joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
xor edi, edi
mov dword [ebp - 4], ebx
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x454676
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 8], 5
sub edx, 4
add edx, ebx
mov dword [ebp - 0xc], edx
lea eax, [edi + ebx]
cmp eax, edx
jae 0x45469f
lea esp, [esp]
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x45469f
inc eax
cmp eax, edx
jb 0x454690
mov ecx, eax
sub ecx, edi
mov edi, eax
sub ecx, ebx
sub edi, ebx
cmp eax, edx
jae 0x454782
cmp ecx, 2
jbe 0x454742
xor esi, esi
movzx ebx, byte [eax + 4]
lea ecx, [ebx + 1]
test cl, 0xfe
jne 0x454774
movzx ecx, byte [eax + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 1]
shl ebx, 8
or ebx, ecx
mov ecx, dword [ebp + 8]
add ecx, edi
add edi, 5
sub ebx, ecx
mov dword [ebp - 8], ecx
test esi, esi
je 0x45471c
and esi, 6
mov edx, ebx
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x454717
mov edx, 0x100
shl edx, cl
dec edx
xor ebx, edx
sub ebx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov byte [eax + 4], bl
mov ebx, dword [ebp - 4]
jmp 0x454682
shr esi, cl
test esi, esi
je 0x4546bc
cmp esi, 4
ja 0x454769
cmp esi, 3
je 0x454769
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x4546bc
or esi, 8
shr esi, 1
inc edi
jmp 0x454682
mov ebx, dword [ebp - 4]
or esi, 8
shr esi, 1
inc edi
jmp 0x454682
cmp ecx, 2
jbe 0x454797
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
shr esi, cl
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b060
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d0a3
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x57f7a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.0045d4d0
mov dword [edi], eax
push 0
mov dword [ebp - 4], 0
push 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.0045d490
mov dword [edi + 8], eax
push 0
mov byte [ebp - 4], 1
push 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.0045d490
mov dword [edi + 0x10], eax
lea eax, [edi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [edi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [edi + 0x5c], 7
xor eax, eax
mov dword [edi + 0x58], 0
mov word [edi + 0x48], ax
mov dword [edi + 0x70], eax
mov dword [edi + 0x74], 7
mov word [edi + 0x60], ax
mov dword [edi + 0x88], eax
mov dword [edi + 0x8c], 7
mov word [edi + 0x78], ax
mov dword [edi + 0xa4], eax
mov dword [edi + 0xa8], 7
mov word [edi + 0x94], ax
mov dword [edi + 0xac], eax
mov dword [edi + 0xb0], 0xffffffff
mov dword [edi + 0xb4], eax
mov eax, edi
mov dword [edi + 0xb8], 2
mov dword [edi + 0xbc], 2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x45e3e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d738
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x57f7a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
cmp dword [esi + 0x14], 8
jb 0x45e41b
mov eax, dword [esi]
jmp 0x45e41d
mov eax, esi
cmp dword [edi + 0x14], 8
jb 0x45e425
mov ecx, dword [edi]
push eax
push ecx
push str.createProcess_filename____s___param____s_
push 0xb5
push str.common::create
call fcn.00439030
push edi
mov edx, 0x559e88
lea ecx, [ebp - 0x40]
call fcn.00414440
push 0x559e88
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.00414100
add esp, 0x24
mov byte [ebp - 4], 2
cmp dword [ebp - 0x2c], 8
jb 0x45e477
push dword [ebp - 0x40]
call fcn.004db8b0
add esp, 4
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
cmp dword [esi + 0x10], eax
je 0x45e4c7
push esi
mov edx, 0x559e8c
lea ecx, [ebp - 0x58]
call fcn.00414440
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.0040a780
mov byte [ebp - 4], 2
cmp dword [ebp - 0x44], 8
jb 0x45e4c7
push dword [ebp - 0x58]
call fcn.004db8b0
add esp, 4
push 0x40
lea eax, [ebp - 0xac]
push 0
push eax
call fcn.004f31f0
add esp, 0xc
mov dword [ebp - 0xb0], 0x44
lea ecx, [ebp - 0x68]
mov dword [ebp - 0xac], 0
xor eax, eax
mov dword [ebp - 0xa8], 0
cmp dword [ebp - 0x14], 8
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x80], eax
push ecx
push 0
push 0
push 0x10
push 0
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push 0
push eax
push 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x84], 1
movdqu xmmword [ebp - 0x68], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x45e56d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.createProcess_failed____lastError___d
push 0xc8
push str.common::create
call fcn.00439030
add esp, 0x10
xor esi, esi
jmp 0x45e579
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x68]
cmp dword [ebp - 0x14], 8
jb 0x45e58a
push dword [ebp - 0x28]
call fcn.004db8b0
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ea604
mov esp, ebp
pop ebp
ret
Function at 0x45f2e0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d876
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x57f7a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x238], 0
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.004f31f0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21c]
cmp word [ebp - 0x21c], 0
je 0x45f389
jmp 0x45f380
add eax, 2
cmp word [eax], 0
jne 0x45f380
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.0041b3d0
push str.XuanZhi9_
lea edx, [ebp - 0x234]
mov dword [ebp - 4], 1
mov ecx, 0x58b7f4
call fcn.00430cb0
add esp, 4
cmp dword [ebp - 0x220], 8
jb 0x45f3d2
push dword [ebp - 0x234]
call fcn.004db8b0
add esp, 4
mov eax, 0x58b7f4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ea604
mov esp, ebp
pop ebp
ret 4

Function at 0x45f4a0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d8db
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x57f7a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x224], 0
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
mov dword [ebp - 0x220], 0x58b810
call fcn.004f31f0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [0x58b824], 7
mov dword [0x58b820], 0
mov word [0x58b810], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21c]
cmp word [ebp - 0x21c], 0
je 0x45f54a
add eax, 2
cmp word [eax], 0
jne 0x45f541
push eax
lea eax, [ebp - 0x21c]
mov ecx, 0x58b810
push eax
call fcn.0041b3d0
mov eax, 0x58b810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ea604
mov esp, ebp
pop ebp
ret 4
Function at 0x45fb60
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d8db
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x57f7a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x224], 0
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
mov dword [ebp - 0x220], 0x58b864
call fcn.004f31f0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [0x58b878], 7
mov dword [0x58b874], 0
mov word [0x58b864], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21c]
cmp word [ebp - 0x21c], 0
je 0x45fc0a
add eax, 2
cmp word [eax], 0
jne 0x45fc01
push eax
lea eax, [ebp - 0x21c]
mov ecx, 0x58b864
push eax
call fcn.0041b3d0
mov eax, 0x58b864
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ea604
mov esp, ebp
pop ebp
ret 4

Function at 0x460120
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52dab7
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x57f7a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
mov dword [ebp - 0x250], 0
call fcn.004f31f0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21c]
cmp word [ebp - 0x21c], 0
je 0x4601c9
lea esp, [esp]
add eax, 2
cmp word [eax], 0
jne 0x4601c0
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.0041b3d0
push str.lddownloader_
lea edx, [ebp - 0x234]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x24c]
call fcn.00430cb0
add esp, 4
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0045fc40
cmp dword [ebp - 0x238], 8
jb 0x46021e
push dword [ebp - 0x24c]
call fcn.004db8b0
add esp, 4
xor eax, eax
mov dword [ebp - 0x238], 7
cmp dword [ebp - 0x220], 8
mov dword [ebp - 0x23c], 0
mov word [ebp - 0x24c], ax
jb 0x460252
push dword [ebp - 0x234]
call fcn.004db8b0
add esp, 4
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
mov dword [ebp - 4], 3
lea eax, [ebp - 0x21c]
cmp word [ebp - 0x21c], 0
je 0x46028f
add eax, 2
cmp word [eax], 0
jne 0x460286
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.0041b3d0
sub esp, 0x18
mov dword [ebp - 4], 4
mov ecx, esp
lea edx, [ebp - 0x234]
push str.lddownloaderlddownloader.log
call fcn.00430cb0
add esp, 4
mov ecx, esi
call fcn.0045fce0
add esp, 0x18
cmp dword [ebp - 0x220], 8
jb 0x4602e2
push dword [ebp - 0x234]
call fcn.004db8b0
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ea604
mov esp, ebp
pop ebp
ret 4
Function at 0x461f60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push esi
mov esi, ecx
lea ecx, [ebp - 4]
push ecx
push 0x2011f
push 0
push eax
push accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x461fc9
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 8], 0
push ecx
push 0
push 0x2001f
push 0
push 0x555a60
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push 0
push eax
push accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x461ffc
mov eax, dword [esi + 0x10]
test eax, eax
je 0x461ff3
cmp dword [esi + 0x14], 8
jb 0x461fd8
mov esi, dword [esi]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push 0x555a60
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x1c], 8
pop esi
jb 0x46200e
push dword [ebp + 8]
call fcn.004db8b0
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x462530
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x57f7a0]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x462585
mov eax, dword [esp]
cmp al, 2
jne 0x46257f
shr eax, 8
cmp al, 2
jne 0x46257f
call fcn.00467b70
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004ea604
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
mov eax, 2
xor ecx, esp
call fcn.004ea604
add esp, 0x194
ret

Function at 0x468590
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4685ac
cmp dword [esi + 0x6c], 0
je 0x4685ac
push 2
push 3
push esi
call fcn.0047e290
add esp, 0xc
push dword [esp + 0xc]
call fcn.00477530
add esp, 4
test esi, esi
je 0x4685cd
cmp dword [esi + 0x6c], 0
je 0x4685cd
push 3
push esi
call fcn.0047e2d0
add esp, 8
pop esi
ret

Function at 0x468d10
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x3c0], 2
je fcn.00468cc0
mov al, 1
ret
Function at 0x471fb0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x57f7a0]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push edi
mov edi, dword [esp + 0x114]
lea eax, [esp + 0x11c]
push eax
push dword [esp + 0x11c]
lea eax, [esp + 0x10]
push 0x100
push eax
call fcn.00474530
lea esi, [esp + 0x18]
add esp, 0x10
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x471ff5
sub esi, ecx
mov ecx, dword [edi + 0x140]
test ecx, ecx
je 0x472029
cmp byte [edi + 0x46b0], al
jne 0x472029
lea edx, [esp + 8]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x472014
mov byte [edi + 0x46b0], 1
cmp byte [edi + 0x370], 0
je 0x472063
mov byte [esp + esi + 8], 0xa
inc esi
cmp esi, 0x102
jae 0x4720bb
mov eax, dword [edi + 0x1b0]
mov byte [esp + esi + 8], 0
test eax, eax
je 0x47207a
push dword [edi + 0x13c]
lea ecx, [esp + 0xc]
push esi
push ecx
push 0
push edi
call eax
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004ea604
add esp, 0x108
ret
push dword [edi + 0x138]
push 1
push 2
push 0x536480
call fcn.004f1d71
push dword [edi + 0x138]
lea eax, [esp + 0x1c]
push 1
push esi
push eax
call fcn.004f1d71
mov ecx, dword [esp + 0x12c]
add esp, 0x20
pop edi
pop esi
xor ecx, esp
call fcn.004ea604
add esp, 0x108
ret
call fcn.004f18c9
int3

Function at 0x4720d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x57f7a0]
xor eax, esp
mov dword [esp + 0x804], eax
push edi
mov edi, dword [esp + 0x810]
test edi, edi
je 0x472199
cmp byte [edi + 0x370], 0
je 0x472199
push esi
lea eax, [esp + 0x81c]
push eax
push dword [esp + 0x81c]
lea eax, [esp + 0x10]
push 0x801
push eax
call fcn.00474530
lea esi, [esp + 0x18]
add esp, 0x10
lea ecx, [esi + 1]
lea ebx, [ebx]
mov al, byte [esi]
inc esi
test al, al
jne 0x472130
mov eax, dword [edi + 0x1b0]
sub esi, ecx
test eax, eax
je 0x47216e
push dword [edi + 0x13c]
lea ecx, [esp + 0xc]
push esi
push ecx
push 0
push edi
call eax
add esp, 0x14
pop esi
pop edi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004ea604
add esp, 0x808
ret
push dword [edi + 0x138]
push 1
push 2
push 0x536480
call fcn.004f1d71
push dword [edi + 0x138]
lea eax, [esp + 0x1c]
push 1
push esi
push eax
call fcn.004f1d71
add esp, 0x20
pop esi
mov ecx, dword [esp + 0x808]
pop edi
xor ecx, esp
call fcn.004ea604
add esp, 0x808
ret
Function at 0x472400
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
push eax
push edi
mov esi, dword [edi + eax*4 + 0x198]
call fcn.00472830
add esp, 8
push 0
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [ebp], 0
cmp ebx, 0xffffffff
jne 0x472486
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x47245e
pop edi
pop esi
mov dword [ebp], 0x51
xor eax, eax
pop ebp
pop ebx
ret
push esi
push edi
call fcn.00462c50
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.00471fb0
mov eax, dword [edi]
add esp, 0x14
mov dword [eax + 0x46b4], esi
mov eax, ebx
mov dword [ebp], 0x37
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x472830
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 8]
mov eax, ecx
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
shl eax, 4
mov ebp, dword [ebx + ecx*4 + 0x198]
lea esi, [ebx + 0x1bc]
add esi, eax
mov eax, dword [ebx + 0x3b8]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x3c], 3
je 0x4728e8
cmp dword [ebx + ecx*4 + 0x1ac], 0x472360
jne 0x4728e8
cmp dword [esi], 0
je 0x47287c
test edi, edi
je 0x4728e8
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.00471900
add esp, 0x14
cmp eax, 0xffffffff
je 0x4728e8
test al, 1
je 0x4728e8
cmp dword [esi], 0
jne 0x4728d1
mov eax, dword [ebx]
mov eax, dword [eax + 0x32c]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [section..data]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
jne 0x4728d1
pop edi
mov dword [esi + 4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4728e8
add dword [esi + 8], eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4728f0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x1b0]
test eax, eax
je 0x472919
push dword [esi + 0x13c]
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
push esi
call eax
add esp, 0x14
pop esi
ret
mov eax, dword [esp + 0xc]
cmp eax, 2
ja 0x472952
push dword [esi + 0x138]
lea eax, [eax + eax*2]
push 1
add eax, 0x536480
push 2
push eax
call fcn.004f1d71
push dword [esi + 0x138]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.004f1d71
add esp, 0x20
xor eax, eax
pop esi
ret

Function at 0x472a30
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp byte [eax + 0x1dc], 0
je 0x472a4d
push eax
call fcn.00418b00
add esp, 4
test eax, eax
jne 0x472a6f
xor al, al
ret
mov eax, dword [eax + 0x198]
cmp eax, 0xffffffff
je 0x472a4a
push 2
push 1
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x472a6f
xor al, al
ret
mov al, 1
ret
Function at 0x4733a0
Capabilities:
Set socket configuration

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push 4
push eax
push 1
mov esi, dword [edi]
push 6
push dword [esp + 0x20]
mov dword [esp + 0x20], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4733e8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.00462c50
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.004720d0
add esp, 0x14
pop edi
pop esi
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.004720d0
add esp, 8
pop edi
pop esi
ret
Function at 0x4734e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x108
mov eax, dword [0x57f7a0]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push edi
mov edi, dword [esp + 0x114]
cmp dword [edi + 0x94], 2
mov ebx, dword [edi]
je 0x4736da
cmp byte [edi + 0x37e], 0
push esi
jne 0x4736d0
cmp byte [edi + 0x39a], 0
jne 0x4736d0
mov esi, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x94]
mov dword [esp + 0x10], 0x80
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x473585
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.00462c50
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.00471fb0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004ea604
add esp, 0x108
ret
push 0x80
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0x80
push 0
push eax
call fcn.004f31f0
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x4735ed
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.00462c50
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.00471fb0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004ea604
add esp, 0x108
ret
lea eax, [edi + 0x138]
push eax
lea esi, [edi + 0x10a]
lea eax, [esp + 0x94]
push esi
push eax
call fcn.00473bd0
add esp, 0xc
test al, al
jne 0x473646
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.00462c50
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.00471fb0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004ea604
add esp, 0x108
ret
movdqu xmm0, xmmword [esi]
mov eax, dword [esi + 0x28]
movdqu xmmword [edi + 0x60], xmm0
movdqu xmm0, xmmword [esi + 0x10]
movdqu xmmword [edi + 0x70], xmm0
movq xmm0, qword [esi + 0x20]
movq qword [edi + 0x80], xmm0
mov dword [edi + 0x88], eax
mov ax, word [esi + 0x2c]
mov word [edi + 0x8c], ax
lea eax, [edi + 0x16c]
push eax
lea eax, [edi + 0x13c]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00473bd0
add esp, 0xc
test al, al
jne 0x4736d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.00462c50
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.00471fb0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004ea604
add esp, 0x108
ret
push edi
call fcn.00473130
add esp, 4
pop esi
mov ecx, dword [esp + 0x10c]
pop edi
pop ebx
xor ecx, esp
call fcn.004ea604
add esp, 0x108
ret
Function at 0x473f60
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x18
mov eax, dword [0x57f7a0]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
xor eax, eax
push edi
mov edi, dword [esp + 0x28]
push 4
cmp byte [esi + 0x4bc], al
setne al
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x473fc0
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.004720d0
add esp, 0xc
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004ea604
add esp, 0x18
ret
push dword [esi + 0x4c0]
mov dword [esp + 0x14], 1
call fcn.0047d2a0
push dword [esi + 0x4c4]
imul eax, eax, 0x3e8
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], eax
call fcn.0047d2a0
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0xc
lea eax, [esp + 0x28]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x474037
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.004720d0
add esp, 0x10
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
call fcn.004ea604
add esp, 0x18
ret