joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411380
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x40], 0x41840c1
movzx eax, word [ecx + 4]
movq xmm0, qword [ecx + 8]
mov word [ebp - 0x3c], ax
movzx eax, word [ecx + 6]
add ecx, 8
mov word [ebp - 0x3a], ax
push ecx
push str.SELECT__FROM_PeriodicItem_WHERE_Account_s
movzx eax, word [ecx + 8]
mov word [ebp - 0x30], ax
mov al, byte [ecx + 0xa]
push 0x442698
movq qword [ebp - 0x38], xmm0
mov byte [ebp - 0x2e], al
call fcn.00413700
add esp, 0xc
test al, al
je 0x4115a4
push dword [0x4426a4]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x4115a4
push 0x438f88
call fcn.00413990
cmp eax, 0xffffffff
jne 0x4113ff
or eax, eax
jmp 0x411410
shl eax, 0xd
add eax, 0x443e7e
push eax
call fcn.0041acc9
add esp, 4
push str.Section
mov dword [ebp - 0x2c], eax
call fcn.00413990
cmp eax, 0xffffffff
jne 0x411426
or eax, eax
jmp 0x411437
shl eax, 0xd
add eax, 0x443e7e
push eax
call fcn.0041acc9
add esp, 4
push str.Index
mov dword [ebp - 0x28], eax
call fcn.00413990
cmp eax, 0xffffffff
jne 0x41144d
or eax, eax
jmp 0x41145e
shl eax, 0xd
add eax, 0x443e7e
push eax
call fcn.0041acc9
add esp, 4
push str.Level
mov dword [ebp - 0x24], eax
call fcn.00413990
cmp eax, 0xffffffff
jne 0x411474
or eax, eax
jmp 0x411485
shl eax, 0xd
add eax, 0x443e7e
push eax
call fcn.0041acc9
add esp, 4
push str.Skill
mov dword [ebp - 0x1c], eax
call fcn.00413990
cmp eax, 0xffffffff
jne 0x41149b
or eax, eax
jmp 0x4114ac
shl eax, 0xd
add eax, 0x443e7e
push eax
call fcn.0041acc9
add esp, 4
push str.Luck
mov dword [ebp - 0x18], eax
call fcn.00413990
cmp eax, 0xffffffff
jne 0x4114c2
or eax, eax
jmp 0x4114d3
shl eax, 0xd
add eax, 0x443e7e
push eax
call fcn.0041acc9
add esp, 4
push 0x438fb4
mov dword [ebp - 0x14], eax
call fcn.00413990
cmp eax, 0xffffffff
jne 0x4114e9
or eax, eax
jmp 0x4114fa
shl eax, 0xd
add eax, 0x443e7e
push eax
call fcn.0041acc9
add esp, 4
push 0x438fb8
mov dword [ebp - 0x10], eax
call fcn.00413990
cmp eax, 0xffffffff
jne 0x411510
or eax, eax
jmp 0x411521
shl eax, 0xd
add eax, 0x443e7e
push eax
call fcn.0041acc9
add esp, 4
push str.Days
mov dword [ebp - 0xc], eax
call fcn.00413990
cmp eax, 0xffffffff
jne 0x411537
or eax, eax
jmp 0x411548
shl eax, 0xd
add eax, 0x443e7e
push eax
call fcn.0041acc9
add esp, 4
push str.IsPeriodic
mov dword [ebp - 0x20], eax
call fcn.00413990
cmp eax, 0xffffffff
jne 0x41155e
or eax, eax
jmp 0x41156f
shl eax, 0xd
add eax, 0x443e7e
push eax
call fcn.0041acc9
add esp, 4
push dword [0x4426a4]
mov dword [ebp - 8], eax
mov byte [ebp - 4], 1
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x4426a4]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 0x40
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 0xc]
call fcn.00414e90
mov esp, ebp
pop ebp
ret 8
push dword [0x4426a4]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x4426a4]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 0x40
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0
push eax
push dword [ebp + 0xc]
call fcn.00414e90
mov esp, ebp
pop ebp
ret 8
Function at 0x4116c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
push pe_nt_image_headers32
lea ebx, [esi + 0xc]
push ebx
call fcn.0041a083
add esp, 0xc
push 0
push 0x20
push 3
push 0
push 1
push bind
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x411718
push ebx
lea eax, [esi + 0x218]
push str.__s__Could_not_open_file
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x41173b
push eax
call fcn.004166ec
add esp, 4
mov dword [esi + 4], 0
push dword [esi + 8]
call fcn.004166f1
add esp, 4
mov dword [esi + 4], eax
test eax, eax
jne 0x411773
push ebx
push str.__s__Could_not_alloc_file_buffer
lea eax, [esi + 0x218]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 4
push 0
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
push ecx
push dword [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x411797
push ebx
push str.__s__Could_not_read_file
jmp 0x411753
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10c], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
mov dword [esi + 0x214], eax
mov al, 1
pop esi
pop ebx
pop ebp
ret 4

Function at 0x411df0
Capabilities:
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x43d008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
jmp 0x411e18
jmp 0x411e2a
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
mov ecx, ebx
push 0
push 0
push 0
push 0
push eax
push 0
push 0
push 4
push 0x43da28
call fcn.004128e0
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x411e69
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004163e0
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreateSequential]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx edx, word [ebp - 0x40]
movzx eax, word [ebp - 6]
movzx ecx, word [ebp - 0x1e]
mov esi, dword [ebp - 0xa]
mov edi, dword [ebp - 0x1c]
xor esi, 0x5d78a569
shl edx, 0x10
xor edi, 0x12b586fe
or edx, eax
shl ecx, 0x10
movzx eax, word [ebp - 0x20]
xor edx, 0xf45bc123
or ecx, eax
xor ecx, 0xb542d8e1
push ecx
push edx
push esi
push edi
push 0x14
push 0x43da2c
mov ecx, ebx
call fcn.004128e0
push eax
lea eax, [ebx + 8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
jmp 0x411ee7
jmp 0x411efe
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004163e0
mov esp, ebp
pop ebp
ret
Function at 0x411f20
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x43d008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
jmp 0x411f48
jmp 0x411f5a
mov ebx, dword [ebp - 0x18]
cmp dword [ebx + 4], 0xffffffff
jne 0x412028
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x412028
push dword [ebp + 0xc]
mov eax, 2
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push dword [ebp + 8]
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x411fc9
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x411fc9
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.00419900
add esp, 0xc
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x411fea
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x412028
jmp 0x411ffc
jmp 0x412013
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004163e0
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004163e0
mov esp, ebp
pop ebp
ret 8

Function at 0x412040
Capabilities:
Encrypt data using rc4 prga
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x43d008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x54], ecx
jmp 0x412068
jmp 0x41207a
call fcn.0041acee
and eax, 0x800000ff
jns 0x41208d
dec eax
or eax, 0xffffff00
inc eax
mov edx, dword [ebp - 0x54]
mov cl, byte [ebp + 8]
mov byte [ebp - 0x4c], cl
mov word [ebp - 0x50], 0x49c1
mov byte [edx + 0x2c], al
movups xmm0, xmmword [0x5d55c4]
mov ecx, dword [0x5d55c0]
mov dword [ebp - 0xb], ecx
mov ecx, 4
movups xmmword [ebp - 0x4b], xmm0
mov byte [ebp - 0x4e], 0
movups xmm0, xmmword [0x5d55d4]
mov byte [ebp - 0x4d], al
movups xmmword [ebp - 0x3b], xmm0
movups xmm0, xmmword [0x5d55a0]
movups xmmword [ebp - 0x2b], xmm0
movups xmm0, xmmword [0x5d55b0]
movups xmmword [ebp - 0x1b], xmm0
add al, 0x1a
xor al, byte [ebp + ecx - 0x50]
sub al, 0x69
mov byte [ebp + ecx - 0x50], al
inc ecx
cmp ecx, 0x49
jae 0x4120f7
mov al, byte [ebp - 0x4d]
jmp 0x4120e0
movzx eax, byte [ebp - 0x4f]
push 0
push eax
lea eax, [ebp - 0x50]
push eax
push dword [edx + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x412132
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x412132
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004163e0
mov esp, ebp
pop ebp
ret 4
jmp 0x412144
jmp 0x41215b
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004163e0
mov esp, ebp
pop ebp
ret 4
Function at 0x4124d0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
jmp 0x4124ee
jmp 0x412500
jmp 0x412512
push 0x10000000
pop dword [0x5d5f20]
jmp 0x41252b
cmp dword [0x5d5f20], 0x10000000
je 0x41255d
xorps xmm0, xmm0
movups xmmword [0x439274], xmm0
movups xmmword [0x439264], xmm0
movups xmmword [0x439254], xmm0
movups xmmword [0x439244], xmm0
movups xmmword [0x439234], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0
movq qword [ebp - 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xc
lea ecx, [ebp - 0x24]
push ecx
push esi
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleInformation]
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 4]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x14]
add edi, ecx
push eax
push edi
push ecx
mov ecx, esi
mov dword [ebp - 0x18], edi
call fcn.00412760
test al, al
je 0x412674
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
mov ecx, esi
push eax
push edi
push dword [ebp - 4]
call fcn.00412820
test al, al
je 0x412674
mov edi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x10
push edi
call ebx
mov esi, 0x439264
mov eax, edi
sub esi, edi
mov edx, 0x10
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor cl, 0x9f
mov byte [eax - 1], cl
sub edx, 1
jne 0x4125e6
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 0x10
push edi
call ebx
mov edi, dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 0x10
push edi
call ebx
mov esi, 0x439254
mov ecx, edi
sub esi, edi
mov edx, 0x10
nop
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, 0x9f
mov byte [ecx - 1], al
sub edx, 1
jne 0x412620
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 0x10
push edi
call ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 0x14]
sub eax, ecx
sub eax, 0x10
push eax
lea eax, [ecx + 0x10]
mov ecx, esi
push eax
call fcn.004126b0
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
mov edi, dword [ebp - 0x18]
add eax, 0x10
push ecx
push edi
push eax
mov ecx, esi
call fcn.00412760
test al, al
jne 0x4125b3
jmp 0x412686
jmp 0x41269d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4126b0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
jmp 0x4126ce
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push esi
push edi
call ebx
xor ecx, ecx
test esi, esi
jle 0x41272d
mov ebx, dword [ebp - 8]
nop dword [eax]
mov eax, 0x38e38e39
mul ecx
mov eax, ecx
shr edx, 3
lea edx, [edx + edx*8]
shl edx, 2
sub eax, edx
mov dl, byte [eax + ebx + 0x55]
xor dl, byte [eax + ebx + 8]
mov eax, ecx
and eax, 0xf
xor dl, 0xaf
mov al, byte [eax + 0x439274]
xor al, byte [ecx + edi]
sub al, dl
mov byte [ecx + edi], al
inc ecx
cmp ecx, esi
jl 0x4126f0
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push edi
call ebx
jmp 0x41274a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4128e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
jmp 0x4128f8
push pe_nt_image_headers32
push 0
push 0x5d5f28
call fcn.00417d10
mov esi, dword [ebp + 0xc]
add esp, 0xc
xor eax, eax
test esi, esi
jle 0x4129c5
mov edx, dword [ebp + 8]
cmp esi, 0x40
jb 0x4129a6
lea ecx, [esi - 1]
add ecx, edx
lea edi, [esi + 0x5d5f27]
cmp ecx, 0x5d5f28
jb 0x41293c
cmp edi, edx
jae 0x4129a6
mov ecx, esi
and ecx, 0x8000003f
jns 0x41294b
dec ecx
or ecx, 0xffffffc0
inc ecx
movaps xmm1, xmmword [0x43a400]
mov edi, esi
sub edi, ecx
nop word [eax + eax]
movups xmm0, xmmword [edx + eax]
pxor xmm0, xmm1
movups xmmword [eax + 0x5d5f28], xmm0
movups xmm0, xmmword [edx + eax + 0x10]
pxor xmm0, xmm1
movups xmmword [eax + 0x5d5f38], xmm0
movups xmm0, xmmword [edx + eax + 0x20]
pxor xmm0, xmm1
movups xmmword [eax + 0x5d5f48], xmm0
movups xmm0, xmmword [edx + eax + 0x30]
pxor xmm0, xmm1
movups xmmword [eax + 0x5d5f58], xmm0
add eax, 0x40
cmp eax, edi
jl 0x412960
cmp eax, esi
jge 0x4129c5
sub edx, 0x5d5f28
mov cl, byte [edx + eax + 0x5d5f28]
xor cl, 0xb0
mov byte [eax + 0x5d5f28], cl
inc eax
cmp eax, esi
jl 0x4129b0
jmp 0x4129d7
mov eax, 0x5d5f28
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x412a40
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x43d008]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44260c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x44260c
mov dword [0x442608], 0x10000000
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
mov dword [0x442400], 0
mov dword [0x442404], 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0x4920
push 0
push 0x43dad4
mov dword [0x4423f8], eax
mov dword [0x4423fc], 0xffffff
mov byte [0x442654], 1
call fcn.00417d10
add esp, 0xc
cmp byte [0x442654], 1
jne 0x412c7a
push edi
push 0xff
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.00417d10
lea eax, [ebp - 0x10c]
push eax
call fcn.0041a52d
lea eax, [ebp - 0x10c]
push eax
call fcn.0041afb2
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x439284
mov edx, dword [eax + 0xc]
add dword [eax + 0x14], 0x76c
mov dword [0x442648], edx
mov ecx, dword [eax + 0x10]
inc ecx
mov dword [0x44264c], ecx
mov eax, dword [eax + 0x14]
push eax
push ecx
push edx
mov dword [0x442650], eax
mov dword [0x442644], eax
lea eax, [ebp - 0x104]
push str.Log_02d._02d._04d__s.log
push eax
mov dword [0x44263c], edx
mov dword [0x442640], ecx
call edi
add esp, 0x2c
push 0
push 0x4392ac
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x104]
push 0x439360
push eax
call fcn.0041b086
add esp, 8
test eax, eax
je 0x412bde
push esi
push eax
call fcn.0041b114
add esp, 4
mov esi, 2
nop dword [eax + eax]
push 0xff
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.00417d10
push esi
push 0x439284
push dword [0x442644]
lea eax, [ebp - 0x104]
push dword [0x442640]
push dword [0x44263c]
push str.Log_02d._02d._04d__s_start__d.log
push eax
call edi
lea eax, [ebp - 0x104]
push 0x439360
push eax
call fcn.0041b086
add esp, 0x30
test eax, eax
je 0x412bdd
push eax
call fcn.0041b114
add esp, 4
inc esi
jmp 0x412b80
pop esi
push 0xff
push 0
push 0x442507
call fcn.00417d10
add esp, 0xc
lea ecx, [ebp - 0x104]
lea edx, [ecx + 1]
pop edi
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412c00
sub ecx, edx
lea eax, [ecx - 4]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x442507
call fcn.00419900
add esp, 0xc
xor ecx, ecx
nop dword [eax]
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x104]
lea ecx, [ecx + 1]
mov byte [ecx + 0x442407], al
test al, al
jne 0x412c30
cmp dword [0x442404], 0
jne 0x412c7a
push 0x4392d4
push 0x442408
call fcn.0041b086
add esp, 8
mov dword [0x442404], eax
test eax, eax
jne 0x412c7a
push str.Log_file_create_error.
push 0x43dad0
call fcn.00412fe0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004163e0
mov esp, ebp
pop ebp
ret 8
Function at 0x414ba0
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov edi, ecx
mov eax, dword [edi + 0x70]
test eax, eax
je 0x414bc6
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 0x70]
call ebx
mov dword [edi + 0x70], 0
mov eax, dword [edi + 0x6c]
test eax, eax
je 0x414bd7
push eax
call ebx
mov dword [edi + 0x6c], 0
push esi
lea ecx, [edi + 0x38]
call fcn.00413f60
lea esi, [edi + 0x14]
mov ebx, 8
mov eax, dword [esi]
test eax, eax
je 0x414c05
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
add esi, 4
sub ebx, 1
jne 0x414be8
mov eax, dword [edi + 0x10]
pop esi
test eax, eax
je 0x414c31
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov dword [edi + 0x10], 0
jmp 0x414c37
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 8]
test eax, eax
je 0x414c48
push eax
call ebx
mov dword [edi + 8], 0
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
je 0x414c5e
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi + 4], 0xffffffff
pop edi
pop ebx
ret
Function at 0x414e90
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x5d4540
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test edi, edi
js 0x415010
cmp edi, 0x14
jge 0x415010
imul ecx, edi, 0x68
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x5d56f4]
test eax, eax
js 0x415010
cmp eax, 0x14
jge 0x415010
cmp dword [ecx + 0x5d56f8], 0
je 0x415010
cmp dword [ecx + 0x5d570c], 0xffffffff
je 0x415010
mov eax, dword [ebp + 0x10]
cmp eax, 0x2000
jle 0x414f17
push eax
push edi
push str._SocketManager__Max_msg_size__Type:_1__Index:__d__Size:__d_
push 0xff
push 0x43dad0
call fcn.00413200
add esp, 0x14
jmp 0x415010
mov ebx, dword [ecx + 0x5d5714]
cmp dword [ebx + 0x20], 0
jle 0x414f86
mov edx, dword [ebx + 0x42028]
lea ecx, [edx + eax]
cmp ecx, 0x40000
jle 0x414f52
push ecx
push edi
push str._SocketManager__Max_msg_size__Type:_2__Index:__d__Size:__d_
push 0xff
push 0x43dad0
call fcn.00413200
add esp, 0x14
jmp 0x415005
push eax
push dword [ebp + 0xc]
lea eax, [ebx + 0x2028]
add eax, edx
push eax
call fcn.00419900
mov ecx, dword [ebp + 0x10]
add esp, 0xc
add dword [ebx + 0x42028], ecx
push 0x5d4540
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push eax
push dword [ebp + 0xc]
lea esi, [ebx + 0x24]
push esi
call fcn.00419900
mov ecx, dword [ebp + 0x10]
lea eax, [ebx + 0x14]
add esp, 0xc
mov dword [eax], ecx
mov dword [ebx + 0x20], ecx
lea ecx, [ebp + 8]
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x1c], 1
push 0
push ebx
push 0
push ecx
push 1
push eax
mov eax, dword [ebp - 4]
mov dword [ebx + 0x2024], 0
mov dword [ebp + 8], 0
push dword [eax + 0x5d570c]
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x414f70
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x3e5
je 0x414f70
call esi
push eax
push str._SocketManager__WSASend___failed_with_error:__d
push 0xff
push 0x43dad0
call fcn.00413200
add esp, 0x10
push edi
mov ecx, 0x5d44c8
call fcn.00415030
push 0x5d4540
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4151e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
lea ebx, [esi + 0x78]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test edi, edi
js 0x41538a
cmp edi, 0x14
jge 0x41538a
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x41522f
push edi
push str._SocketManager__Server___d__disconnected_send_Size__0
push 0xff
push 0x43dad0
call fcn.00413200
mov ecx, esi
jmp 0x415381
mov esi, dword [ebp + 0x10]
imul ecx, edi, 0x68
add dword [esi + 0x2024], eax
mov edx, dword [esi + 0x2024]
mov dword [ebp + 0xc], ecx
mov ecx, dword [esi + 0x20]
cmp edx, ecx
jl 0x41531b
mov eax, dword [esi + 0x42028]
test eax, eax
jg 0x415270
push ebx
mov dword [esi + 0x20], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea edx, [esi + 0x2028]
lea ecx, [esi + 0x24]
cmp eax, 0x2000
jle 0x4152e5
push 0x2000
push edx
push ecx
call fcn.00419900
lea eax, [esi + 0x24]
mov dword [esi + 0x14], 0x2000
mov dword [esi + 0x18], eax
add esp, 0xc
mov eax, dword [esi + 0x42028]
sub eax, 0x2000
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], 0x2000
push eax
lea eax, [esi + 0x4028]
mov dword [esi + 0x2024], 0
push eax
lea eax, [esi + 0x2028]
push eax
call fcn.00419240
add esp, 0xc
lea eax, [esi + 0x14]
add dword [esi + 0x42028], 0xffffe000
jmp 0x415331
push eax
push edx
push ecx
call fcn.00419900
lea eax, [esi + 0x24]
mov dword [esi + 0x2024], 0
mov dword [esi + 0x18], eax
add esp, 0xc
mov eax, dword [esi + 0x42028]
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], eax
lea eax, [esi + 0x14]
mov dword [esi + 0x42028], 0
jmp 0x41532a
lea eax, [esi + 0x24]
add eax, edx
sub ecx, edx
mov dword [esi + 0x18], eax
lea eax, [esi + 0x14]
mov dword [eax], ecx
mov dword [esi + 0x1c], 1
push 0
push esi
push 0
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
push ecx
push 1
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + 0x5d570c]
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x41538a
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x3e5
je 0x41538a
call esi
push eax
push str._SocketManager__WSASend___failed_with_error:__d
push 0xff
push 0x43dad0
call fcn.00413200
mov ecx, dword [ebp - 4]
add esp, 0x10
push edi
call fcn.00415030
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc