joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40be15
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd3c
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp word [eax], si
push edi
mov dword [ebp - 0x10], esi
jne 0x40be43
push 0x10
push str.tcmadmin
push str.This_program_is_internal_to_Total_Commander._Do_not_call_it_directly_
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40bebf
mov edi, 0x103
lea eax, [ebp - 0xb3c]
push edi
push str..PipeTcInstallPipe
push eax
call fcn.0040c67c
lea eax, [ebp - 0xb3c]
push eax
call fcn.00413733
push edi
lea ebx, [ebp + eax*2 - 0xb3c]
push dword [ebp + 8]
lea eax, [ebp - 0xb3c]
push eax
call fcn.0040c719
push 0x20
push ebx
call fcn.00413ce4
add esp, 0x24
cmp eax, esi
je 0x40bea3
mov word [eax], si
add eax, 2
push edi
push eax
push 0x421f80
call fcn.0040c67c
add esp, 0xc
jmp 0x40beaa
mov word [0x421f80], si
lea eax, [ebp - 0xb3c]
push eax
call fcn.0040bc3d
cmp eax, 0xffffffff
pop ecx
mov dword [ebp - 0x18], eax
jne 0x40bec7
push 1
pop eax
jmp 0x40c638
lea eax, [ebp - 0x34]
mov dword [ecx + eax], 0x948b0000
invalid

Function at 0x40c63d
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40c630
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40c64e
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40c6ac
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
loop 0x40c67e
add byte [eax], al
and byte [ecx + 0x1065], al
invalid
invalid
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40c693
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40c69c
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40c6a6
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40c688
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
push es
jbe 0x40c612
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40c6f9
dec eax
je 0x40c6f0
sub eax, 3
je 0x40c6e7
mov dword [ebp - 4], 0x40
jmp 0x40c716
mov dword [ebp - 4], 4
jmp 0x40c6fc
mov dword [ebp - 4], 0x20
jmp 0x40c6fc
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40c748
invalid
invalid
push esp
Function at 0x40c67c
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40c630
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40c64e
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40c6ac
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
loop 0x40c67e
add byte [eax], al
and byte [ecx + 0x1065], al
invalid
invalid
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40c693
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40c69c
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40c6a6
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40c688
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
push es
jbe 0x40c612
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40c6f9
dec eax
je 0x40c6f0
sub eax, 3
je 0x40c6e7
mov dword [ebp - 4], 0x40
jmp 0x40c716
mov dword [ebp - 4], 4
jmp 0x40c6fc
mov dword [ebp - 4], 0x20
jmp 0x40c6fc
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40c748
invalid
invalid
push esp

Function at 0x40c780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fiadd dword [eax - 0x3505b]
inc dword [eax]
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
test dword [esi + 0x46fffffc], esi

Function at 0x40c7b3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esi + 0x46fffffc], esi
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
invalid
invalid
invalid
cld
invalid
invalid
Function at 0x10001220
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
mov dword [ecx + 0x30], edx
mov dword [ecx + 0x4c], edx
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x2c], 0x20
mov dword [ecx + 0x54], 1
mov dword [ecx + 0x48], 4
mov dword [ecx + 0x58], edx
lea esi, [ecx + 0x70]
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0x10001247
pop esi
ret

Function at 0x10005430
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x10005440
pop edi
pop ebx
ret

Function at 0x10005470
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
sar ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x10005480
pop esi
pop ebp
pop ebx
ret 4
Function at 0x10005720
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [esp], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
push ebp
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
xor edx, edx
push edi
cmp edx, dword [esp + 0x1c]
jae 0x10005891
mov eax, edx
or eax, 8
xor edi, edi
cmp eax, 1
je 0x100057aa
lea ebx, [ebx]
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x10005780
add edi, dword [esp + 8]
mov ecx, dword [esp + 0x20]
mov dword [ecx + edx*4], edi
inc edx
cmp edx, 8
jb 0x10005764
cmp edx, 0x10
jae 0x1000582b
lea eax, [edx - 8]
mov dword [esp + 8], eax
jmp 0x100057d0
cmp edx, dword [esp + 0x1c]
jae 0x10005891
or eax, 8
xor edi, edi
cmp eax, 1
je 0x10005811
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x100057e4
add edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 8], eax
cmp edx, 0x10
jb 0x100057d0
cmp edx, dword [esp + 0x1c]
jae 0x10005891
lea eax, [edx - 0x10]
mov dword [esp + 0x18], eax
jmp 0x10005840
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x10005876
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x10005850
add edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 0x18], eax
cmp edx, dword [esp + 0x1c]
jb 0x10005840
pop edi
pop ebp
add esp, 0xc
ret 0xc
Function at 0x100073c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
lea eax, [edi + 0x32550]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jmp 0x100073e0
xor edx, edx
lea ecx, [edx + 1]
mov dword [esp + 0xc], 4
lea ecx, [ecx]
movzx ebx, word [edi + ecx*2 + 0x32bf4]
mov eax, esi
and eax, 1
mov ebp, eax
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
xor ebx, ebp
add edx, dword [edi + ebx*4 + 0x30ea0]
add ecx, ecx
shr esi, 1
or ecx, eax
dec dword [esp + 0xc]
jne 0x100073f0
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
inc esi
mov dword [eax], edx
add eax, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
cmp esi, 0x10
jb 0x100073e0
pop esi
pop ebp
mov dword [edi + 0x32590], 0
pop ebx
add esp, 0xc
ret
Function at 0x10007450
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
mov eax, 4
push edi
mov dword [esp + 0x18], eax
movzx ebp, byte [edx + eax + 0x306a0]
mov ecx, ebp
mov esi, ebp
and esi, 1
shr ecx, 1
dec ecx
or esi, 2
shl esi, cl
mov edi, eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x10], 0
sub edi, esi
mov ebx, 1
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x100074e1
jmp 0x100074a4
mov ebp, dword [esp + 0x1c]
mov ecx, ebx
sub ecx, ebp
mov eax, edi
and eax, 1
add ecx, esi
movzx ecx, word [edx + ecx*2 + 0x32b0e]
mov ebp, eax
neg ebp
sar ebp, 4
shr ecx, 4
and ebp, 0x7f
xor ecx, ebp
mov ecx, dword [edx + ecx*4 + 0x30ea0]
add dword [esp + 0x10], ecx
add ebx, ebx
shr edi, 1
or ebx, eax
dec dword [esp + 0x14]
jne 0x100074a0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x20], ecx
inc eax
mov dword [esp + 0x18], eax
cmp eax, 0x80
jb 0x10007463
lea eax, [edx + 0x32910]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
sub eax, edx
lea ebp, [edx + 0x31d58]
sub eax, 0x31d50
lea edi, [edx + 0x31950]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 4
lea ebx, [ebx]
xor ebx, ebx
cmp dword [edx + 0x32594], ebx
jbe 0x1000758b
lea ebx, [ebx]
mov eax, ebx
or eax, 0x40
xor esi, esi
cmp eax, 1
je 0x1000757f
lea esp, [esp]
mov ebp, dword [esp + 0x10]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebp + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add esi, dword [edx + ebp*4 + 0x30ea0]
mov eax, ecx
cmp eax, 1
jne 0x10007550
mov ebp, dword [esp + 0x18]
mov dword [edi + ebx*4], esi
inc ebx
cmp ebx, dword [edx + 0x32594]
jb 0x10007540
mov eax, 0xe
cmp dword [edx + 0x32594], eax
jbe 0x100075ae
mov ecx, eax
shr ecx, 1
sub ecx, 5
shl ecx, 4
add dword [edi + eax*4], ecx
inc eax
cmp eax, dword [edx + 0x32594]
jb 0x10007598
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov ecx, dword [edi + 4]
mov dword [ebp - 4], ecx
mov eax, dword [edi + 8]
mov dword [ebp], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp + 4], ecx
mov eax, 4
lea ecx, [ebp + 8]
lea ecx, [ecx]
movzx esi, byte [edx + eax + 0x306a0]
mov esi, dword [edi + esi*4]
mov ebx, dword [esp + 0x14]
add esi, dword [ebx + ecx]
inc eax
mov dword [ecx], esi
add ecx, 4
cmp eax, 0x80
jb 0x100075d0
sub dword [esp + 0x10], 0xffffff80
sub dword [esp + 0x14], 0x200
add ebp, 0x200
add edi, 0x100
dec dword [esp + 0x1c]
mov dword [esp + 0x18], ebp
jne 0x10007530
pop edi
pop esi
pop ebp
mov dword [edx + 0x3bcf8], 0
pop ebx
add esp, 0x210
ret

Function at 0x10008950
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call fcn.10009404
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x10008978
xor eax, eax
ret 4
call dword [0x1000e00c]
test eax, eax
jne 0x10008987
mov eax, 1
ret 4
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x47891c], 1
mov dword [0x478918], 1
mov dword [0x478914], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x47800c], eax
mov eax, dword [0x478928]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x47893c]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x478924]
mov dword [eax], edx
call sym.__setargv
cmp dword [0x4590e0], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], sym.__matherr
call sym.___mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056
Function at 0x4069f0
Capabilities:
Resolve function by parsing pe exports
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, ecx
sub esp, 0x18
call method.Client.InitTrafficLoop__
mov eax, dword [ebx + 0xc8]
mov edx, dword [eax + 0x78]
test dh, 8
je 0x406a20
and edx, 0x10
jne 0x406a60
mov ecx, ebx
test byte [eax + 0x7c], 8
je 0x406a50
add esp, 0x18
pop ebx
jmp method.Client.RunUDPIsochronous__
test byte [eax + 0x81], 1
jne 0x406a90
mov edx, dword [eax + 0x98]
or edx, dword [eax + 0x9c]
mov ecx, ebx
jne 0x406aa0
test byte [eax + 0x7f], 8
je 0x406a80
add esp, 0x18
pop ebx
jmp method.Client.RunNearCongestionTCP__
add esp, 0x18
pop ebx
jmp method.Client.RunUDP__
mov dword [esp + 4], eax
mov dword [esp], 0x10
call sym._Extractor_reduceReadSize
add dword [ebx + 0xec], 0x10
mov eax, dword [ebx + 0xc8]
jmp 0x406a0e
add esp, 0x18
pop ebx
jmp method.Client.RunTCP__
add esp, 0x18
mov ecx, ebx
pop ebx
jmp method.Client.RunBounceBackTCP__
add esp, 0x18
pop ebx
jmp method.Client.RunRateLimitedTCP__
Function at 0x4079f0
Capabilities:
Read file on windows

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x24]
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x407a0b
mov dword [esp], eax
call sym._feof
test eax, eax
je 0x407a18
add esp, 0x18
xor eax, eax
pop ebx
ret
mov eax, dword [ebx + 0x30]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x64]
mov dword [esp + 4], 1
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._fread
add esp, 0x18
pop ebx
ret
Function at 0x4091f0
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x7c
mov ebp, dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp], 2
call ebp
sub esp, 4
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp], 0x20002
call ebp
sub esp, 4
mov dword [esp + 0x48], eax
mov dword [esp], 1
call ebp
sub esp, 4
mov dword [esp + 0x4c], eax
test byte [ebx + 0x7d], 0x20
jne 0x4093b0
mov eax, 0x1c
mov edi, 0x1c
lea esi, [esp + 0x34]
mov dword [esp], eax
call ebp
sub esp, 4
mov dword [esp + 0x40], eax
mov eax, dword [ebx + 0xb0]
test eax, eax
je 0x409328
shr eax, 2
mov edx, 0x2710
cmp eax, edx
cmovge edx, eax
cmp eax, 0x2625a1
mov eax, 0x2625a0
cmovl eax, edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._SetSocketOptionsSendTimeout
mov dword [esp + 0xc], esi
mov ebp, dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 1
mov dword [esp + 4], 6
mov eax, dword [ebx + 0x60]
mov dword [esp + 0x34], 1
mov dword [esp], eax
call ebp
sub esp, 0x14
test eax, eax
js 0x409478
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x60]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
test eax, eax
js 0x409450
mov ecx, dword [ebx + 0x78]
mov edx, ecx
sar edx, 5
and edx, 1
mov dword [esp + 0x34], edx
and ch, 8
je 0x409358
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x2710
test byte [ebx + 0x79], 0x10
je 0x409293
mul dword [ebx + 0xa8]
imul ecx, dword [ebx + 0xac], 0x2710
add edx, ecx
shrd eax, edx, 2
jmp 0x40927c
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 6
mov eax, dword [ebx + 0x60]
mov dword [esp], eax
call ebp
sub esp, 0x14
test eax, eax
jns 0x40931b
mov dword [esp + 8], 0x515
mov dword [esp + 4], str.Listener.cpp
mov dword [esp], str.tcpnodelay
mov dword [esp + 0x2c], eax
call sym._warn_errno
mov eax, dword [esp + 0x2c]
jmp 0x40931b
mov eax, dword [ebx + 0x378]
mov dword [esp], eax
call ebp
sub esp, 4
mov dword [esp + 0x58], eax
mov eax, dword [ebx + 0x37c]
mov dword [esp], eax
call ebp
sub esp, 4
mov dword [esp + 0x5c], eax
mov eax, dword [ebx + 0x370]
mov dword [esp], eax
call ebp
sub esp, 4
mov dword [esp + 0x60], eax
mov eax, dword [ebx + 0x374]
mov dword [esp], eax
call ebp
sub esp, 4
lea esi, [esp + 0x34]
mov dword [esp], 0
mov dword [esp + 4], esi
mov dword [esp + 0x64], eax
call sym._clock_gettime
mov ecx, dword [esp + 0x38]
mov eax, 0x10624dd3
imul ecx
mov eax, dword [esp + 0x34]
sar ecx, 0x1f
mov dword [esp], eax
sar edx, 6
mov edi, edx
sub edi, ecx
call ebp
sub esp, 4
mov dword [esp], edi
mov edi, 0x34
mov dword [esp + 0x68], eax
call ebp
sub esp, 4
mov dword [esp + 0x6c], eax
mov eax, 0x34
jmp 0x40925f
mov dword [esp + 8], 0x50e
mov dword [esp + 4], str.Listener.cpp
mov dword [esp], str.send_ack
call sym._warn_errno
xor eax, eax
jmp 0x409307
mov dword [esp + 8], 0x50a
mov dword [esp + 4], str.Listener.cpp
mov dword [esp], str.tcpnodelay
call sym._warn_errno
jmp 0x4092dc
Function at 0x409b00
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
lea ebp, [ebx + 0xd0]
mov dword [esp], ebp
call sym._SockAddr_zeroAddress
mov esi, dword [ebx + 0x78]
mov dword [ebx + 0x150], pe_nt_image_headers32
mov dword [ebx + 0x370], 0
mov dword [ebx + 0x374], 0
and esi, 0x800
je 0x409b68
mov dword [esp], ebx
mov ecx, edi
call method.Listener.udp_accept_thread_Settings_
mov dword [ebx + 0x60], eax
sub esp, 4
mov esi, eax
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 4
lea eax, [ebx + 0x150]
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
mov eax, dword [edi + 0x20]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebx + 0x60], eax
sub esp, 0xc
test eax, eax
je 0x409b56
lea eax, [esp + 0x18]
mov dword [esp], 0
mov dword [esp + 4], eax
call sym._clock_gettime
mov ecx, dword [esp + 0x1c]
mov eax, 0x10624dd3
mov dword [ebx + 0x1d8], pe_nt_image_headers32
imul ecx
mov eax, dword [esp + 0x18]
sar ecx, 0x1f
mov dword [ebx + 0x370], eax
lea eax, [ebx + 0x1d8]
sar edx, 6
sub edx, ecx
mov dword [ebx + 0x374], edx
mov dword [esp + 8], eax
lea eax, [ebx + 0x158]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x60]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_getsockname]
sub esp, 0xc
mov dword [esp], ebx
call sym._SockAddr_Ifrname
mov dword [esp], ebx
call sym.Iperf_push_host_thread_Settings_
mov esi, dword [ebx + 0x60]
add esp, 0x2c
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret 4
Function at 0x40b540
Capabilities:
Set socket configuration

Disassembly:
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x130
lea edi, [esp + 0x28]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], edi
mov dword [esp + 8], 3
mov dword [esp + 4], 0
mov eax, dword [eax + 0x60]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], 4
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
cmp eax, 0xffffffff
jne 0x40b5b6
test byte [ebx + 0x78], 8
mov eax, str.setsockopt_IP_TOS
mov edx, str.setsockopt_IPV6_TCLASS
mov dword [esp + 8], 0x165
cmovne eax, edx
mov dword [esp + 4], str.PerfSocket.cpp
mov dword [esp], eax
call sym._warn_errno
mov eax, dword [ebx + 0x78]
mov edx, 3
and eax, 8
je 0x40b5cd
mov edx, 0x27
mov eax, 0x29
lea ecx, [esp + 0x2c]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x60]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_getsockopt]
sub esp, 0x14
cmp eax, 0xffffffff
jne 0x40b61e
test byte [ebx + 0x78], 8
mov eax, str.getsockopt_IP_TOS
mov edx, str.getsockopt_IPV6_TCLASS
mov dword [esp + 8], 0x168
cmovne eax, edx
mov dword [esp + 4], str.PerfSocket.cpp
mov dword [esp], eax
call sym._warn_errno
mov eax, dword [esp + 0x28]
cmp esi, eax
je 0x40b672
mov dword [esp + 0x10], esi
lea esi, [esp + 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Warning:_IP_TOS_set_to_0x_x__request_for_setting_to_0x_x
mov dword [esp + 4], 0x100
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__snprintf]
mov dword [esp + 8], 0x16d
mov dword [esp + 4], str.PerfSocket.cpp
mov dword [esp], esi
mov byte [esp + 0x12f], 0
call sym._warn
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x50], eax
add esp, 0x130
pop ebx
pop esi
pop edi
ret