joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471970
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5f2ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push edi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edi, eax
and eax, 2
mov dword [esp + 0xc], eax
mov eax, dword [esi]
mov edx, dword [eax + 0x38]
push ecx
mov ecx, esi
and edi, 1
call edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi]
mov edx, dword [eax + 0x34]
push ecx
mov ecx, esi
call edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [esp + 0x28]
call sub.mfc90u.dll_CBrush::CBrush
mov dword [esp + 0x48], 0
mov eax, dword [ebp + 0x1c]
imul eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x20]
add eax, ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x34], eax
lea eax, [ecx + edx]
mov edx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x30], ecx
push eax
lea ecx, [esp + 0x30]
push ecx
push edx
mov dword [esp + 0x38], ebx
call dword [sym.imp.USER32.dll_FillRect]
push 1
mov ecx, esi
call sub.mfc90u.dll_CDC::SetBkMode
mov eax, dword [ebp + 0x18]
mov ecx, dword [esi + 4]
push eax
mov eax, dword [ebp + 0x28]
push ebx
push ecx
mov ecx, dword [ebp + 0x24]
call fcn.0046ca20
add esp, 0xc
test edi, edi
je 0x471a58
mov edx, dword [ebp + 0x18]
mov ecx, dword [esi + 4]
push edx
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp + 0x28]
push ecx
mov ecx, dword [ebp + 0x24]
call fcn.0046ca20
add esp, 0xc
cmp dword [esp + 0xc], 0
je 0x471ad5
lea ecx, [esp + 0x1c]
call fcn.00411fb0
mov byte [esp + 0x48], 1
mov edx, dword [ebp + 8]
push edx
push 0
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x20]
call sub.mfc90u.dll_CGdiObject::Attach
test eax, eax
je 0x471ac7
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call sub.mfc90u.dll_CDC::SelectObject_2
mov edi, dword [esp + 0x10]
add edi, 0xfffffffe
push edi
push ebx
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
mov dword [esp + 0x18], eax
call sub.mfc90u.dll_CDC::MoveTo
mov edx, dword [esp + 0x18]
push edi
push edx
mov ecx, esi
call sub.mfc90u.dll_CDC::LineTo
mov eax, dword [esp + 0xc]
push eax
mov ecx, esi
call sub.mfc90u.dll_CDC::SelectObject_2
mov byte [esp + 0x48], 0
lea ecx, [esp + 0x1c]
call fcn.00411f00
or eax, 0xffffffff
mov dword [esp + 0x48], eax
mov dword [esp + 0x24], vtable.CBrush.0
mov dword [esp + 0x48], eax
lea ecx, [esp + 0x24]
call fcn.00401a60
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x478790
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x60270b
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x84]
mov ebx, dword [esp + 0x80]
mov esi, ecx
mov eax, dword [0x741af8]
push eax
push 0
lea ecx, [esp + 0x38]
push ecx
call fcn.00475440
mov dword [esp + 0x6c], 0
lea edx, [esp + 0x30]
push edx
mov edi, ebp
call fcn.00475790
mov dword [esp + 0x6c], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.00475600
mov edi, dword [esp + 0x7c]
call fcn.00473180
mov edi, ebx
call fcn.00473180
mov eax, 0x6b70dc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x478816
sub eax, edx
sar eax, 1
push str.Install
mov eax, esi
setne byte [esp + 0x88]
call fcn.0047b3a0
test al, al
je 0x4788cf
push esi
mov eax, str.Install
lea esi, [esp + 0x24]
call fcn.0047b2d0
mov dword [esp + 0x6c], 1
push 0x2c
call sub.mfc90u.dll_new_1
add esp, 4
mov dword [esp + 0x80], eax
mov byte [esp + 0x6c], 2
test eax, eax
je 0x47887d
mov ecx, esi
push ecx
push eax
call fcn.0047a6f0
jmp 0x47887f
xor eax, eax
mov byte [esp + 0x6c], 1
mov ecx, eax
lea eax, [esp + 0x18]
call fcn.0047aad0
mov byte [esp + 0x6c], 3
lea eax, [esp + 0x18]
call fcn.0044d900
add eax, 0x14
je 0x4788a7
add eax, 0xc
jmp 0x4788a9
xor eax, eax
mov edi, ebx
call fcn.00472a50
mov byte [esp + 0x6c], 1
lea ecx, [esp + 0x18]
call fcn.0047aae0
mov dword [esp + 0x6c], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.0047b2f0
mov eax, ebx
call fcn.00473170
test al, al
je 0x478937
cmp byte [esp + 0x84], 0
je 0x4789ef
mov edx, dword [0x741af8]
push edx
push 0xe1040062
lea eax, [esp + 0x38]
push eax
call fcn.00475440
mov dword [esp + 0x6c], 4
lea ecx, [esp + 0x30]
push ecx
mov edi, ebp
call fcn.00475790
mov dword [esp + 0x6c], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.00475600
mov edx, dword [ebp]
mov eax, dword [esp + 0x78]
mov edx, dword [edx + 0x20]
push eax
mov ecx, ebp
call edx
jmp 0x4789ef
mov esi, dword [esp + 0x74]
mov ecx, dword [esi + 4]
lea edi, [esp + 0x20]
call fcn.00486580
mov dword [esp + 0x6c], 5
mov edi, dword [esp + 0x7c]
push edi
lea eax, [esi + 8]
call fcn.004221b0
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00479d70
or esi, 0xffffffff
add esp, 0xc
mov dword [esp + 0x6c], esi
lea ecx, [esp + 0x20]
call fcn.004866e0
mov edx, edi
mov eax, ebx
call fcn.00473b40
test al, al
je 0x4789d9
cmp byte [esp + 0x84], 0
jne 0x4789e3
mov ecx, dword [0x741af8]
push ecx
push 0xe1040063
lea edx, [esp + 0x38]
push edx
call fcn.00475440
mov dword [esp + 0x6c], 6
lea eax, [esp + 0x30]
push eax
mov edi, ebp
call fcn.00475790
mov dword [esp + 0x6c], esi
lea ecx, [esp + 0x30]
call fcn.00475600
mov edx, dword [ebp]
mov eax, dword [esp + 0x78]
mov edx, dword [edx + 0x20]
push eax
mov ecx, ebp
call edx
jmp 0x4789ef
cmp byte [esp + 0x84], 0
je 0x4789ef
push 0x6b70dc
mov eax, edi
call fcn.00472a30
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret 0x14
Function at 0x47bdc0
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 4]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x47bde0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
mov ecx, dword [esp + 0x28]
xor eax, eax
push ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
push esi
push eax
mov eax, dword [edx + 4]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x2c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne bl
test bl, bl
jne 0x47be4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x47be4b
mov al, 1
mov dword [esi], 0
pop ebx
add esp, 0x14
ret 0x14
mov al, bl
pop ebx
add esp, 0x14
ret 0x14

Function at 0x47bef0
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 4]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x47bf10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
mov ecx, dword [esp + 0x28]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
lea edx, [esp]
push edx
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, dword [eax + 4]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret 0x18

Function at 0x47c060
Capabilities:
Read file via mapping

Disassembly:
push esi
push 3
mov esi, eax
mov eax, dword [esi]
mov edx, dword [eax + 4]
push closesocket
push ecx
mov ecx, esi
call edx
test al, al
jne 0x47c07a
pop esi
ret
push ebx
push edi
mov ecx, esi
mov bl, 1
xor edi, edi
call fcn.0047c000
or eax, edx
je 0x47c0ba
mov eax, dword [esi + 4]
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
test edi, edi
je 0x47c0b3
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x18], eax
cmp dword [esi + 0x18], 0
setne bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test edi, edi
je 0x47c0cd
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov al, bl
pop ebx
pop esi
ret
Function at 0x481820
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x5ed30c
mov eax, dword fs:[0]
push eax
sub esp, 0x1cc
mov eax, dword [0x72d630]
xor eax, esp
mov dword [esp + 0x1c4], eax
push ebx
push esi
push edi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x1dc]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x1ec]
lea eax, [esp + 0x44]
push eax
push 2
mov edi, ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov esi, eax
test esi, esi
je 0x48199f
cmp esi, 0x276b
jne 0x4818c4
mov ecx, dword [0x741af8]
push ecx
push 0xe1040002
lea edx, [esp + 0x1c]
push edx
call fcn.00475440
mov dword [esp + 0x1e4], 0
push eax
call fcn.00475790
mov dword [esp + 0x1e4], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00475600
xor al, al
jmp 0x481a1e
cmp esi, 0x276c
je 0x481924
cmp esi, 0x2726
je 0x481924
mov eax, dword [0x741af8]
push eax
push 0xe1040019
lea ecx, [esp + 0x1c]
push ecx
call fcn.00475440
mov dword [esp + 0x1e4], 2
push eax
call fcn.00475790
mov dword [esp + 0x1e4], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00475600
mov edx, dword [edi]
mov eax, dword [edx + 0x28]
push esi
push str._1_d_
mov ecx, edi
call eax
xor al, al
jmp 0x481a1e
mov ecx, dword [0x741af8]
push ecx
push 0xe1040003
lea edx, [esp + 0x1c]
push edx
call fcn.00475440
mov dword [esp + 0x1e4], 1
push eax
call fcn.00475790
mov dword [esp + 0x1e4], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00475600
mov eax, dword [edi]
mov edx, dword [eax + 0x28]
push esi
push str._1_d_
mov ecx, edi
call edx
movzx ecx, byte [esp + 0x44]
mov eax, dword [edi]
mov edx, dword [eax + 0x28]
push ecx
push str._1_d_
mov ecx, edi
call edx
mov ecx, dword [esp + 0x44]
mov eax, dword [edi]
mov eax, dword [eax + 0x28]
shr ecx, 8
movzx edx, cl
push edx
push str._1_d_
mov ecx, edi
call eax
xor al, al
jmp 0x481a1e
cmp word [esp + 0x44], 2
je 0x481a19
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [0x741af8]
push ecx
push 0xe104001a
lea edx, [esp + 0x1c]
push edx
call fcn.00475440
mov dword [esp + 0x1e4], 3
push eax
call fcn.00475790
mov dword [esp + 0x1e4], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00475600
movzx ecx, byte [esp + 0x44]
mov eax, dword [edi]
mov edx, dword [eax + 0x28]
push ecx
push str._1_d_
mov ecx, edi
call edx
mov ecx, dword [esp + 0x44]
mov eax, dword [edi]
mov eax, dword [eax + 0x28]
shr ecx, 8
movzx edx, cl
push edx
push str._1_d_
mov ecx, edi
call eax
xor al, al
jmp 0x481a1e
mov byte [ebx], 1
mov al, 1
mov ecx, dword [esp + 0x1dc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c4]
xor ecx, esp
call fcn.005e038a
add esp, 0x1d8
ret 4
Function at 0x482600
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x606b00
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
or edi, 0xffffffff
lea esi, [esp + 0x18]
call fcn.004728e0
mov dword [esp + 0x58], 0
lea eax, [esp + 0x18]
push eax
mov eax, esi
call fcn.004221b0
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
jne 0x4826c1
mov ecx, dword [0x741af8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x24]
push edx
call fcn.00475440
mov byte [esp + 0x58], 1
lea eax, [esp + 0x1c]
push eax
mov edi, ebx
call fcn.00475790
mov byte [esp + 0x58], 0
lea ecx, [esp + 0x1c]
call fcn.00475600
mov dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.004740c0
xor al, al
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x18]
push ebx
push esi
call fcn.00482410
add esp, 8
push esi
mov bl, al
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.004740c0
mov al, bl
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x482930
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ed2b8
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea eax, [esi + 8]
mov dword [esi + 4], vtable.IHostnameResolverSink.0
xor ebx, ebx
push eax
mov dword [esi], vtable.VUnknown_class_Interface::VCompletionPortSocket_.1.0
mov dword [esi + 4], vtable.VUnknown_class_Interface::VCompletionPortSocket_.0
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x20]
lea ecx, [esi + 0xc]
push ecx
mov dword [esi], vtable.VCompletionPortSocket.0
mov dword [esi + 4], vtable.VCompletionPortSocket.1.0
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], 0xffffffff
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
mov byte [esi + 0x36], bl
mov dword [esi + 0x38], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 8
Function at 0x482f50
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov edi, ecx
push esi
call fcn.00483df0
test al, al
jne 0x482fd6
mov eax, edi
mov dword [edi + 0x38], esi
call fcn.0049a670
push 0x10
push eax
mov eax, dword [edi + 0x30]
push eax
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
mov edx, dword [ebx]
mov edx, dword [edx + 0x50]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebx
mov dword [esp + 0x18], 0
call edx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [edi + 0x30]
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x482fd6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x482fd6
xor edx, edx
push edx
mov ecx, 0x483760
push ecx
push eax
push esi
call fcn.00483d60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x483170
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [ecx + 0x30]
mov edx, dword [esp + 4]
cmp eax, 0xffffffff
jne 0x483196
cmp edx, 0x100
jne 0x483196
mov eax, dword [esp + 8]
cmp dword [eax], 0
setne dl
mov byte [ecx + 0x35], dl
xor eax, eax
ret 0x10
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push ecx
push edx
mov edx, dword [esp + 0x1c]
push edx
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x483191
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
ret 0x10

Function at 0x483290
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
mov eax, dword [0x72d630]
xor eax, esp
mov dword [esp + 0x8c], eax
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx + 0x30]
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x18], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x4832eb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
pop esi
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.005e038a
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0xc]
push ecx
lea edi, [esp + 0x14]
call fcn.0048cda0
mov ecx, dword [esp + 0x98]
mov dword [esi], eax
add esp, 4
neg eax
sbb eax, eax
pop edi
and eax, 0x1efbffbf
pop esi
xor ecx, esp
add eax, 0xe1040041
call fcn.005e038a
mov esp, ebp
pop ebp
ret 4
Function at 0x4833b0
Capabilities:
Send data
Send data on socket

Disassembly:
push 0xffffffffffffffff
push 0x5eb18b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
push 0x30
call sub.mfc90u.dll_new_1
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
mov dword [esp + 0x30], 0
test esi, esi
je 0x48340d
mov edx, dword [esp + 0x38]
push edx
xor ecx, ecx
mov eax, 0x483b00
push ecx
push eax
mov eax, ebx
call fcn.0049ad60
mov esi, eax
jmp 0x48340f
xor esi, esi
mov dword [esp + 0x30], 0xffffffff
mov edi, dword [esp + 0x40]
mov eax, edi
mov ecx, esi
call fcn.0049add0
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x50]
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x18], 0
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
mov ecx, edi
call eax
mov edx, dword [edi]
mov dword [esp + 0x24], eax
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push 0
push esi
push ecx
push edx
mov edx, dword [ebx + 0x30]
push 0
mov dword [esp + 0x34], eax
lea eax, [esp + 0x30]
push eax
push 1
lea ecx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSASendTo]
test eax, eax
je 0x4834a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x4834a6
push esi
push 0x483720
mov dword [esi + 0x2c], eax
mov eax, dword [ebx + 0x2c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0xc
Function at 0x4834c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5efd5b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
push 0xb8
call sub.mfc90u.dll_new_1
add esp, 4
mov dword [esp + 0x14], eax
xor edx, edx
mov dword [esp + 0x30], edx
cmp eax, edx
je 0x48351f
push edx
mov ecx, 0x4839f0
push ecx
mov ecx, dword [ebp + 8]
push ecx
push ebx
push eax
call fcn.004828a0
mov esi, eax
jmp 0x483521
xor esi, esi
mov dword [esp + 0x30], 0xffffffff
mov edi, dword [ebp + 0xc]
mov eax, edi
mov ecx, esi
call fcn.0049add0
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
mov ecx, edi
call eax
mov edx, dword [edi]
mov dword [esp + 0x20], eax
mov eax, dword [edx + 0x14]
mov ecx, edi
call eax
push 0
push esi
lea ecx, [esi + 0xb0]
push ecx
mov dword [esp + 0x28], eax
lea edx, [esi + 0x30]
push edx
lea eax, [esp + 0x20]
push eax
mov eax, dword [ebx + 0x30]
lea ecx, [esp + 0x2c]
push ecx
push 1
lea edx, [esp + 0x38]
push edx
push eax
mov dword [esp + 0x34], 0
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
test eax, eax
je 0x4835a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x4835a6
push esi
push 0x483720
mov dword [esi + 0x2c], eax
mov ecx, dword [ebx + 0x2c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x483f60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5efd5b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x10]
xor esi, esi
test byte [ebp + 0x14], 1
mov edi, 0x483950
jne 0x483fa1
mov edi, 0x4838b0
push 0x30
call sub.mfc90u.dll_new_1
mov ecx, eax
add esp, 4
mov dword [esp + 0x14], ecx
mov dword [esp + 0x30], 0
test ecx, ecx
je 0x483fd3
mov eax, dword [ebp + 0xc]
push eax
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
mov esi, ecx
call fcn.0049ad60
mov esi, eax
jmp 0x483fd8
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [esp + 0x30], 0xffffffff
mov eax, ebx
mov ecx, esi
call fcn.0049add0
mov edx, dword [ebx]
mov eax, dword [edx + 0x10]
mov ecx, ebx
call eax
mov edx, dword [ebx]
mov dword [esp + 0x20], eax
mov eax, dword [edx + 0x14]
mov ecx, ebx
call eax
push 0
push esi
lea ecx, [ebp + 0x14]
push ecx
mov ecx, dword [edi + 0x30]
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x2c], eax
push 1
lea eax, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x484046
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x484046
push esi
push 0x483720
mov dword [esi + 0x2c], eax
mov edx, dword [edi + 0x2c]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x484060
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ed22b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor ebx, ebx
test byte [ebp + 0x10], 1
mov esi, 0x483b60
jne 0x48409d
mov esi, 0x483b00
push 0x30
call sub.mfc90u.dll_new_1
mov ecx, eax
add esp, 4
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
test ecx, ecx
je 0x4840cf
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, ebx
mov esi, ecx
call fcn.0049ad60
mov esi, eax
jmp 0x4840d4
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [esp + 0x28], 0xffffffff
mov eax, edi
mov ecx, esi
call fcn.0049add0
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
mov ecx, edi
call eax
mov edx, dword [edi]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
mov ecx, dword [ebp + 0x10]
push 0
push esi
push ecx
mov ecx, dword [ebx + 0x30]
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x24], eax
push 1
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x484142
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x484142
push esi
push 0x483720
mov dword [esi + 0x2c], eax
mov edx, dword [ebx + 0x2c]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4849a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fe91b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, ecx
push 0x20
call sub.mfc90u.dll_new_1
add esp, 4
mov dword [esp + 0x10], eax
xor esi, esi
mov dword [esp + 0x1c], esi
cmp eax, esi
je 0x4849ef
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
push ecx
push eax
call fcn.00484d60
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
mov edx, dword [esp + 0x2c]
push edx
lea eax, [esi + 4]
mov dword [esi], 1
call fcn.00474160
mov ax, word [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
push esi
mov edi, ebx
mov word [esi + 8], ax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], edx
call fcn.00484d30
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x18