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0x10]
mov dword [esi + eax - 4], ecx
mov edx, dword [ebp + 4]
mov eax, dword [esp + 0x14]
mov dword [esi + edx], eax
add esi, 8
dec edi
jne 0x460b87
cmp esi, 0x1004
jl 0x460b82
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
Function at 0x4620b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 8]
push edi
cmp eax, 0xffffffff
je 0x46225e
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
push edx
mov ecx, ebx
call fcn.00461df0
test al, al
je 0x46225e
mov ecx, dword [esp + 0x38]
call fcn.00422070
push 0x4e40
xor esi, esi
call fcn.0046fd5a
mov ebp, eax
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x14]
add esp, 4
mov dword [esp + 0x24], eax
xor eax, eax
lea edx, [esp + 0x10]
push eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 8]
push edx
push 0x4e20
xor edi, edi
push ebp
push eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x462255
mov eax, dword [esp + 0x10]
test eax, eax
je 0x462255
cmp eax, 4
jl 0x462255
mov edx, dword [ebx + 0x10]
mov dword [esp + 0x14], eax
add edx, eax
mov dword [ebx + 0x10], edx
mov ecx, dword [ebx + 0x14]
mov edx, dword [esp + 0x34]
adc ecx, edi
mov dword [ebx + 0x14], ecx
cmp dword [ebp], edx
mov ecx, ebp
je 0x462217
cmp eax, 4
jle 0x46218f
mov edx, dword [esp + 0x20]
dec eax
inc esi
add edi, 1
adc edx, 0
mov dword [esp + 0x14], eax
lea ecx, [esi + ebp]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edx
jmp 0x46220b
test eax, eax
je 0x4621c1
mov ecx, eax
add esi, ebp
mov edx, ecx
lea edi, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
lea esi, [esp + 0x18]
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x1c]
mov edx, 0x4e20
lea ecx, [esp + 0x10]
push 0
sub edx, eax
push ecx
mov ecx, dword [ebx + 8]
add eax, ebp
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x462255
mov eax, dword [esp + 0x10]
xor esi, esi
cmp eax, esi
je 0x462255
mov ecx, dword [ebx + 0x10]
add ecx, eax
mov dword [ebx + 0x10], ecx
mov edx, dword [ebx + 0x14]
mov ecx, dword [esp + 0x14]
adc edx, esi
add ecx, eax
mov dword [esp + 0x14], ecx
mov dword [ebx + 0x14], edx
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov edx, dword [esp + 0x34]
cmp dword [ecx], edx
jne 0x46216d
cmp dword [ecx], edx
jne 0x462255
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
add edi, eax
mov eax, dword [esp + 0x20]
push 4
adc eax, ebx
push ecx
mov ecx, dword [esp + 0x40]
mov dword [edx], edi
mov dword [edx + 4], eax
call fcn.00422fd0
push ebp
call fcn.0046f89f
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
push ebp
call fcn.0046f89f
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1c
ret 0xc