joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46193b
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x178], 0
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
push 0x800
push 0x160
lea ecx, [ebp - 0x174]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x46199c
mov eax, dword [ebp - 0x16c]
and eax, 0x10000
test eax, eax
jne 0x4619a3
xor eax, eax
jmp 0x461ad3
lea ecx, [ebp - 0x14]
push ecx
push 0x523bb8
push 0
push 0x523bc8
lea ecx, [ebp - 4]
call fcn.004615d7
test eax, eax
jge 0x4619c6
xor eax, eax
jmp 0x461ad3
lea edx, [ebp - 0x10]
push edx
push 0x529b28
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
call dword [ecx]
test eax, eax
jl 0x461ac5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
jne 0x461a00
mov dword [ebp - 0x180], 0
jmp 0x461a4e
mov ecx, dword [ebp - 0x178]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
shl eax, 1
add eax, 3
and al, 0xfc
call fcn.004084e0
mov dword [ebp - 0x184], esp
mov edx, dword [ebp - 0x17c]
push edx
mov eax, dword [ebp - 0x178]
push eax
mov ecx, dword [ebp - 0x184]
push ecx
call fcn.004036e0
mov dword [ebp - 0x180], eax
push 0
mov edx, dword [ebp - 0x180]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x10]
push edx
call dword [ecx + 0x14]
test eax, eax
jl 0x461ab9
push 2
mov ecx, dword [ebp + 8]
call fcn.004b0c0c
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
call dword [ecx + 0x4c]
test eax, eax
jl 0x461ab9
push 0
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 8]
mov eax, 1
jmp 0x461ad3
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 8]
xor eax, eax
lea esp, [ebp - 0x184]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x461adf
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cef9d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x15c
push ebx
push esi
push edi
push 1
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.00430a36
test eax, eax
jne 0x461b28
push 0x216
push str.filecore.cpp
call fcn.004ade80
test eax, eax
je 0x461b28
int3
xor ecx, ecx
test ecx, ecx
jne 0x461b00
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x461b7e
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
test eax, eax
je 0x461b64
mov ecx, dword [ebp + 0xc]
push ecx
push str.Warning:_could_not_parse_the_path__s._n
call fcn.004307f5
add esp, 8
push 0x104
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
jmp 0x461c71
lea ecx, [ebp - 0x1c]
call fcn.004aa427
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00461c84
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.004aa4ca
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x461bf6
lea ecx, [ebp - 0x1c]
call fcn.004aa4ca
push eax
push str.Warning:_could_not_get_volume_information__s._n
call fcn.004307f5
add esp, 8
mov dword [ebp - 0x164], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00457c8c
mov eax, dword [ebp - 0x164]
jmp 0x461c71
mov edx, dword [ebp - 0x18]
and edx, 2
test edx, edx
jne 0x461c0a
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
mov ecx, dword [ebp - 0x18]
and ecx, 4
test ecx, ecx
jne 0x461c52
lea edx, [ebp - 0x15c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xffffffff
je 0x461c52
mov ecx, dword [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x168], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00457c8c
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4746e0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.004aa4ca
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x474736
push 1
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x474734
push str.Warning:_File_save_with_new_name_failed._n
push 0x53ad0c
call fcn.004307f5
add esp, 8
xor eax, eax
jmp 0x474771
jmp 0x47476c
push 1
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.004aa4ca
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x47476c
push str.Warning:_File_save_failed._n
push 0x53ad2c
call fcn.004307f5
add esp, 8
xor eax, eax
jmp 0x474771
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x474ea0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0545
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
mov dword [ebp - 0x11c], 0
lea ecx, [ebp - 0x10]
call fcn.004aa427
mov dword [ebp - 4], 1
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0x104
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov eax, dword [ebp - 0x118]
mov byte [eax], 0
push 0x105
lea ecx, [ebp - 0x10]
call fcn.00458438
push eax
push 0
push 0x53adb8
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00458573
cmp dword [ebp + 0x10], 0
jne 0x474f3d
lea ecx, [ebp - 0x10]
call fcn.004aa4ca
push eax
call fcn.004615b4
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.004578ba
mov eax, dword [ebp - 0x11c]
or al, 1
mov dword [ebp - 0x11c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00457c8c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x47e296
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0047dec0
mov dword [ebp - 0x28], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x47e2f5
push 0x20
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.0047e054
test eax, eax
jne 0x47e2f3
push 0xffffffffffffffff
push 0
mov edx, dword [ebp + 0x14]
push edx
call fcn.0047dcd9
mov ecx, dword [ebp + 8]
call fcn.0047dfdf
jmp 0x47e314
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.004704f3
mov dword [ebp - 4], 0
mov esp, ebp
pop ebp
ret

Function at 0x47e52c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.0047dec0
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x47e580
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.004585e7
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.00458573
jmp 0x47e592
mov ecx, dword [ebp + 0x10]
call fcn.004aa4ca
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004704f3
mov esp, ebp
pop ebp
ret 0xc

Function at 0x47e984
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.0047df0e
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x47e9fd
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x47e9d4
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.004585e7
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x47e9f1
push 0x100
push 0xff
mov ecx, dword [ebp + 0x10]
call fcn.00458438
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.00458573
jmp 0x47ea2e
mov ecx, dword [ebp + 0x10]
call fcn.004aa4ca
push eax
push 0xffffffffffffffff
push 0x14d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x47ea2e
mov ecx, dword [ebp + 0x10]
call fcn.004aa4ca
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.004704f3
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47fef5
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0
jne 0x47ff1b
push 0x110
push str.appui3.cpp
call fcn.004ade80
test eax, eax
je 0x47ff1b
int3
xor eax, eax
test eax, eax
jne 0x47ff01
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x80], 0
je 0x480006
cmp dword [ebp + 0xc], 0
jne 0x47ff6f
mov ecx, dword [ebp - 0x14]
call fcn.004c51fc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47ff4f
xor eax, eax
jmp 0x480079
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47fffb
cmp dword [ebp + 0x10], 0
jne 0x47ffae
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.004c5302
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x47ff91
xor eax, eax
jmp 0x480079
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47fffb
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.004c5302
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x47ffca
xor eax, eax
jmp 0x480079
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 4], 0
sete al
jmp 0x480079
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x94], 0
jne 0x480026
push 0x132
push str.appui3.cpp
call fcn.004ade80
test eax, eax
je 0x480026
int3
xor ecx, ecx
test ecx, ecx
jne 0x480006
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xfff
jl 0x480057
push 0x133
push str.appui3.cpp
call fcn.004ade80
test eax, eax
je 0x480057
int3
xor ecx, ecx
test ecx, ecx
jne 0x48002c
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x94]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x497328
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x497417
mov eax, dword [ebp - 4]
push eax
call fcn.00459414
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x497403
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
cmp edx, dword [ebp - 4]
je 0x497403
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.00496f40
test eax, eax
je 0x497403
push 0xfffffffffffffff0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x4973c9
mov ecx, dword [ebp - 0xc]
and ecx, 0x18000000
cmp ecx, 0x10000000
jne 0x4973c9
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
or ecx, 2
mov edx, dword [ebp - 8]
mov dword [edx + 0x24], ecx
jmp 0x497403
cmp dword [ebp + 8], 0
je 0x497403
mov eax, dword [ebp - 0xc]
and eax, 0x18000000
test eax, eax
jne 0x497403
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 2
test edx, edx
je 0x497403
push 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 0xfffffffd
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], edx
push 2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
jmp 0x497343
mov esp, ebp
pop ebp
ret 4
Function at 0x49b27e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 1
test ecx, ecx
je 0x49b2a2
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
jmp 0x49b2dc
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x49b2f6
push 0xc9
push str.dlgprop.cpp
call fcn.004ade80
test eax, eax
je 0x49b2f6
int3
xor eax, eax
test eax, eax
jne 0x49b2dc
mov ecx, dword [ebp - 4]
xor edx, edx
mov dx, word [ecx + 2]
cmp edx, 0xffff
jne 0x49b3d1
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and eax, 0x80000000
test eax, eax
je 0x49b3a1
push 0x5399c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x49b34e
push 0xe1
push str.dlgprop.cpp
call fcn.004ade80
test eax, eax
je 0x49b34e
int3
xor ecx, ecx
test ecx, ecx
jne 0x49b334
cmp dword [ebp - 0x18], 0
je 0x49b39f
push 0x5399d8
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x49b395
mov eax, 1
test eax, eax
je 0x49b38f
push 0xe6
push str.dlgprop.cpp
call fcn.004ade80
test eax, eax
je 0x49b38f
int3
xor ecx, ecx
test ecx, ecx
jne 0x49b372
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x49b3d1
mov eax, dword [ebp - 0x14]
and eax, 0xff
cmp eax, 3
jne 0x49b3d1
mov ecx, 1
test ecx, ecx
je 0x49b3cb
push 0xed
push str.dlgprop.cpp
call fcn.004ade80
test eax, eax
je 0x49b3cb
int3
xor edx, edx
test edx, edx
jne 0x49b3ae
call fcn.004c4cc3
cmp dword [eax + 0x1038], 0
je 0x49b3ee
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.0049b233
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0049b0f5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x44], 0
je 0x49b41e
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x44], 0
cmp dword [ebp - 8], 0
je 0x49b433
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov dword [edx + 0x44], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c3f8c
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0
jne 0x4c3fb2
push 0x146
push str.afxtls.cpp
call fcn.004ade80
test eax, eax
je 0x4c3fb2
int3
xor eax, eax
test eax, eax
jne 0x4c3f98
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
jmp 0x4c3fd1
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 8]
jge 0x4c4054
cmp dword [ebp + 0xc], 0
je 0x4c3ff4
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [edx + eax*8 + 4]
cmp ecx, dword [ebp + 0xc]
jne 0x4c4039
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4c4020
push 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx]
mov dword [ebp - 0x20], eax
jmp 0x4c4027
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx + edx*4], 0
jmp 0x4c404f
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
cmp dword [ecx + edx*4], 0
je 0x4c404f
mov dword [ebp - 4], 0
jmp 0x4c3fc8
cmp dword [ebp - 4], 0
je 0x4c40c8
mov eax, dword [ebp - 0x1c]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.004c4650
mov edx, dword [ebp - 0x1c]
add edx, 0x1c
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4c40b3
push 1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
call dword [edx]
mov dword [ebp - 0x24], eax
jmp 0x4c40ba
mov dword [ebp - 0x24], 0
push 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c40d1
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp + 0xc], 0
jne 0x4c4114
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4c4112
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.004c3f8c
jmp 0x4c4149
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004c4670
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4c4149
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.004c3f8c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x4c4122
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esp, ebp
pop ebp
ret 8
Function at 0x460a00
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x48fde8]
push esi
mov dword [ebp - 4], eax
xor eax, eax
mov esi, ecx
xor ecx, ecx
push edi
mov dword [ebp - 0x14], eax
mov word [ebp - 0x14], 2
mov word [ebp - 0x12], cx
mov edi, dword [ebp - 0x14]
lea edx, [esi + 0x1a]
mov dword [edx], edi
push 0x11
mov dword [edx + 4], ecx
push 2
mov dword [edx + 8], eax
mov dword [ebp - 0x10], eax
push 2
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
mov dword [edx + 0xc], eax
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x460adf
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2728
jne 0x460acd
push 0x4805aa
lea ecx, [ebp - 0x4c]
call dword [0x4988c0]
push str.C:diceProjectsBF2BranchesPatch_1_50CodeBF2IONetworkNetworkLayerSocketUDPSocket.cpp
lea ecx, [ebp - 0x30]
call dword [0x4988c0]
lea eax, [ebp - 0x4c]
push eax
push 0xd5
lea ecx, [ebp - 0x30]
push ecx
push 6
lea ecx, [ebp - 0x10c]
call fcn.0041d430
add eax, 0x40
push str.out_of_socket_descs
push eax
call dword [0x4989a8]
add esp, 8
lea ecx, [ebp - 0x10c]
call fcn.0041d7d0
lea ecx, [ebp - 0x30]
call dword [0x4988bc]
lea ecx, [ebp - 0x4c]
call dword [0x4988bc]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
call fcn.00462527
mov esp, ebp
pop ebp
ret 4
push 0x10
lea edx, [ebp - 0x14]
push edx
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x460b0d
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
call fcn.00462527
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x30]
test al, al
jne 0x460b38
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
call fcn.00462527
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
pop edi
mov al, 1
pop esi
call fcn.00462527
mov esp, ebp
pop ebp
ret 4
Function at 0x460f50
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x48fde8]
push esi
mov esi, ecx
lea edx, [ebp - 0x14]
lea ecx, [ebp + 8]
mov dword [ebp - 4], eax
mov dword [esi + 4], 0
call fcn.00460c00
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x460fdb
cmp word [ebp - 0x12], 0
je 0x460fae
push 4
lea ecx, [ebp - 0x18]
push ecx
push 4
push 0xffff
push eax
mov dword [ebp - 0x18], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x460fd1
mov ecx, dword [esi + 4]
push 0x10
lea eax, [ebp - 0x14]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x460fd1
mov ecx, dword [ebp + 0x24]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x30]
test al, al
jne 0x460ff5
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
lea ecx, [ebp + 8]
call dword [0x4988bc]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
call fcn.00462527
mov esp, ebp
pop ebp
ret 0x20
lea ecx, [ebp + 8]
call dword [0x4988bc]
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
call fcn.00462527
mov esp, ebp
pop ebp
ret 0x20