joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bb20
Capabilities:
Set socket configuration

Disassembly:
push ebx
sub esp, 0x48
fild dword [esp + 0x54]
fdiv dword [0x460180]
mov dword [esp + 0x10], 4
fnstcw word [esp + 0x2e]
mov ebx, dword [esp + 0x50]
mov dword [esp + 8], 0x1005
mov dword [esp + 4], 0xffff
movzx eax, word [esp + 0x2e]
or ah, 0xc
mov word [esp + 0x2c], ax
fldcw word [esp + 0x2c]
fistp qword [esp + 0x20]
fldcw word [esp + 0x2e]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x60]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
test eax, eax
js 0x40bb90
add esp, 0x48
pop ebx
ret
cmp dword [ebx + 0x60], 0x1005
jne 0x40bb8a
mov dword [esp + 8], 0x13e
mov dword [esp + 4], str.PerfSocket.cpp
mov dword [esp], str.socket
call sym._warn_errno
jmp 0x40bb8a

Function at 0x40bbc0
Capabilities:
Set socket configuration

Disassembly:
push ebx
sub esp, 0x48
fild dword [esp + 0x54]
fdiv dword [0x460180]
mov dword [esp + 0x10], 4
fnstcw word [esp + 0x2e]
mov ebx, dword [esp + 0x50]
mov dword [esp + 8], 0x1006
mov dword [esp + 4], 0xffff
movzx eax, word [esp + 0x2e]
or ah, 0xc
mov word [esp + 0x2c], ax
fldcw word [esp + 0x2c]
fistp qword [esp + 0x20]
fldcw word [esp + 0x2e]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x60]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
test eax, eax
js 0x40bc30
add esp, 0x48
pop ebx
ret
cmp dword [ebx + 0x60], 0x1006
jne 0x40bc2a
mov dword [esp + 8], 0x14e
mov dword [esp + 4], str.PerfSocket.cpp
mov dword [esp], str.socket
call sym._warn_errno
jmp 0x40bc2a

Function at 0x40bc60
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
test byte [eax + 0x81], 8
jne 0x40bc78
test edx, edx
jle 0x40bc9a
test byte [eax + 0x78], 8
je 0x40bca0
mov dword [esp + 8], 0x15e
mov dword [esp + 4], str.PerfSocket.cpp
mov dword [esp], str.IPV6_TCLASS_not_supported
call sym._warn_errno
add esp, 0x1c
ret
add esp, 0x1c
jmp sym._SetSocketOptionsIPTos.part.0

Function at 0x40bd50
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x2c
xor edx, edx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
test ecx, ecx
js 0x40bd8c
xor eax, 1
mov dword [esp + 4], 0x8004667e
movzx eax, al
mov dword [esp], ecx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
sub esp, 0xc
test eax, eax
sete dl
mov eax, edx
add esp, 0x2c
ret
Function at 0x421180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xcc
mov eax, dword [esp + 0xe4]
mov ebx, dword [esp + 0xe0]
mov dword [esp + 0x24], eax
mov eax, dword [ebx]
mov edi, dword [eax + 0x10]
mov edx, dword [eax]
lea esi, [eax + 0x100]
and edi, 0x40004
mov dword [esp + 0x28], edi
lea edi, [eax + 0x78]
cmp edx, 1
jne 0x4211c3
mov esi, edi
lea edi, [eax + 0x100]
movzx ecx, word [esi]
cmp cx, 2
je 0x4212b8
cmp cx, 0x17
je 0x421388
mov byte [esp + 0x3c], 0
lea ebp, [esp + 0x3c]
xor ecx, ecx
cmp word [edi], 2
je 0x421248
cmp word [esi], 0x17
je 0x421340
mov byte [esp + 0x7e], 0
lea esi, [esp + 0x7e]
xor eax, eax
mov dword [esp + 0x18], eax
lea eax, [ebx + 0x770]
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ecx
mov dword [esp + 8], str._s__u__s__u
mov dword [esp + 4], 0xac
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__snprintf]
mov byte [ebx + 0x81b], 0
add esp, 0xcc
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx]
lea esi, [esp + 0x7e]
mov dword [esp + 0x2c], ecx
test byte [eax + 0x14], 0x80
lea eax, [edi + 4]
mov dword [esp + 8], esi
mov dword [esp + 0xc], 0x42
mov dword [esp + 4], eax
mov dword [esp], 2
jne 0x421330
call sym._inet_ntop
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x421292
cmp byte [esp + 0x24], 0
jne 0x4211fe
movzx eax, word [edi + 2]
mov dword [esp + 0x24], ecx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ntohs]
sub esp, 4
movzx eax, ax
mov ecx, dword [esp + 0x24]
jmp 0x421200
test byte [eax + 0x14], 0x80
lea ebp, [esp + 0x3c]
lea eax, [esi + 4]
mov dword [esp + 0x2c], edx
mov dword [esp + 0xc], 0x42
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
mov dword [esp], 2
jne 0x421320
call sym._inet_ntop
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
test ecx, ecx
jne 0x4212fc
cmp byte [esp + 0x24], 0
jne 0x4211e3
movzx eax, word [esi + 2]
mov dword [esp + 0x2c], edx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ntohs]
sub esp, 4
movzx ecx, ax
mov edx, dword [esp + 0x2c]
jmp 0x4211e5
call sym._inet_ntop_hide
mov edx, dword [esp + 0x2c]
jmp 0x4212e9
call sym._inet_ntop_hide
mov ecx, dword [esp + 0x2c]
jmp 0x42127f
lea eax, [edi + 8]
lea esi, [esp + 0x7e]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0xc], 0x42
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], 0x17
mov dword [esp + 0x28], edx
call sym._inet_ntop
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
cmp edx, 1
jne 0x421287
jmp 0x421292
lea eax, [esi + 8]
lea ebp, [esp + 0x3c]
mov dword [esp + 0x2c], edx
mov dword [esp + 0xc], 0x42
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
mov dword [esp], 0x17
call sym._inet_ntop
mov edx, dword [esp + 0x2c]
cmp edx, 1
je 0x4212f1
jmp 0x4212fc
Function at 0x427fb0
Capabilities:
Query environment variable

Disassembly:
push esi
mov eax, str.IPERF_IPV6_DOMAIN
push ebx
mov ebx, 0x46308c
sub esp, 0x14
mov esi, dword [esp + 0x20]
lea esi, [esi]
nop
mov dword [esp], eax
call sym._getenv
test eax, eax
je 0x427fe7
mov dword [esp + 8], esi
mov dword [esp + 4], eax
movsx eax, byte [ebx]
mov dword [esp], eax
call sym.Settings_Interpret_char__char_const__thread_Settings_
mov eax, dword [ebx + 4]
add ebx, 0x10
test eax, eax
jne 0x427fc8
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x42a320
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [0x45901c], 1
mov edi, dword [esp + 0x50]
mov esi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
jmp 0x42a359
mov edx, dword [0x478684]
movsx eax, al
mov dword [esp + 8], ebp
mov dword [esp], eax
mov dword [esp + 4], edx
call sym.Settings_Interpret_char__char_const__thread_Settings_
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x463720
mov dword [esp + 8], str.146b:c:def:hi:l:mn:o:p:rst:uvw:x:y:zAB:CDF:H:IL:M:NP:RS:T:UVWXZ:
mov dword [esp + 4], esi
mov dword [esp], edi
call sym._gnu_getopt_long
cmp eax, 0xffffffff
jne 0x42a340
mov ebx, dword [0x459020]
cmp edi, ebx
jle 0x42a3cf
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], ebp
lea esi, [esi]
mov edi, dword [esi + ebx*4]
mov ebp, dword [esi]
mov dword [esp], 2
add ebx, 1
call dword [0x459154]
mov dword [esp + 4], str._s:_ignoring_extra_argument_____s_n
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebp
mov dword [esp], eax
call sym.fprintf__iobuf__char_const__..._
cmp dword [esp + 0x28], ebx
jne 0x42a398
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x50], ebp
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp sym.Settings_ModalOptions_thread_Settings_
Function at 0x42e720
Capabilities:
Access the windows event log

Disassembly:
push edi
push esi
push ebx
sub esp, 0x140
mov esi, dword [esp + 0x150]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], str.IPerfService
mov dword [0x478800], eax
mov dword [esp], 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
sub esp, 8
mov ebx, eax
mov dword [esp], esi
lea edi, [esp + 0x40]
call sym._printf_2
mov eax, dword [0x478800]
mov dword [esp + 8], str.IPerfService
mov dword [esp + 4], str._s_error:__d
mov dword [esp + 0xc], eax
mov dword [esp], edi
call sym._sprintf_3
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], esi
test ebx, ebx
je 0x42e7e6
lea eax, [esp + 0x38]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
sub esp, 0x24
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
sub esp, 4
add esp, 0x140
pop ebx
pop esi
pop edi
ret
Function at 0x42eb80
Capabilities:
Create service
Query service status
Start service

Disassembly:
push edi
push esi
push ebx
sub esp, 0x240
lea edi, [esp + 0x40]
mov dword [esp + 8], 0x200
mov dword [esp + 4], edi
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
test eax, eax
je 0x42ec58
mov dword [esp + 8], 0xf003f
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x42ec90
mov dword [esp + 8], 0xf01ff
mov dword [esp + 4], str.IPerfService
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x42ed20
mov dword [esp + 4], str.IPerf_Service
mov dword [esp], str._s_already_installed._n
call sym._printf_2
mov dword [esp + 4], 0x478808
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
sub esp, 8
test eax, eax
jne 0x42ecc0
mov dword [esp], esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
sub esp, 4
mov dword [esp], ebx
call esi
sub esp, 4
add esp, 0x240
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], 0x100
mov dword [esp], 0x478700
call sym._GetLastErrorText
mov dword [esp + 4], str.IPerf_Service
mov dword [esp + 8], eax
mov dword [esp], str.Unable_to_install__s____s_n
call sym._printf_2
add esp, 0x240
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], 0x100
mov dword [esp], 0x478700
call sym._GetLastErrorText
mov dword [esp], str.OpenSCManager_failed____s_n
mov dword [esp + 4], eax
call sym._printf_2
add esp, 0x240
pop ebx
pop esi
pop edi
ret
cmp dword [0x47880c], 1
jne 0x42ec31
mov eax, dword [esp + 0x254]
mov dword [esp], esi
add eax, 4
mov dword [esp + 8], eax
mov eax, dword [esp + 0x250]
sub eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
sub esp, 0xc
test eax, eax
je 0x42ec31
mov dword [esp + 4], str.IPerf_Service
mov dword [esp], str._s_started._n
call sym._printf_2
jmp 0x42ec31
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0x464376
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 3
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], 0xf01ff
mov dword [esp + 8], str.IPerf_Service
mov dword [esp + 4], str.IPerfService
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
sub esp, 0x34
mov esi, eax
test eax, eax
jne 0x42ec15
mov dword [esp + 4], 0x100
mov dword [esp], 0x478700
call sym._GetLastErrorText
mov dword [esp], str.CreateService_failed____s_n
mov dword [esp + 4], eax
call sym._printf_2
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x42ec3f
Function at 0x42edd0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp + 8], 0xf003f
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
sub esp, 0xc
test eax, eax
je 0x42eeb8
mov dword [esp + 8], 0xf01ff
mov ebx, eax
mov dword [esp + 4], str.IPerfService
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x42ee98
mov dword [esp + 8], 0x478808
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
sub esp, 0xc
test eax, eax
jne 0x42ef10
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
sub esp, 4
test eax, eax
jne 0x42eef0
mov dword [esp + 4], 0x100
mov dword [esp], 0x478700
call sym._GetLastErrorText
mov dword [esp], str.DeleteService_failed____s_n
mov dword [esp + 4], eax
call sym._printf_2
mov dword [esp], esi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, 1
call edi
sub esp, 4
jmp 0x42eea0
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
mov dword [esp], ebx
call edi
mov eax, esi
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x100
xor esi, esi
mov dword [esp], 0x478700
call sym._GetLastErrorText
mov dword [esp], str.OpenSCManager_failed____s_n
mov dword [esp + 4], eax
call sym._printf_2
add esp, 0x1c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], str.IPerf_Service
mov dword [esp], str._s_removed._n
call sym._printf_2
jmp 0x42ee7f
mov dword [esp + 4], str.IPerf_Service
mov dword [esp], str.Stopping__s.
call sym._printf_2
mov dword [esp], 0x3e8
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
call ebp
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
sub esp, 4
jmp 0x42ef5d
cmp eax, 3
jne 0x42ef76
mov dword [esp], 0x4643de
call sym._printf_2
mov dword [esp], 0x3e8
call ebp
sub esp, 4
mov dword [esp + 4], 0x478808
mov dword [esp], esi
call edi
sub esp, 8
test eax, eax
mov eax, dword [0x47880c]
jne 0x42ef40
mov dword [esp + 4], str.IPerf_Service
cmp eax, 1
je 0x42ef98
mov dword [esp], str._n_s_failed_to_stop._n
call sym._printf_2
jmp 0x42ee47
mov dword [esp], str._n_s_stopped._n
call sym._printf_2
jmp 0x42ee47
Function at 0x42f190
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov ebx, dword [esp + 0x48]
mov edx, esi
and edx, 2
jne 0x42f200
mov esi, ebx
test ebx, ebx
jle 0x42f233
mov eax, dword [0x4786e0]
test eax, eax
jne 0x42f1f2
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ebp
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
cmp eax, 0xffffffff
je 0x42f240
test eax, eax
je 0x42f2d0
sub esi, eax
mov edx, ebx
add edi, eax
sub edx, esi
test esi, esi
jg 0x42f1b4
add esp, 0x2c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
xor edx, edx
cmp edx, ebx
je 0x42f1f2
mov ecx, dword [0x4786e0]
test ecx, ecx
jne 0x42f1f2
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], ebp
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
mov edx, eax
cmp eax, 0xffffffff
je 0x42f290
test eax, eax
jne 0x42f202
add esp, 0x2c
xor edx, edx
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 0xfffffffe
cmp eax, 0x2733
je 0x42f1f2
mov dword [esp + 8], 0x99
mov dword [esp + 4], str.socket_io.c
mov dword [esp], str.recvn
call sym._warn_errno
mov dword [0x4786e0], 1
mov edx, 0xffffffff
add esp, 0x2c
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x1c], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [esp + 0x1c]
cmp eax, 0x2733
je 0x42f202
mov dword [esp + 8], 0x79
mov dword [esp + 4], str.socket_io.c
mov dword [esp], str.recvn_peek
call sym._warn_errno
jmp 0x42f26e
sub ebx, esi
add esp, 0x2c
mov edx, ebx
pop ebx
pop esi
mov eax, edx
pop edi
pop ebp
ret
Function at 0x42f2e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
xor ecx, ecx
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [esp + 0x48]
mov ebx, dword [esp + 0x44]
mov esi, dword [esp + 0x4c]
mov ebp, edi
test edi, edi
jle 0x42f342
lea esi, [esi]
nop
mov eax, dword [0x4786e0]
test eax, eax
jne 0x42f342
mov eax, dword [esp + 0x40]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebp
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_send]
add dword [esi], 1
sub esp, 0x10
cmp eax, 0xffffffff
je 0x42f370
test eax, eax
jne 0x42f350
mov eax, dword [0x4786e0]
mov ecx, edi
sub ecx, ebp
test eax, eax
je 0x42f309
add esp, 0x2c
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
sub ebp, eax
mov ecx, edi
add ebx, eax
sub ecx, ebp
test ebp, ebp
jg 0x42f300
add esp, 0x2c
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x42f335
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 0xb
je 0x42f335
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 0x8c
je 0x42f335
sub edi, ebp
mov dword [esp + 0x1c], edi
call dword [sym.imp.msvcrt.dll__errno]
mov ebx, dword [eax]
mov dword [esp], 1
call dword [0x459154]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], str.FAIL:_writen_errno___d__bytes_d__n
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
mov dword [esp], eax
call sym._fprintf.constprop.0
mov ecx, dword [esp + 0x1c]
jmp 0x42f342

Function at 0x430060
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x3c
xor eax, eax
mov edx, dword [esp + 0x44]
test edx, edx
jle 0x4300b0
mov eax, dword [esp + 0x48]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x10], 4
test eax, eax
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], eax
je 0x4300b8
mov dword [esp + 8], 0x1001
mov eax, dword [esp + 0x40]
mov dword [esp + 4], 0xffff
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
xor edx, edx
sub esp, 0x14
test eax, eax
cmovg eax, edx
add esp, 0x3c
ret
mov dword [esp + 8], 0x1002
jmp 0x430091

Function at 0x431070
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx + 0x2e8]
test eax, eax
jne 0x431090
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp], 0x47884c
call sym._pthread_mutex_lock
mov eax, dword [ebx + 0x84]
sub dword [0x478860], 1
sub eax, 1
cmp eax, 1
jbe 0x431110
mov dword [esp], 0x478848
call sym._pthread_cond_signal
mov dword [esp], 0x47884c
call sym._pthread_mutex_unlock
mov esi, dword [ebx + 0x2e8]
call sym._pthread_self
cmp esi, eax
jne 0x4310f8
mov dword [esp], ebx
call sym._Settings_Destroy
mov dword [esp + 0x20], 0
add esp, 0x14
pop ebx
pop esi
jmp sym._pthread_exit
mov dword [esp + 0x20], ebx
add esp, 0x14
pop ebx
pop esi
jmp sym._Settings_Destroy
sub dword [0x47885c], 1
jmp 0x4310b1
Function at 0x43bec0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x43bf20
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x478930]
test esi, esi
jle 0x43c040
mov eax, dword [0x478934]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x43bf54
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x43bfd7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x43bf40
mov dword [esp], ebx
call sym.___mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x43c067
mov eax, dword [0x478934]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
mov edx, dword [0x478934]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x43c047
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x43bfd0
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x43bfe0
add dword [0x478930], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x478934]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x43bfd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x43bf5e
mov eax, dword [0x478934]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
lea esi, [esi]
nop
Function at 0x43c590
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x47894c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x478944]
sub esp, 4
test ebx, ebx
je 0x43c5e5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x43c5de
test eax, eax
jne 0x43c5de
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x43c5c0
mov dword [esp], 0x47894c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x43c920
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x43c945
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x43c950
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x43c945
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x43c998
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x43c98e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x43c99a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x43c980
xor eax, eax
pop ebx
pop esi
ret
Function at 0x451530
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push edi
xor eax, eax
mov ecx, 0x10
sub esp, 0x88
lea edi, [esp + 0x40]
mov dword [esp + 0x15], 0x6f727245
mov dword [esp + 0x19], 0x6c632072
mov dword [esp + 0x1d], 0x696e6165
mov dword [esp + 0x21], 0x7520676e
mov dword [esp + 0x25], 0x70732070
mov dword [esp + 0x29], 0x6b5f6e69
mov dword [esp + 0x2d], 0x20737965
mov dword [esp + 0x31], 0x20726f66
mov dword [esp + 0x35], 0x65726874
mov dword [esp + 0x39], 0x206461
mov dword [esp + 0x3d], 0
mov dword [esp + 0x7c], 0
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
je 0x45160b
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x4515dd
cmp eax, 0x6a
je 0x4515fa
mov ecx, eax
add eax, 1
cmp byte [edx + eax], 0
jne 0x4515d8
cmp eax, 0x6a
je 0x4515fa
add ecx, 2
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + ecx + 0x15], 0
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
call sym._abort
mov ecx, 0x28
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x4515f0

Function at 0x451990
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x4794b0], 1
je 0x451a48
push edi
mov eax, 0x4794b0
push esi
push ebx
sub esp, 0x10
call sym._enterOnceObject
lea esi, [eax + 4]
mov ebx, eax
mov dword [esp], esi
call sym._pthread_mutex_lock
mov edi, dword [0x4794b0]
test edi, edi
jne 0x451a00
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x459170], eax
cmp eax, 0xffffffff
je sym.__pthread_once_raw.constprop.0.isra.0.cold
mov dword [0x4794b0], 1
mov dword [esp], esi
call sym._pthread_mutex_unlock
test ebx, ebx
je 0x451a3a
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
jmp sym._leaveOnceObject.part.0
cmp edi, 1
je 0x4519e2
mov dword [esp], 2
call dword [0x459154]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x4794b0
mov dword [esp + 4], str._once__p_is__d_n
mov dword [esp], eax
call sym._fprintf_10
mov dword [esp], esi
call sym._pthread_mutex_unlock
test ebx, ebx
jne 0x4519ee
add esp, 0x10
pop ebx
pop esi
pop edi
ret
ret