joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4251d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1e000]
push edi
or ebp, 0xffffffff
jmp 0x4251f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4251f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4251e8
mov eax, 1
add ebx, ebx
jne 0x42520b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x425200
jne 0x42521c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x425200
xor ecx, ecx
sub eax, 3
jb 0x425230
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4252a2
mov ebp, eax
add ebx, ebx
jne 0x42523b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x425248
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42526c
inc ecx
add ebx, ebx
jne 0x425258
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42524d
jne 0x425269
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42524d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42528c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42527d
jmp 0x4251ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42528c
add edi, ecx
jmp 0x4251ee
pop esi
mov edi, esi
mov ecx, 0x547
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4252aa
cmp byte [edi], 9
jne 0x4252aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4252af
lea edi, [esi + 0x23000]
mov eax, dword [edi]
or eax, eax
je 0x42531e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x25100]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x251b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4252dc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x251b8]
or eax, eax
je 0x425318
mov dword [ebx], eax
add ebx, 4
jmp 0x4252f9
call dword [esi + 0x251bc]
popal
jmp 0x40b30c
Function at 0x405c41
Capabilities:
Get common file path

Disassembly:
push 4
mov eax, 0x43aa02
call fcn.00421920
mov esi, ecx
push 0
lea edi, [esi + 8]
push str.http:__
mov ecx, edi
call fcn.00404286
test eax, eax
je 0x405c7a
push 0
push str.ftp:__
mov ecx, edi
call fcn.00404286
test eax, eax
jne 0x405d0d
push 0x2f
push dword [edi]
call fcn.0042220d
pop ecx
pop ecx
test eax, eax
jne 0x405c8e
or eax, 0xffffffff
jmp 0x405c92
sub eax, dword [edi]
sar eax, 1
lea ebx, [eax + 1]
mov eax, dword [edi]
cmp ebx, dword [eax - 0xc]
jne 0x405ca5
mov ecx, edi
call fcn.00401451
jmp 0x405d0d
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], 1
push edi
call fcn.0040132a
add esi, 0x14
push 0x104
mov ecx, esi
call fcn.004017e6
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00401872
push ebx
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.0040610d
mov eax, dword [eax]
mov ecx, esi
and dword [ebp - 4], 0
push dword [eax - 0xc]
push eax
call fcn.00403e26
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00401856
push esi
mov ecx, edi
call fcn.0040132a
call fcn.004218ee
ret

Function at 0x405e74
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push 0x44
pop edi
push edi
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
mov esi, ecx
call fcn.00421080
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0x58], edi
push ebx
push eax
call fcn.00421080
mov eax, dword [esi + 8]
lea ecx, [esi + 8]
add esp, 0x18
push dword [eax - 0xc]
call fcn.004017e6
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x58]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x405efe
cmp dword [0x4539a4], ebx
je 0x405eed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [esi + 8]
push str.InstallUpdate:_CreateProcess_failed__Cmdline_s_Error_d_._n
push 0x453994
call fcn.004014f0
add esp, 0x10
mov ecx, 0x4538c8
call fcn.0040a75f
xor eax, eax
jmp 0x405f7f
mov esi, ebx
cmp dword [0x4539ac], ebx
jne 0x405f18
push ebx
push ebx
push ebx
push ebx
push 0x43d294
call fcn.00412d92
mov esi, eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test esi, esi
je 0x405f43
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x405f32
mov eax, ebx
jmp 0x405f35
mov eax, dword [eax + 0x20]
push ebx
push ebx
push 0x405
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor edi, edi
inc edi
test eax, eax
je 0x405f6d
mov ecx, dword [0x4539a8]
cmp dword [ebp - 4], 0xbc2
cmove ecx, edi
mov dword [0x4539a8], ecx
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4066a3
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 4
push ebx
push ebx
push 0x43cbc8
call fcn.00412d92
mov dword [esi + 0x20], eax
mov dword [eax + 0x44], 0x3f1
mov eax, dword [esi + 0x20]
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, ebx
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4066dd
cmp dword [eax + 0x20], ebx
jne 0x4066ed
cmp edi, 2
jge 0x4066ed
push 0x64
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4066d1
mov ecx, eax
pop edi
mov eax, dword [ecx + 0x20]
mov dword [esi + 0x24], eax
mov eax, dword [ecx + 0x2c]
mov dword [esi + 0x28], eax
pop esi
pop ebx
ret

Function at 0x4075c6
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, 0x3ff
and ax, cx
movzx eax, ax
cmp eax, 1
je 0x4075e9
cmp eax, 0xd
je 0x4075e9
mov eax, dword [ebp + 0xc]
jmp 0x4075f1
mov eax, dword [ebp + 0xc]
or eax, 0x100000
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
push 0x4538c8
call fcn.00417bd4
add esp, 0x10
pop ebp
ret

Function at 0x4087cd
Capabilities:
Query environment variable

Disassembly:
push 0x20
mov eax, 0x439f2d
call fcn.00421920
mov edi, dword [ebp + 8]
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.004013b4
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
mov ebx, 0x104
push ebx
mov ecx, edi
call fcn.004017e6
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00401856
push 0xffffffffffffffff
mov ecx, edi
call fcn.00401872
lea ecx, [ebp - 0x2c]
call fcn.0041557b
mov eax, dword [edi]
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
cmp dword [eax - 0xc], 0
je 0x40887a
push 0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00415818
test eax, eax
je 0x40887a
lea ecx, [ebp - 0x2c]
call fcn.004159c0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00415ad9
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.0040132a
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], bl
lea ecx, [ecx - 0x10]
call fcn.00401856
lea ecx, [ebp - 0x2c]
call fcn.004157cc
jmp 0x40887c
xor ebx, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041572c
mov eax, ebx
call fcn.004218ee
ret 4
Function at 0x113d31b8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.113d3308
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x113d31de
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x113d31ca
add dl, dl
jne 0x113d31e9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x113d323c
xor eax, eax
add dl, dl
jne 0x113d31f6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x113d32dd
add dl, dl
jne 0x113d3205
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x113d3210
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x113d321b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x113d3226
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x113d3232
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x113d31d5
mov eax, 1
add dl, dl
jne 0x113d324a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x113d3255
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x113d3241
sub eax, ebx
mov ebx, 1
jne 0x113d3288
mov ecx, 1
add dl, dl
jne 0x113d326e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x113d3279
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x113d3265
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x113d31d5
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x113d329f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x113d32aa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x113d3296
cmp eax, 0x7d00
jae 0x113d32cd
cmp eax, 0x500
jb 0x113d32c8
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x113d31d5
cmp eax, 0x7f
ja 0x113d32d0
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x113d31d5
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x113d32fe
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x113d31d5
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp int.00401219
Function at 0x401340
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c233
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x469a54]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
xor eax, eax
lea ebx, [edi + 0xc]
mov word [edi], ax
mov dword [edi + 4], eax
mov word [edi + 8], ax
mov dword [ebx], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], 0xf
mov byte [ebx], al
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], 0xf
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x48], 0xf
mov dword [ebx + 0x4c], eax
mov byte [ebp - 4], 3
lea esi, [edi + 0x68]
mov dword [edi + 0x5c], eax
mov dword [edi + 0x60], eax
mov dword [edi + 0x64], eax
push 0x14
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0042ef08
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 4
cmp ebx, eax
je 0x401404
cmp dword [ebp + 0x20], 0x10
mov ecx, ebx
push dword [ebp + 0x1c]
cmovae eax, dword [ebp + 0xc]
push eax
call fcn.00402250
lea ecx, [edi + 0x40]
lea eax, [ebp + 0x40]
cmp ecx, eax
je 0x40141f
cmp dword [ebp + 0x54], 0x10
push dword [ebp + 0x50]
cmovae eax, dword [ebp + 0x40]
push eax
call fcn.00402250
lea ecx, [edi + 0x24]
lea eax, [ebp + 0x24]
cmp ecx, eax
je 0x40143a
cmp dword [ebp + 0x38], 0x10
push dword [ebp + 0x34]
cmovae eax, dword [ebp + 0x24]
push eax
call fcn.00402250
mov ecx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x3c]
mov dword [edi + 0x3c], eax
cmp ecx, 0x10
jb 0x401474
mov edx, dword [ebp + 0xc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40146a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40150e
push ecx
push edx
call fcn.0042f189
add esp, 8
mov ecx, dword [ebp + 0x38]
mov dword [ebp + 0x1c], 0
mov dword [ebp + 0x20], 0xf
mov byte [ebp + 0xc], 0
cmp ecx, 0x10
jb 0x4014b6
mov edx, dword [ebp + 0x24]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4014ac
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40150e
push ecx
push edx
call fcn.0042f189
add esp, 8
mov ecx, dword [ebp + 0x54]
mov dword [ebp + 0x34], 0
mov dword [ebp + 0x38], 0xf
mov byte [ebp + 0x24], 0
cmp ecx, 0x10
jb 0x4014f8
mov edx, dword [ebp + 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4014ee
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40150e
push ecx
push edx
call fcn.0042f189
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x50
call fcn.00432a12
int3
Function at 0x40b6c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x14c], 0
je 0x40b6ed
call fcn.0041cc60
test eax, eax
je 0x40b6ed
push dword [edi + 0x14c]
call fcn.0041cd40
add esp, 4
test eax, eax
je 0x40b78b
push esi
mov esi, dword [esp + 0x10]
movzx eax, word [esi + 8]
test al, 1
jne 0x40b71a
mov eax, dword [esi + 0x1c]
push 1
cdq
push edx
push eax
push esi
push str.event_queue_remove_timeout
push str._s:__p_fd__I64d__not_on_queue__x
push 1
call fcn.0041bd20
add esp, 0x1c
pop esi
pop edi
ret
sar eax, 4
not eax
and eax, 1
sub dword [edi + 0x78], eax
and word [esi + 8], 0xfffe
mov ecx, dword [esi + 0x3c]
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x50000000
jne 0x40b778
sar ecx, 0x14
movzx ecx, cl
cmp ecx, dword [edi + 0xb4]
jge 0x40b778
mov eax, dword [edi + 0xb0]
mov edx, dword [eax + ecx*4]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
test ecx, ecx
je 0x40b76a
mov dword [ecx + 0x18], eax
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
pop esi
pop edi
mov dword [ecx], eax
ret
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
pop esi
pop edi
mov dword [ecx], eax
ret
lea eax, [edi + 0xd8]
push esi
push eax
call fcn.00408830
add esp, 8
pop esi
pop edi
ret
push 0x45ab50
push 0x45ab6c
push 0xc92
push 0x45aba0
push 0x45aba8
push 0xdeaddead
call fcn.0041bd20
add esp, 0x18
push 0x45abcc
push 0x45abe8
push 0xc92
push 0x45ac1c
push 0x45ac24
push 2
call fcn.00434b42
add esp, 4
push eax
call fcn.004046e0
add esp, 0x18
call fcn.00435eff
int3
Function at 0x410a70
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov dword [esp + 0xc], 1
push edi
test esi, esi
je 0x410a8a
movzx ecx, word [esi]
jmp 0x410a8c
xor ecx, ecx
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x410b8c
mov ebx, dword [esp + 0x24]
mov edx, 0x4000001
mov eax, ebx
and eax, 4
mov dword [esp + 0x2c], eax
mov eax, 0x84000001
push 0
cmove eax, edx
push eax
push ecx
call fcn.0041a000
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x410b8c
push 4
lea eax, [esp + 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
js 0x410b83
test bl, 8
je 0x410afc
push edi
call fcn.00417b80
add esp, 4
test eax, eax
js 0x410b83
test bl, bl
jns 0x410b0d
push edi
call fcn.00417b90
add esp, 4
test eax, eax
js 0x410b83
test bl, 0x40
je 0x410b1f
push edi
call fcn.00417bc0
add esp, 4
test eax, eax
js 0x410b83
test esi, esi
je 0x410b33
push dword [esp + 0x30]
push esi
push edi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
js 0x410b83
mov esi, dword [esp + 0x18]
test esi, esi
je 0x410b73
push esi
call fcn.00420560
add esp, 4
test eax, eax
je 0x410b73
call fcn.004201c0
cmp dword [eax], 0
je 0x410b73
cmp dword [eax + 8], 0
je 0x410b73
push edi
push ebp
push ebx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push esi
call fcn.00410e80
add esp, 0x18
mov esi, eax
jmp 0x410c3a
test ebp, ebp
jle 0x410b94
push ebp
push edi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jns 0x410ba6
push edi
call fcn.00417bb0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
jns 0x410ba6
push 0x80
push edi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
js 0x410b83
push 0x64
push 1
call fcn.00408570
mov esi, eax
add esp, 8
test esi, esi
je 0x410b83
mov eax, dword [esp + 0x1c]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov eax, 1
mov word [esi + 0x18], ax
xor eax, eax
mov dword [esi], 0x44d324
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], 0
test bl, 1
jne 0x410bf2
mov dword [esi + 0x1c], 0x4000000
mov eax, 0x4000000
cmp dword [esp + 0x2c], 0
je 0x410c01
or eax, 0x80000000
mov dword [esi + 0x1c], eax
test bl, 0x10
je 0x410c13
push 1
call fcn.0041cc70
add esp, 4
mov dword [esi + 4], eax
push esi
push 0x411220
push 0x12
push edi
push dword [esp + 0x28]
lea eax, [esi + 0x24]
push eax
call fcn.00406aa0
add esp, 0x18
test bl, 0x20
jne 0x410c3a
push esi
call fcn.00410c90
add esp, 4
test esi, esi
je 0x410b83
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x411810
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.004201c0
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0
push 1
mov dword [esp + 0x18], 0
movzx ecx, byte [esi + 0x51]
push ecx
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
mov eax, dword [esi + 0x4c]
test byte [eax + 0x20], 1
je 0x411907
cmp edi, 0xffffffff
jne 0x411856
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x4118f2
push 4
add eax, 0x24
push eax
push 0x700b
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [esi + 0x4c]
test byte [eax + 0x14], 1
jne 0x411882
push edi
call fcn.00417b40
mov eax, dword [esi + 0x4c]
add esp, 4
push 1
push edi
push dword [eax + 0x2c]
call fcn.00420460
add esp, 0xc
test eax, eax
jns 0x4118a4
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
movzx eax, byte [esi + 0x50]
lea ebx, [esi + 0x18]
push ebx
shr eax, 1
lea ecx, [esp + 0x14]
push ecx
push eax
push eax
push 0
lea eax, [esi + 0x58]
mov dword [esi + 0x30], edi
push eax
mov eax, dword [esi + 0x4c]
push edi
push dword [eax + 0x24]
mov eax, dword [ebp]
call eax
test eax, eax
je 0x4118e5
push 1
push 0
push 1
push ebx
call fcn.00411410
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x411907
mov dword [esi + 0x34], eax
lea eax, [esi + 0x38]
push eax
mov eax, dword [esi + 0x4c]
push dword [eax + 0x28]
call fcn.00408bf0
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x413410
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x469a54]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
mov ebp, dword [esp + 0x94]
push esi
push edi
or edi, 0xffffffff
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x413444
push eax
push 0
call fcn.0041ccb0
add esp, 8
test byte [ebp + 0x1c], 2
jne 0x413509
mov esi, dword [esp + 0xa4]
test esi, esi
js 0x41345e
cmp esi, dword [ebp + 0xc]
jbe 0x413461
mov esi, dword [ebp + 0xc]
test esi, esi
jle 0x413509
mov edi, dword [ebp]
xor ebx, ebx
cmp dword [ebp + 0x18], ebx
je 0x41348f
call fcn.0041cc60
test eax, eax
je 0x41348f
push dword [ebp + 0x18]
call fcn.0041cd40
add esp, 4
test eax, eax
je 0x413536
test edi, edi
je 0x413507
cmp ebx, 0x10
jge 0x4134c8
test esi, esi
je 0x4134c8
mov eax, dword [edi + 0x18]
lea ecx, [ebx*8]
add eax, dword [edi + 8]
inc ebx
mov dword [esp + ecx + 0x18], eax
mov eax, dword [edi + 0xc]
cmp esi, eax
jb 0x4134c4
mov dword [esp + ecx + 0x14], eax
sub esi, dword [edi + 0xc]
mov edi, dword [edi]
test edi, edi
jne 0x413493
jmp 0x4134c8
mov dword [esp + ecx + 0x14], esi
test ebx, ebx
je 0x413507
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push ebx
lea eax, [esp + 0x28]
push eax
push dword [esp + 0xb8]
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x4134f3
or edi, 0xffffffff
jmp 0x413509
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x413509
push edi
push ebp
call fcn.00413250
add esp, 8
jmp 0x413509
xor edi, edi
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x41351b
push eax
push 0
call fcn.0041ccc0
add esp, 8
mov ecx, dword [esp + 0x94]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042eefa
add esp, 0x88
ret
push 0x45f9e4
push 0x45f9fc
push 0x96d
push 0x45fa2c
push 0x45fa38
push 0xdeaddead
call fcn.0041bd20
add esp, 0x18
push str.evbuffer_write_iovec
push str.evthread_is_debug_lock_held___buffer___lock_
push 0x96d
push 0x45faa4
push 0x45fab0
push 2
call fcn.00434b42
add esp, 4
push eax
call fcn.004046e0
add esp, 0x18
call fcn.00435eff
int3
Function at 0x413590
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
sub esp, 0x50
mov eax, dword [0x469a54]
xor eax, esp
mov dword [esp + 0x4c], eax
push esi
push edi
mov edi, dword [esp + 0x5c]
mov eax, dword [edi + 0x18]
test eax, eax
je 0x4135b6
push eax
push 0
call fcn.0041ccb0
add esp, 8
test byte [edi + 0x1c], 4
je 0x4135c4
or esi, 0xffffffff
jmp 0x413713
push ebx
mov ebx, dword [esp + 0x64]
lea eax, [esp + 0xc]
push eax
push 0x4004667f
push ebx
mov dword [esp + 0x18], 0x1000
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
js 0x4135f5
mov eax, dword [esp + 0xc]
test eax, eax
jle 0x4135f5
cmp eax, 0x1000
jle 0x4135fa
mov eax, 0x1000
mov esi, dword [esp + 0x68]
test esi, esi
js 0x413606
cmp esi, eax
jle 0x413608
mov esi, eax
push 4
push esi
push edi
call fcn.00414f30
add esp, 0xc
cmp eax, 0xffffffff
jne 0x413620
or esi, eax
jmp 0x413712
push ebp
push 1
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x28]
push eax
push esi
push edi
call fcn.00415300
mov ebp, eax
add esp, 0x18
xor ecx, ecx
test ebp, ebp
jle 0x413656
mov eax, dword [esp + ecx*8 + 0x1c]
mov dword [esp + ecx*8 + 0x40], eax
mov eax, dword [esp + ecx*8 + 0x20]
mov dword [esp + ecx*8 + 0x3c], eax
inc ecx
cmp ecx, ebp
jl 0x413641
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x20]
push eax
push ebp
lea eax, [esp + 0x50]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x413692
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2745
je 0x4136a3
or esi, 0xffffffff
jmp 0x413711
mov esi, dword [esp + 0x14]
cmp esi, 0xffffffff
jne 0x41369f
or esi, esi
jmp 0x413711
test esi, esi
jne 0x4136a7
xor esi, esi
jmp 0x413711
mov dword [esp + 0x10], 0
mov ebx, esi
test ebp, ebp
jle 0x413702
mov edx, dword [esp + 0x18]
mov dword [esp + 0x14], accept
mov ecx, dword [edx]
test byte [ecx + 0x10], 8
je 0x4136cd
xor eax, eax
jmp 0x4136e0
mov eax, dword [ecx + 4]
sub eax, dword [ecx + 0xc]
sub eax, dword [ecx + 8]
cmp eax, 0x7fffffff
cmova eax, dword [esp + 0x14]
cmp eax, ebx
jge 0x4136fa
add dword [ecx + 0xc], eax
sub ebx, eax
mov eax, dword [esp + 0x10]
mov edx, dword [edx]
inc eax
mov dword [esp + 0x10], eax
cmp eax, ebp
jl 0x4136c1
jmp 0x413702
mov eax, ecx
add dword [eax + 0xc], ebx
mov dword [edi + 8], edx
add dword [edi + 0xc], esi
add dword [edi + 0x10], esi
push edi
call fcn.00415470
add esp, 4
pop ebp
pop ebx
mov eax, dword [edi + 0x18]
test eax, eax
je 0x413725
push eax
push 0
call fcn.0041ccc0
add esp, 8
mov ecx, dword [esp + 0x54]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0042eefa
add esp, 0x50
ret

Function at 0x417b40
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x10], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x417b79
push esi
push str.fcntl__d__F_GETFL_
push esi
call fcn.0041bc20
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret