joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441dc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47bfed
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x49c100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebx + 8]
push dword [0x4a8e68]
lea eax, [esi + 0x14]
neg esi
sbb esi, esi
and esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x441e10
cmp dword [eax], esi
je 0x441e25
mov eax, dword [eax + 8]
test eax, eax
jne 0x441e05
push dword [0x4a8e68]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x441e69
mov eax, dword [eax + 4]
jmp 0x441e6b
cmp dword [eax + 4], 0
je 0x441e10
nop
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xd]
push eax
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x15], 0
lea eax, [ecx + 4]
mov dword [ebp - 4], 0
push eax
push ecx
push dword [ebp - 0x11]
push dword [ebp - 0x15]
call fcn.0043ece0
add esp, 0x14
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
push 4
push 0x34
push eax
push dword [ebp + 8]
call fcn.0042e7e0
mov ecx, dword [ebp + 8]
mov edx, eax
add esp, 0x10
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], 0x455ec0
mov dword [edx], 0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov dword [edx + 0xc], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x1c], 0
mov eax, dword [ecx]
mov dword [edx + 0x20], eax
mov eax, dword [ecx + 4]
mov dword [edx + 0x24], eax
mov ax, word [ecx + 8]
mov word [edx + 0x28], ax
mov eax, dword [ecx + 0xc]
push 0
mov dword [edx + 0x2c], eax
mov ecx, dword [ebx + 8]
push edx
call fcn.00433e90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x441ef0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c02d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x49c100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
push dword [0x4a8e80]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [esi]
call ebx
test eax, eax
je 0x441f3d
cmp dword [eax], esi
je 0x441f54
mov eax, dword [eax + 8]
test eax, eax
jne 0x441f32
push dword [0x4a8e68]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], edi
call ebx
test eax, eax
je 0x441fab
mov eax, dword [eax + 4]
jmp 0x441fad
cmp dword [eax + 4], 0
je 0x441f3d
nop
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
lea eax, [ebx + 0x40]
push eax
sub esp, 0x28
mov esi, esp
mov dword [ebp + 0xc], esi
mov dword [esi + 0x24], 0
mov ecx, dword [ebx + 0x34]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x441f8b
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx]
mov byte [ebp - 4], 0
call eax
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
push 8
push 0x78
push eax
push dword [ebp + 0xc]
call fcn.0042e7e0
add esp, 0x10
mov ebx, eax
mov dword [ebx + 0x14], 0
lea ecx, [ebx + 0x28]
mov dword [ebx + 0x18], 0x456190
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x1c], 0
mov eax, dword [edi]
add edi, 8
push edi
mov dword [ebp - 4], 2
mov dword [ebx + 0x20], eax
call fcn.00447140
mov edx, dword [ebp + 0xc]
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov eax, dword [edi + 0x30]
mov dword [ebx + 0x58], eax
mov eax, dword [edi + 0x34]
mov dword [ebx + 0x5c], eax
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov eax, dword [edx + 0x40]
mov ecx, dword [edx + 0x44]
push ebx
push dword [ebp + 8]
mov dword [ebx + 0x64], ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x60], eax
mov eax, dword [edx + 0x48]
mov dword [ebx + 0x68], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
call fcn.00457ef0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x442080
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c02d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x49c100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
push dword [0x4a8e80]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [esi]
call ebx
test eax, eax
je 0x4420cd
cmp dword [eax], esi
je 0x4420e4
mov eax, dword [eax + 8]
test eax, eax
jne 0x4420c2
push dword [0x4a8e68]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], edi
call ebx
test eax, eax
je 0x44213e
mov eax, dword [eax + 4]
jmp 0x442140
cmp dword [eax + 4], 0
je 0x4420cd
nop
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
push dword [ebx + 0x48]
lea eax, [ebx + 0x40]
push eax
sub esp, 0x28
mov esi, esp
mov dword [ebp + 0xc], esi
mov dword [esi + 0x24], 0
mov ecx, dword [ebx + 0x34]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x44211e
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx]
mov byte [ebp - 4], 0
call eax
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
push 8
push 0x78
push eax
push dword [ebp + 0xc]
call fcn.0042e7e0
add esp, 0x10
mov ebx, eax
mov dword [ebx + 0x14], 0
lea ecx, [ebx + 0x28]
mov dword [ebx + 0x18], 0x4562c0
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x1c], 0
mov eax, dword [edi]
add edi, 8
push edi
mov dword [ebp - 4], 2
mov dword [ebx + 0x20], eax
call fcn.004471b0
mov edx, dword [ebp + 0xc]
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov eax, dword [edi + 0x30]
mov dword [ebx + 0x58], eax
mov eax, dword [edi + 0x34]
mov dword [ebx + 0x5c], eax
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov eax, dword [edx + 0x40]
mov ecx, dword [edx + 0x44]
push ebx
push dword [ebp + 8]
mov dword [ebx + 0x64], ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x60], eax
mov eax, dword [edx + 0x48]
mov dword [ebx + 0x68], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
call fcn.00457ef0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x442210
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c06d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x49c100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
push dword [0x4a8e80]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [esi]
call edi
test eax, eax
je 0x44225d
cmp dword [eax], esi
je 0x442274
mov eax, dword [eax + 8]
test eax, eax
jne 0x442252
push dword [0x4a8e68]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x20], esi
call edi
test eax, eax
je 0x4422db
mov eax, dword [eax + 4]
jmp 0x4422dd
cmp dword [eax + 4], 0
je 0x44225d
nop
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x48]
push dword [esi + 0x50]
mov ecx, dword [esi + 0x4c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
sub esp, 0x28
mov dword [ebp - 0x10], ecx
mov edi, esp
mov dword [ebp + 0xc], edi
mov dword [edi + 0x24], 0
mov ecx, dword [esi + 0x3c]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x4422ba
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 8]
mov byte [ebp - 4], 0
call eax
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
push 8
push 0x80
push eax
push dword [ebp + 0xc]
call fcn.0042e7e0
add esp, 0x10
mov ebx, eax
mov dword [ebx + 0x14], 0
lea edi, [esi + 0x10]
mov dword [ebx + 0x18], 0x4565f0
lea ecx, [ebx + 0x30]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x1c], 0
mov eax, dword [esi]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 8]
push edi
mov dword [ebp - 4], 2
mov dword [ebx + 0x28], eax
call fcn.004471b0
mov edx, dword [ebp + 0xc]
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov eax, dword [edi + 0x30]
mov dword [ebx + 0x60], eax
mov eax, dword [edi + 0x34]
mov dword [ebx + 0x64], eax
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov eax, dword [edx + 0x48]
mov ecx, dword [edx + 0x4c]
push ebx
push dword [ebp + 8]
mov dword [ebx + 0x6c], ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x68], eax
mov eax, dword [edx + 0x50]
mov dword [ebx + 0x70], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.00457ef0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x445600
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c600
mov eax, dword fs:[0]
push eax
sub esp, 0x104
mov eax, dword [0x49c100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x18]
push ecx
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x84], eax
call fcn.00446690
mov eax, dword [esi]
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x60], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x5c], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x58], eax
mov eax, dword [esi + 0x10]
add esi, 0x18
push esi
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x50], eax
call fcn.004471b0
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x14], eax
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
push 0x10000
lea eax, [ebp - 0x10c]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x64], 1
call fcn.00467660
mov edx, dword [ebp - 0x84]
lea ecx, [edx + 0x44]
push ecx
lea ecx, [ebp - 0x88]
push ecx
mov ecx, dword [edx]
push 0
push eax
lea eax, [edx + 4]
add ecx, 0x14
push eax
call fcn.00440c70
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x4456f5
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x4456f5
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x4456f5
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x445714
mov edx, dword [ecx]
lea eax, [ebp - 0x40]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x80]
test edx, edx
je 0x44574d
mov ecx, dword [ebp - 0x78]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffff8
cmp ecx, 0x1000
jb 0x445743
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x445743
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0047613e
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00475cb4
mov esp, ebp
pop ebp
ret
Function at 0x44cf40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d325
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x49c100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [0x4a8e80]
mov esi, dword [ecx + 4]
lea eax, [ecx + 4]
lea edi, [ecx + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ecx]
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x44cf93
cmp dword [eax], esi
je 0x44cfab
mov eax, dword [eax + 8]
test eax, eax
jne 0x44cf88
push dword [0x4a8e68]
mov dword [ebp - 0x28], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x44cfd7
mov eax, dword [eax + 4]
jmp 0x44cfd9
cmp dword [eax + 4], 0
je 0x44cf93
nop
mov ecx, dword [edi + 0x24]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x44d02f
mov eax, dword [ecx]
call dword [eax + 8]
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
push 8
push 0x50
push eax
push dword [ebp - 0x14]
call fcn.0042e7e0
add esp, 0x10
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 1
push ecx
push edi
mov ecx, eax
call fcn.00446010
mov ecx, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.00457ef0
lea ecx, [ebp - 0x28]
call fcn.0046daa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
int3
Function at 0x451570
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x15c
mov eax, dword [0x49c100]
xor eax, esp
mov dword [esp + 0x158], eax
mov eax, dword [esp + 0x168]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], eax
xor edi, edi
mov eax, dword [esp + 0x174]
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
mov dword [esp + 0x24], 0xc3d2e1f0
cmp eax, 0x40
jb 0x45163a
lea ebp, [eax - 0x40]
nop dword [eax]
lea eax, [edi + 0x40]
cmp edi, eax
jae 0x45161d
mov eax, dword [esp + 0x170]
lea esi, [esp + 0x28]
add eax, 2
mov ebx, 0x10
add eax, edi
add edi, 0x40
nop
movzx edx, byte [eax - 2]
lea esi, [esi + 4]
movzx ecx, byte [eax - 1]
lea eax, [eax + 4]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 4]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 3]
shl edx, 8
or edx, ecx
mov dword [esi - 4], edx
sub ebx, 1
jne 0x4515f0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00460eb0
add esp, 8
cmp edi, ebp
jbe 0x4515d0
mov eax, dword [esp + 0x174]
mov ebx, eax
mov eax, 0xf
sub ebx, edi
mov dword [esp + eax*4 + 0x28], 0
sub eax, 1
jns 0x451643
xor esi, esi
lea ebp, [esi + 3]
test ebx, ebx
je 0x451685
add edi, dword [esp + 0x170]
mov eax, esi
lea edx, [esp + 0x28]
shr eax, 2
mov ecx, ebp
lea edx, [edx + eax*4]
mov eax, esi
and eax, 3
sub ecx, eax
movzx eax, byte [edi + esi]
shl ecx, 3
inc esi
shl eax, cl
or dword [edx], eax
cmp esi, ebx
jb 0x451660
mov eax, esi
lea edx, [esp + 0x28]
shr eax, 2
and esi, ebp
sub ebp, esi
lea edx, [edx + eax*4]
shl ebp, 3
mov eax, 0x80
mov ecx, ebp
shl eax, cl
or dword [edx], eax
cmp ebx, 0x38
jb 0x4516d1
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00460eb0
xorps xmm0, xmm0
add esp, 8
movups xmmword [esp + 0x28], xmm0
movups xmmword [esp + 0x38], xmm0
movups xmmword [esp + 0x48], xmm0
movups xmmword [esp + 0x58], xmm0
mov eax, dword [esp + 0x174]
shl eax, 3
mov dword [esp + 0x64], eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00460eb0
mov esi, dword [esp + 0x18]
add esp, 8
mov edx, 0x13
nop word [eax + eax]
mov eax, edx
mov ecx, edx
and eax, 0xfffffffc
not ecx
and ecx, 3
shl ecx, 3
mov eax, dword [esp + eax + 0x14]
shr eax, cl
mov byte [esi + edx], al
sub edx, 1
jns 0x451700
mov ecx, dword [esp + 0x168]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00475cb4
add esp, 0x15c
ret
Function at 0x452e20
Capabilities:
Set socket configuration

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, dword [edi]
cmp esi, 0x4cf
jg 0x452e54
je 0x452e4d
cmp esi, 0x79
je 0x452e46
cmp esi, 0x4c9
jne 0x452e6b
mov esi, 0x274d
jmp 0x452e61
mov esi, 0x274c
jmp 0x452e61
mov esi, 0x2743
jmp 0x452e61
cmp esi, 0x4d0
jne 0x452eb9
mov esi, 0x2751
call fcn.00433040
mov dword [edi + 4], eax
mov dword [edi], esi
test esi, esi
jne 0x452eb9
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
jne 0x452e89
call fcn.00433040
mov dword [edi], 0x2719
mov dword [edi + 4], eax
pop edi
pop esi
ret
push 0
push 0
push 0x7010
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x452ea7
mov dword [edi], eax
pop edi
pop esi
ret
call fcn.00433040
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
mov dword [edi + 4], esi
pop edi
pop esi
ret
Function at 0x4536a0
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0xffffffff
jne 0x4536bf
call fcn.00433040
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], eax
or eax, 0xffffffff
mov dword [ecx], 0x2719
ret
push edi
push dword [esp + 0x10]
push dword [esp + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov edi, eax
test edi, edi
jne 0x4536dd
mov ecx, dword [esp + 0x14]
pop edi
mov dword [ecx], eax
ret
push esi
call fcn.00433040
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], esi
mov dword [ecx], eax
mov eax, edi
pop esi
pop edi
ret
Function at 0x455c10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47df2d
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x49c100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 0
xor edx, edx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], edx
mov ecx, dword [ebp + 0x30]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x455c69
mov eax, dword [ecx]
lea edx, [ebp - 0x70]
push edx
call dword [eax]
mov edx, eax
mov dword [ebp - 0x4c], edx
mov eax, dword [esi + 0x80]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], 0
test edx, edx
je 0x455cbe
lea eax, [ebp - 0x70]
cmp edx, eax
jne 0x455cb4
mov eax, dword [edx]
lea ecx, [ebp - 0x38]
push ecx
mov ecx, edx
call dword [eax + 4]
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x14], eax
test ecx, ecx
je 0x455cbe
mov edx, dword [ecx]
lea eax, [ebp - 0x70]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x455cb7
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x4c], 0
mov eax, dword [esi + 0x7c]
push dword [0x4a8e80]
mov esi, dword [ebp - 0x3c]
mov byte [ebp - 4], 2
mov dword [ebp - 0x44], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x455ceb
nop dword [eax + eax]
cmp dword [eax], esi
je 0x455d08
mov eax, dword [eax + 8]
test eax, eax
jne 0x455ce0
xor eax, eax
push dword [0x4a8e68]
test eax, eax
setne byte [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x455d0d
mov eax, dword [eax + 4]
jmp 0x455d0f
mov eax, dword [eax + 4]
jmp 0x455ced
xor eax, eax
push 8
push 0x58
push eax
push dword [ebp - 0x44]
call fcn.0042e7e0
mov esi, eax
add esp, 0x10
lea eax, [ebp - 0x40]
push eax
lea ecx, [esi + 0x20]
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x456940
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
call fcn.00447360
mov ecx, dword [ebp - 0x44]
push dword [ebp - 0x48]
push esi
mov ecx, dword [ecx + 8]
call fcn.00433e90
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x455d8b
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp + 0x30]
mov dword [edi], 0
mov dword [edi + 4], 0x49c034
test ecx, ecx
je 0x455db0
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00475cb4
mov esp, ebp
pop ebp
ret 0x2c
Function at 0x4607a0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x194
push 0xffffffffffffffff
push 0x47f475
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x49c100]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
push 0xc
call fcn.00475da2
mov edi, eax
add esp, 4
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x4608d7
push 0x20
call fcn.00475da2
mov ebx, eax
add esp, 4
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x460837
mov ecx, ebx
call fcn.00432520
mov esi, eax
call fcn.00433040
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], eax
test esi, esi
jne 0x460915
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x1c], esi
jmp 0x460839
xor ebx, ebx
mov dword [edi], ebx
mov byte [ebp - 4], 2
mov eax, 1
lock xadd dword [0x4a8e74], eax
inc eax
mov ebx, 0x4a8e78
cmp eax, 1
jne 0x460868
lea eax, [ebp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [ebx], eax
xor esi, esi
lock xadd dword [ebx], esi
test esi, esi
jne 0x460923
push 0x64
mov byte [ebp - 4], 3
call fcn.00475da2
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x46089e
push esi
push 0xffffffffffffffff
push edi
mov ecx, eax
call fcn.00430330
mov esi, eax
jmp 0x4608a0
xor esi, esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 5
push 0
push eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.0042f210
mov ecx, dword [edi]
lea eax, [ebp - 0x14]
add esp, 8
push esi
push eax
call fcn.00455dd0
mov ebx, dword [ebp - 0x1c]
mov dword [edi + 8], esi
jmp 0x4608d9
xor edi, edi
mov dword [ebp - 0x18], edi
push edi
mov ecx, ebx
mov dword [ebp - 4], 6
call fcn.00460610
mov byte [ebx + 0xa4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
call fcn.00475cb4
lea esp, [ebp + 0x194]
pop ebp
ret
push str.mutex
lea eax, [ebp - 0x14]
push eax
call fcn.00432a80
call fcn.00433040
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push str.winsock
push eax
mov dword [ebp - 0x14], esi
call fcn.00432a80
int3
Function at 0x4611d0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x18
push esi
push 0
push 0
lea eax, [esp + 0xf]
mov byte [esp + 0xf], 0
push 0
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
push eax
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 1
push eax
push dword [ecx + 4]
mov dword [esp + 0x24], 0
call dword [sym.imp.WS2_32.dll_WSASend]
call fcn.00433040
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop esi
cmp eax, 0x40
je 0x461224
cmp eax, 0x4d2
jne 0x461229
call fcn.00433040
add esp, 0x18
ret

Function at 0x462cb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x10]
cmp dword [edi + 0x14], 0xf
jbe 0x462cc2
mov edi, dword [edi]
cmp dword [eax + 0x14], 0xf
mov ecx, dword [eax + 0x10]
jbe 0x462cd1
add ecx, dword [eax]
mov eax, dword [eax]
jmp 0x462cd3
add ecx, eax
xor esi, esi
cmp eax, ecx
je 0x462cf2
sub edi, eax
nop dword [eax + eax]
mov dl, byte [esp + esi + 0x14]
inc esi
xor dl, byte [eax]
and esi, 3
mov byte [edi + eax], dl
inc eax
cmp eax, ecx
jne 0x462ce0
pop edi
pop esi
ret 0xc