joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f90f
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [0x5a3e04]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
add edx, dword [eax + 0x8c]
add esi, dword [eax + 0x90]
mov ecx, dword [eax + 0x74]
cmp ecx, 2
je 0x44f948
cmp ecx, 3
je 0x44f948
cmp ecx, 8
je 0x44f948
cmp ecx, 0xc
jne 0x44f99b
mov ecx, dword [ebp + 0x10]
push edi
xor edi, edi
inc edi
test ecx, ecx
jns 0x44f95a
neg ecx
mov dword [ebp + 0x10], ecx
jmp 0x44f95f
jne 0x44f95f
mov dword [ebp + 0x10], edi
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jns 0x44f96d
neg ecx
mov dword [ebp + 0x14], ecx
jmp 0x44f972
jne 0x44f972
mov dword [ebp + 0x14], edi
fild dword [ebp + 0x10]
mov dword [eax + 0x118], edx
mov dword [eax + 0x11c], esi
mov dword [eax + 0xb4], 0x44f89a
pop edi
fstp dword [eax + 0x120]
fild dword [ebp + 0x14]
fstp dword [eax + 0x124]
pop esi
pop ebp
ret 0x10

Function at 0x44f9ba
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x5a3e04]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, dword [esi + 0xac]
je 0x44f9e0
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [esp + 0x10]
mov eax, dword [esi + 0x90]
add eax, dword [esp + 0x10]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [esp + 0x10]
push eax
push esi
call dword [esi + 0x3c]
pop esi
ret 0x10

Function at 0x44fa1b
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [0x5a3e04]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov ecx, dword [ebx + 0x74]
cmp ecx, 2
je 0x44fa48
cmp ecx, 3
je 0x44fa48
cmp ecx, 8
je 0x44fa48
cmp ecx, 0xc
jne 0x44fb1d
fldz
fld dword [ebp + 8]
fcom st(1)
fnstsw ax
test ah, 5
jp 0x44fa5d
fstp st(0)
fstp dword [ebp + 8]
jmp 0x44fa6e
fstp st(1)
fld1
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 5
jnp 0x44fa58
fstp st(0)
push esi
mov esi, dword [ebx + 0xbc]
push edi
xor edi, edi
jmp 0x44fa9a
fld dword [esi + 4]
fld dword [ebp + 8]
fld st(0)
fucom st(2)
fnstsw ax
test ah, 0x44
jnp 0x44faba
fstp st(1)
fcompp
fnstsw ax
test ah, 5
jnp 0x44faa0
mov edi, esi
mov esi, dword [esi]
test esi, esi
jne 0x44fa7a
jmp 0x44fac6
push 0x18
push 0
push dword [0x59f0c0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x44fac6
mov dword [edx], esi
jmp 0x44fadf
mov edx, esi
fstp st(2)
fstp st(1)
test edx, edx
jne 0x44faf0
fstp st(0)
push 0x18
push 0
push dword [0x59f0c0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x44fb1b
and dword [edx], 0
fld dword [ebp + 8]
test edi, edi
je 0x44faea
mov dword [edi], edx
jmp 0x44faf0
mov dword [ebx + 0xbc], edx
mov ecx, dword [ebp + 0xc]
movzx eax, cl
mov dword [edx + 8], eax
mov eax, ecx
sar eax, 8
movzx eax, al
mov dword [edx + 0xc], eax
mov eax, ecx
sar eax, 0x10
movzx eax, al
sar ecx, 0x18
mov dword [edx + 0x10], eax
movzx eax, cl
fstp dword [edx + 4]
mov dword [edx + 0x14], eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x44fd37
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x5a3e04]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [esp + 0x14]
mov edi, eax
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov edx, dword [edi + 0x8c]
add esi, edx
mov ecx, dword [edi + 0x90]
add ebx, edx
mov edx, dword [esp + 0x20]
add ebp, ecx
mov eax, dword [edi + 0x74]
add edx, ecx
mov dword [esp + 0x20], edx
cmp eax, 2
je 0x44fd8c
cmp eax, 3
je 0x44fd8c
cmp eax, 8
je 0x44fd8c
cmp eax, 0xc
jne 0x44ff08
mov dword [edi + 0x124], edx
mov eax, ebx
sub edx, ebp
mov dword [edi + 0x118], esi
sub eax, esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
imul edx, edx
imul eax, eax
mov dword [edi + 0x11c], ebp
mov dword [edi + 0x120], ebx
add edx, eax
mov dword [esp + 0x18], edx
fild dword [esp + 0x18]
push edx
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp]
call fcn.0044f9a0
mov eax, dword [esp + 0x24]
fstp dword [edi + 0x128]
pop ecx
cmp ebp, eax
jne 0x44fdf2
mov eax, 0x44fc33
cmp esi, ebx
jle 0x44fe04
mov eax, 0x44fc74
jmp 0x44fe04
cmp esi, ebx
jne 0x44fe0f
cmp ebp, eax
mov eax, 0x44fcb5
jle 0x44fe04
mov eax, 0x44fcf6
mov dword [edi + 0xb4], eax
jmp 0x44ff08
push dword [esp + 0x14]
call fcn.004c957e
push dword [esp + 0x20]
mov esi, eax
call fcn.004c957e
xor ebp, ebp
pop ecx
inc ebp
pop ecx
cmp esi, eax
jl 0x44fe41
and dword [edi + 0x130], 0
mov ecx, dword [edi + 0x124]
mov esi, dword [edi + 0x11c]
jmp 0x44fe77
mov eax, dword [edi + 0x11c]
mov esi, dword [edi + 0x118]
mov ecx, dword [edi + 0x120]
mov dword [edi + 0x118], eax
mov eax, dword [edi + 0x124]
mov dword [edi + 0x130], ebp
mov dword [edi + 0x11c], esi
mov dword [edi + 0x124], ecx
mov dword [edi + 0x120], eax
mov ebx, dword [edi + 0x118]
mov edx, dword [edi + 0x120]
cmp ebx, edx
jge 0x44fe90
and dword [edi + 0x12c], 0
jmp 0x44fec0
mov esi, dword [edi + 0x124]
mov eax, ebx
mov ecx, dword [edi + 0x11c]
mov ebx, edx
mov dword [edi + 0x118], edx
mov edx, eax
mov dword [edi + 0x12c], ebp
mov dword [edi + 0x120], eax
mov dword [edi + 0x124], ecx
mov dword [edi + 0x11c], esi
sub ecx, esi
sub edx, ebx
mov dword [esp + 0x20], ecx
fild dword [esp + 0x20]
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
mov dword [esp + 0x20], edx
fild dword [esp + 0x20]
fstp dword [esp + 0x20]
fdiv dword [esp + 0x20]
mov dword [edi + 0xb4], 0x44fb3b
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
fst dword [edi + 0x134]
fdivr qword [0x4eb578]
fstp dword [edi + 0x138]
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x44ff48
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x5a3e04]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
add eax, dword [esi + 0x90]
add ebp, dword [esi + 0x8c]
mov dword [esp + 0x18], eax
test edi, edi
jns 0x44ff7e
add ebp, edi
neg edi
mov ebx, dword [esp + 0x20]
test ebx, ebx
jns 0x44ff8e
add eax, ebx
neg ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
add eax, eax
cmp eax, edi
jle 0x44ffa3
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x28]
add ecx, ecx
cmp ecx, ebx
jle 0x44ffb8
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0xa4]
cmp eax, dword [esi + 0xac]
je 0x44ffd1
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [esp + 0x28]
push dword [esp + 0x28]
push ebx
push edi
push dword [esp + 0x28]
push ebp
push esi
call dword [esi + 8]
pop edi
pop esi
pop ebp
pop ebx
ret 0x18

Function at 0x44ffeb
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x5a3e04]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [esp + 0x14]
mov edi, eax
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
add eax, dword [edi + 0x90]
add ebp, dword [edi + 0x8c]
mov dword [esp + 0x18], eax
test esi, esi
jns 0x450021
add ebp, esi
neg esi
mov ebx, dword [esp + 0x20]
test ebx, ebx
jns 0x450031
add eax, ebx
neg ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
add eax, eax
cmp eax, esi
jle 0x450046
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x28]
add ecx, ecx
cmp ecx, ebx
jle 0x45005b
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
cmp eax, dword [edi + 0xac]
je 0x450072
push eax
push edi
mov dword [edi + 0xac], eax
call dword [edi + 0x40]
push dword [esp + 0x28]
push dword [esp + 0x28]
push ebx
push esi
push dword [esp + 0x28]
push ebp
push edi
call dword [edi + 8]
pop edi
pop esi
pop ebp
pop ebx
ret 0x1c

Function at 0x45008c
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, ebx
test esi, esi
je 0x4500e9
push esi
call dword [esi + 0x58]
mov ecx, dword [esi + 0x80]
mov edi, eax
mov dword [esi + 0x94], ecx
mov ecx, dword [esi + 0x84]
mov dword [esi + 0x98], ecx
test edi, edi
jne 0x4500e9
mov eax, dword [esi + 0x70]
test eax, eax
je 0x4500c8
push ebx
push esi
call eax
push esi
push ebx
push dword [0x59f0c0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [0x5a3e04]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x5a3e00], ebx
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x45094a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
mov ebx, dword [esp + 0x5c]
push ebp
xor ebp, ebp
push esi
test ebx, ebx
je 0x45095e
mov esi, ebx
jmp 0x450970
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
test esi, esi
je 0x450a5e
lea eax, [esp + 0x18]
push eax
push 0x18
pop eax
push eax
push dword [esp + 0x68]
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x450a53
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push edi
mov edi, dword [esp + 0x24]
push 0x2c
push 0
push eax
mov dword [esp + 0x20], ebp
call fcn.0043afb0
add esp, 0xc
mov dword [esp + 0x34], 0x28
xor eax, eax
mov dword [esp + 0x38], ebp
inc eax
mov dword [esp + 0x3c], edi
mov word [esp + 0x40], ax
xor ecx, ecx
push 0x18
pop eax
push ecx
push ecx
mov word [esp + 0x4a], ax
lea eax, [esp + 0x18]
push eax
push ecx
lea eax, [esp + 0x44]
mov dword [esp + 0x54], ecx
push eax
push esi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebp, eax
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x450a52
push 0
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x18]
push edi
push 0
push dword [esp + 0x78]
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
imul edi, dword [esp + 0x14]
test edi, edi
jle 0x450a52
mov ebp, dword [esp + 0x10]
push 3
pop ebx
movzx ecx, byte [ebp + 1]
xor edx, edx
movzx eax, byte [ebp + 2]
add eax, ecx
movzx ecx, byte [ebp]
add eax, ecx
div ebx
mov byte [ebp], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 1], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 2], al
mov ebp, dword [esp + 0x10]
add ebp, ebx
mov dword [esp + 0x10], ebp
sub edi, 1
jne 0x450a16
mov ebx, dword [esp + 0x68]
mov ebp, dword [esp + 0x18]
pop edi
test ebx, ebx
jne 0x450a5e
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x50
ret 8
Function at 0x452a80
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x452ab8
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x452ab3
xor eax, eax
cmp dword [esp + 0xc], esi
pop edi
sete al
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call fcn.0043d170
add dword [edi + 8], esi
add esp, 0xc
mov eax, 1
pop edi
pop esi
ret
Function at 0x456818
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x5a37b8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x456879
push esi
push dword [0x5a37b4]
push 8
push dword [0x59f0c0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x5a37b8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x5a37b0]
jmp 0x456869
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x456867
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x456857
push edi
push 0x4567b6
call fcn.004be8c0
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4

Function at 0x456883
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ecx, edi
and ecx, 3
je 0x456899
push 4
pop eax
sub eax, ecx
add edi, eax
mov esi, dword [0x5a37b4]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
jne 0x4568d2
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push edi
push 8
push dword [0x59f0c0]
mov dword [0x5a37b8], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x5a37b8]
call ebx
mov esi, dword [0x5a37b4]
lea eax, [edi + esi]
push eax
push dword [0x5a37b8]
mov dword [0x5a37b4], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x59f0c0]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x5a37b8]
call ebx
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test edi, edi
jne 0x456911
test ebx, ebx
je 0x456932
push 0x14
push 0x5a37b0
call fcn.00457140
pop ecx
pop ecx
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
test edi, edi
je 0x456932
lea ecx, [esi + ebp]
push ecx
call edi
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x4572a0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x59ed38]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [esp + 0x18]
mov edi, eax
mov ebp, dword [esp + 0x14]
mov esi, dword [edi + 8]
mov ecx, dword [ebp]
sub esi, ebx
lea eax, [esi + 0xa]
push eax
test ecx, ecx
jne 0x4572d9
push ecx
push dword [0x5a3f38]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x4572e8
push ecx
push 0
push dword [0x5a3f38]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
shr esi, 1
mov dword [ebp], ecx
mov eax, dword [edi]
push esi
add eax, ebx
push eax
push ecx
call fcn.00457600
mov dword [edi + 8], ebx
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x4573e0
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x59ed38]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add dword [eax + 8], 2
ret
Function at 0x4574e0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x59ed38]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [esp + 0x18]
mov esi, eax
cmp ebx, 0xffffffff
jne 0x4574fe
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x14]
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
lea ebp, [eax + eax]
add ecx, ebp
lea eax, [edx - 4]
cmp ecx, eax
jl 0x457522
lea eax, [ecx + 0x4000]
mov dword [esi + 4], eax
add eax, 0xa
jmp 0x45753d
cmp edx, 0x100000
jle 0x457550
cmp ecx, 0x100000
jge 0x457537
mov ecx, 0x100000
mov dword [esi + 4], ecx
lea eax, [ecx + 0xa]
push eax
push dword [esi]
push 0
push dword [0x5a3f38]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [esi], eax
lea eax, [ebx + ebp]
mov dword [esi + 8], eax
mov eax, dword [esi]
pop edi
pop esi
pop ebp
add eax, ebx
pop ebx
ret 8

Function at 0x457590
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x59ed38]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 4]
neg ecx
add ecx, ecx
add dword [eax + 8], ecx
ret 4

Function at 0x4575b0
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x59ed38]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov eax, dword [esp + 4]
mov edx, dword [ecx]
cmp eax, edx
jb 0x4575d7
mov ecx, dword [ecx + 8]
add ecx, edx
cmp eax, ecx
ja 0x4575d7
sub eax, edx
inc eax
ret 4
xor eax, eax
ret 4

Function at 0x4575e0
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x59ed38]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
mov eax, dword [esp + 4]
dec eax
add eax, ecx
ret 4

Function at 0x457640
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x59ed38]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
add eax, dword [esp + 4]
ret 4

Function at 0x4577d0
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x59ed38]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 4]
mov dword [eax + 8], ecx
mov eax, dword [eax]
add eax, ecx
ret 4

Function at 0x45b900
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x45b920
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x45b920
mov eax, dword [eax + 0x44]
test eax, eax
je 0x45b920
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x46e110
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x46e1c0
lea eax, [esp + 0x18]
push eax
push ebx
push 2
call fcn.0048af10
add esp, 0xc
test eax, eax
jne 0x46e1c0
lea eax, [esp + 4]
push eax
push ebx
push 0x17
call fcn.0048af10
add esp, 0xc
test eax, eax
jne 0x46e1c0
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x46e153
sub esi, ecx
push esi
push 0x2e
push ebx
call fcn.0048aee0
add esp, 0xc
test eax, eax
je 0x46e18b
sub eax, ebx
push eax
push 0x2e
push ebx
call fcn.0048aee0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x46e18b
inc edi
mov ecx, ebx
sub ecx, edi
add esi, ecx
test edi, edi
jne 0x46e18d
mov edi, ebx
add esi, edi
mov ebx, 0x1505
cmp edi, esi
jae 0x46e1b6
mov al, byte [edi]
push eax
call fcn.0047ea60
movsx ecx, al
inc edi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, esi
jb 0x46e198
pop edi
pop esi
movzx eax, bl
pop ebx
add esp, 0x10
ret
xor eax, eax
pop ebx
add esp, 0x10
ret

Function at 0x46e640
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x2f0], 2
je fcn.0046e5f0
mov al, 1
ret
Function at 0x47b750
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_recv]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x47b781
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov eax, dword [esp + 0x10]
mov dword [eax], ecx
xor eax, eax
ret

Function at 0x47bac0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov edx, dword [esp + 8]
sub esp, 0x80
xor eax, eax
push ebx
mov ebx, dword [esp + 0x88]
push ebp
push esi
mov esi, edx
mov ecx, dword [ebx + 0x1c4]
cmp edx, ecx
push edi
sete al
sub esi, ecx
neg esi
sbb esi, esi
and esi, 0xfffffff0
lea eax, [eax*4 + 0x1c0]
mov ebp, dword [eax + ebx]
add esi, 0x1f4
mov eax, dword [ebx + 0x2e8]
add esi, ebx
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x47bba4
xor eax, eax
cmp edx, ecx
sete al
lea eax, [eax*4 + 0x1d4]
cmp dword [eax + ebx], 0x47b7d0
jne 0x47bba4
cmp dword [esi], 0
je 0x47bb35
test edi, edi
je 0x47bba4
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.0047e640
add esp, 0x14
cmp eax, 0xffffffff
je 0x47bba4
test al, 1
je 0x47bba4
cmp dword [esi], 0
jne 0x47bb7e
mov eax, dword [ebx]
mov eax, dword [eax + 0x8fc]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x59ed44]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov ecx, dword [esi]
test ecx, ecx
je 0x47bb9d
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x47bba4
add dword [esi + 8], eax
jmp 0x47bba4
mov dword [esi + 4], 0
push 0
push dword [esp + 0xa4]
push dword [esp + 0xa4]
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
cmp edi, 0xffffffff
jne 0x47bc2e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x47bbed
mov ecx, dword [esp + 0xa4]
lea eax, [edi + 0x52]
pop edi
pop esi
pop ebp
mov dword [ecx], 0
pop ebx
add esp, 0x80
ret
push 0x80
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004990b0
push eax
push str.Send_failure:__s
push dword [ebx]
call fcn.0047b560
mov eax, dword [ebx]
add esp, 0x18
mov ecx, dword [esp + 0xa4]
mov dword [eax + 0xd14], esi
mov eax, 0x37
mov dword [ecx], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
mov ecx, dword [esp + 0xa4]
xor eax, eax
mov dword [ecx], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
Function at 0x47cc60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
push ebx
mov ebx, dword [esp + 0x190]
cmp dword [ebx + 0x90], 3
jne 0x47ce98
cmp byte [ebx + 0x2a5], 0
push ebp
push esi
push edi
jne 0x47ce2a
cmp byte [ebx + 0x2c0], 0
jne 0x47ce2a
mov esi, dword [esp + 0x1a0]
lea eax, [esp + 0x10]
mov ebp, dword [ebx]
push eax
lea eax, [esp + 0x11c]
mov dword [esp + 0x14], 0x80
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x47ccf4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x18]
push 0x80
push eax
push esi
call fcn.004990b0
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebp
call fcn.0047b560
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
push 0x80
lea eax, [esp + 0x9c]
mov dword [esp + 0x18], 0x80
push 0
push eax
call fcn.0043afb0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x9c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x47cd5e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x18]
push 0x80
push eax
push esi
call fcn.004990b0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebp
call fcn.0047b560
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
lea eax, [ebx + 0x138]
push eax
lea esi, [ebx + 0x10a]
push esi
push dword [esp + 0x18]
lea eax, [esp + 0x124]
push eax
call fcn.0047bef0
add esp, 0x10
test al, al
jne 0x47cdbe
call fcn.0042fb7f
mov esi, dword [eax]
call fcn.0042fb7f
mov edi, eax
lea eax, [esp + 0x18]
push 0x80
push eax
push esi
call fcn.004990b0
push eax
push dword [edi]
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebp
call fcn.0047b560
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
lea edi, [ebx + 0x5c]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
lea eax, [ebx + 0x16c]
push eax
lea eax, [ebx + 0x13c]
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0xa4]
movsw word es:[edi], word [esi]
push eax
call fcn.0047bef0
add esp, 0x10
test al, al
jne 0x47ce2a
call fcn.0042fb7f
mov esi, dword [eax]
call fcn.0042fb7f
mov edi, eax
lea eax, [esp + 0x18]
push 0x80
push eax
push esi
call fcn.004990b0
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebp
call fcn.0047b560
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
mov edi, dword [ebx]
lea esi, [ebx + 0x10a]
add edi, 0x1088
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xb
movsw word es:[edi], word [esi]
mov edi, dword [ebx]
lea esi, [ebx + 0x13c]
add edi, 0x10bc
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebx + 0x2e8]
mov ecx, dword [ebx]
pop edi
pop esi
mov eax, dword [eax]
mov dword [ecx + 0x10f0], eax
mov eax, dword [ebx + 0x2e8]
mov ecx, dword [ebx]
pop ebp
mov eax, dword [eax + 0x40]
mov dword [ecx + 0x10f4], eax
mov ecx, dword [ebx]
mov eax, dword [ebx + 0x138]
mov dword [ecx + 0x10b8], eax
mov ecx, dword [ebx]
mov eax, dword [ebx + 0x16c]
mov dword [ecx + 0x10ec], eax
pop ebx
add esp, 0x188
ret