joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fd00
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4a4080]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x40
push 0
lea eax, [ebp - 0x44]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x40
push 0x36
lea ecx, [ebp - 0xc4]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x40
push 0x5c
lea edx, [ebp - 0x104]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [ebp + 0xc], 0x40
jbe 0x42fd67
push 0x40
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0042fe90
add esp, 0x10
jmp 0x42fd7b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x44]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [ebp - 0x108], 0
jmp 0x42fd96
mov eax, dword [ebp - 0x108]
add eax, 1
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0x40
jge 0x42fdf1
mov ecx, dword [ebp - 0x108]
movzx edx, byte [ebp + ecx - 0x44]
mov eax, dword [ebp - 0x108]
movzx ecx, byte [ebp + eax - 0xc4]
xor ecx, edx
mov edx, dword [ebp - 0x108]
mov byte [ebp + edx - 0xc4], cl
mov eax, dword [ebp - 0x108]
movzx ecx, byte [ebp + eax - 0x44]
mov edx, dword [ebp - 0x108]
movzx eax, byte [ebp + edx - 0x104]
xor eax, ecx
mov ecx, dword [ebp - 0x108]
mov byte [ebp + ecx - 0x104], al
jmp 0x42fd87
push 0x20
lea edx, [ebp - 0x64]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0x40
lea edx, [ebp - 0xc4]
push edx
call fcn.0042fc80
add esp, 0x18
push 0x20
lea eax, [ebp - 0x84]
push eax
push 0x20
lea ecx, [ebp - 0x64]
push ecx
push 0x40
lea edx, [ebp - 0x104]
push edx
call fcn.0042fc80
add esp, 0x18
cmp dword [ebp + 0x1c], 0x20
jbe 0x42fe42
mov dword [ebp - 0x10c], 0x20
jmp 0x42fe4b
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x110], ecx
mov edx, dword [ebp - 0x110]
push edx
lea eax, [ebp - 0x84]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00486b00
mov esp, ebp
pop ebp
ret

Function at 0x4301d0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp + 8]
xor edx, edx
xor eax, eax
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x6a09e667
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0xbb67ae85
mov eax, 4
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0x3c6ef372
mov edx, 4
imul eax, edx, 3
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0xa54ff53a
mov edx, 4
shl edx, 2
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x510e527f
mov ecx, 4
imul edx, ecx, 5
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x9b05688c
mov ecx, 4
imul edx, ecx, 6
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x1f83d9ab
mov ecx, 4
imul edx, ecx, 7
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x5be0cd19
pop ebp
ret
Function at 0x432240
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x4a4080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0xffffffff
jne 0x432271
xor al, al
jmp 0x4322e1
mov dword [ebp - 0x42c], 0x428
lea ecx, [ebp - 0x42c]
push ecx
mov edx, dword [ebp - 0x430]
push edx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x4322d2
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x40c]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x4322bb
mov edx, dword [ebp - 0x430]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x4322e1
lea eax, [ebp - 0x42c]
push eax
mov ecx, dword [ebp - 0x430]
push ecx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x432292
mov edx, dword [ebp - 0x430]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00486b00
mov esp, ebp
pop ebp
ret

Function at 0x4322f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ab90
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x4a4080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xa
mov eax, dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jne 0x43233d
jmp 0x43242f
mov ecx, dword [ebp - 0xc4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xd0], eax
mov edx, dword [ebp - 0xc4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jne 0x432375
jmp 0x43242f
mov eax, dword [ebp - 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jne 0x432396
jmp 0x43242f
push 0xb0
lea ecx, [ebp - 0xc0]
call fcn.00421330
push 1
push 0x40
push 0x22
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0xc0]
call fcn.00430d50
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx + 4]
lea ecx, [ebp + eax - 0xc0]
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator__void_const]
movzx ecx, al
test ecx, ecx
je 0x4323f4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
call fcn.0041d700
nop
jmp 0x43242f
mov edx, dword [ebp - 0xd0]
xor eax, eax
push eax
push edx
mov ecx, dword [ebp - 0xcc]
push ecx
lea ecx, [ebp - 0xc0]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const___long_long___int64__]
lea ecx, [ebp - 0xc0]
call fcn.00422460
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
call fcn.0041d700
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00486b00
mov esp, ebp
pop ebp
ret
Function at 0x4325f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov dword [ebp - 0x18], 0
push 0
push 0x80
push 3
push 0
push 1
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x432660
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
xor ecx, ecx
mov byte [ebp - 1], cl
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 1]
call fcn.00431820
mov ecx, eax
call fcn.004313f0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.004353f0
add esp, 8
xor eax, eax
jmp 0x43278d
push 0
push 0
push 0
push 2
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4326c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
xor eax, eax
mov byte [ebp - 2], al
lea ecx, [ebp - 0xac]
push ecx
lea ecx, [ebp - 2]
call fcn.00431ae0
mov ecx, eax
call fcn.00431450
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.004353f0
add esp, 8
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x43278d
push 0
push 0
push 0
push 4
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x43272c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov byte [ebp - 3], al
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 3]
call fcn.00431c20
mov ecx, eax
call fcn.00431430
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x30]
push eax
call fcn.004353f0
add esp, 8
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x43278d
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0xc], 0
jmp 0x432753
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x34]
jae 0x43276c
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x18], edx
jmp 0x43274a
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x441010
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x44109c
push esi
call fcn.00453780
add esp, 4
test al, al
jne 0x44109c
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x441033
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.0045bdf0
add esp, 0xc
test eax, eax
je 0x441067
sub eax, esi
push eax
push 0x2e
push esi
call fcn.0045bdf0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x441069
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x441095
mov al, byte [esi]
push eax
call fcn.00450540
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x441077
pop edi
movzx eax, bl
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4455a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov eax, 0x1b8
mov edx, 0x178
push esi
push edi
cmp dword [ebp], 0x4922b8
mov ecx, dword [ebp + 8]
cmovne eax, edx
mov dword [esp + 0x20], ecx
add eax, dword [ebp + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4455d8
mov byte [eax], 0
mov ebx, dword [esp + 0x30]
mov esi, dword [ebx + 0x8f0]
test esi, esi
je 0x44578c
push dword [ecx + 8]
mov edi, dword [esi + 0x14]
call dword [0x4a4028]
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
je 0x445631
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x201], 0
je 0x44563e
push dword [eax + 0x6c]
call dword [0x4a4028]
mov ecx, eax
add esp, 4
mov dword [esp + 0x10], ecx
test ecx, ecx
jne 0x445646
mov edi, dword [esp + 0x30]
push edi
call dword [0x4a4020]
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0x18
ret
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x202], 0
je 0x44565e
mov ecx, dword [eax + 0x4a8]
mov dword [esp + 0x14], ecx
jmp 0x445666
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x44567c
test byte [eax + 4], 0x10
je 0x44567c
lea edx, [eax + 0x74]
mov dword [esp + 0x2c], edx
jmp 0x445686
lea eax, [ebx + 0x8f4]
mov dword [esp + 0x2c], eax
mov eax, dword [ebx + 0x4b4]
mov ecx, 1
cmp eax, ecx
jbe 0x4456d3
mov eax, dword [ebx + 0x8f0]
add eax, 0x74
nop
cmp dword [eax - 8], 0
mov edx, edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], edi
je 0x4456cd
mov edi, dword [eax]
lea esi, [eax - 0x14]
cmp edi, edx
cmovge esi, dword [esp + 0x1c]
inc ecx
add eax, 0x60
cmp edi, edx
cmovge edi, edx
cmp ecx, dword [ebx + 0x4b4]
jb 0x4456a0
mov eax, dword [ebx + 0x4b4]
cmp ecx, eax
jne 0x4456e2
push esi
call fcn.004461e0
add esp, 4
jmp 0x4456ee
lea esi, [ecx + ecx*2]
shl esi, 5
add esi, dword [ebx + 0x8f0]
mov eax, dword [esp + 0x34]
push dword [esi]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
mov dword [esi + 0x14], eax
call dword [0x4a4020]
push dword [esi + 4]
call dword [0x4a4020]
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x18]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x28]
mov dword [esi], edi
mov dword [esi + 4], ebx
mov eax, dword [eax + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0xc]
lea ebp, [esi + 0x20]
push ebp
push dword [esp + 0x30]
mov eax, dword [eax + 0x238]
mov eax, dword [eax]
mov dword [esi + 8], eax
call fcn.00444dc0
add esp, 0x10
test al, al
jne 0x445781
push ebp
call fcn.00445040
push edi
mov dword [esi + 0xc], 0
call dword [0x4a4020]
push ebx
call dword [0x4a4020]
add esp, 0xc
mov eax, 0x1b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x44578c
mov byte [eax], 1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x44b670
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp byte [edi + 0x6e7], 0
je 0x44b70f
cmp dword [edi + 0x1a8], 0
je 0x44b6c7
push edi
call fcn.0043bd00
push 1
push edi
mov byte [esp + 0x14], al
call fcn.0043bfd0
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1a8]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push dword [esp + 0x28]
push edi
call fcn.0043bfd0
add esp, 0x28
pop edi
ret
mov ecx, dword [esp + 0xc]
mov eax, ecx
sub eax, 0
je 0x44b6dc
sub eax, 1
je 0x44b6dc
sub eax, 1
jne 0x44b70f
push dword [edi + 0x148]
lea eax, [ecx*2 + 0x492c88]
push 1
add eax, ecx
push 2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [edi + 0x148]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x20
pop edi
ret

Function at 0x44b8f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x110
mov eax, dword [0x4a4080]
xor eax, esp
mov dword [esp + 0x10c], eax
mov edx, dword [esp + 0x118]
mov eax, dword [esp + 0x11c]
push ebx
mov ebx, dword [esp + 0x128]
push ebp
mov ebp, dword [esp + 0x11c]
push edi
mov dword [esp + 0xc], eax
mov edi, dword [ebp + 0xc]
cmp edx, dword [edi + 0x128]
je 0x44b957
cmp edx, dword [edi + 0x12c]
je 0x44b957
pop edi
pop ebp
mov eax, 0x2b
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.00486b00
add esp, 0x110
ret
mov ecx, dword [esp + 0x12c]
xor eax, eax
cmp edx, dword [edi + 0x12c]
push esi
sete al
mov dword [esp + 0x14], 0x168
mov esi, 0x158
cmove esi, dword [esp + 0x14]
add esi, edi
lea eax, [eax*4 + 0x128]
mov eax, dword [eax + edi]
mov dword [esp + 0x18], eax
mov edx, dword [esi]
test edx, edx
je 0x44b9fd
mov edi, dword [esi + 8]
mov eax, dword [esi + 0xc]
cmp edi, eax
jbe 0x44b9bb
sub edi, eax
cmp ecx, edi
cmovb edi, ecx
add eax, edx
push edi
push eax
push dword [esp + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [esi + 0xc], edi
mov eax, dword [esi + 0xc]
jmp 0x44b9bd
xor edi, edi
cmp eax, dword [esi + 8]
jne 0x44b9e8
push dword [esi]
call dword [0x4a4020]
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test edi, edi
jle 0x44b9f2
xor eax, eax
mov dword [ebx], edi
jmp 0x44ba60
mov ecx, dword [esp + 0x130]
mov eax, dword [esp + 0x18]
push 0
push ecx
push dword [esp + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
jne 0x44ba53
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x44ba29
lea eax, [edi + 0x52]
jmp 0x44ba53
push 0x100
lea eax, [esp + 0x20]
push eax
push esi
call fcn.00435db0
push eax
push 0x492cb4
push ebp
call fcn.0044b720
add esp, 0x18
mov dword [ebp + 0x938], esi
mov eax, 0x38
mov dword [ebx], edi
cmp edi, 0xffffffff
jne 0x44ba60
mov dword [ebx], 0
mov ecx, dword [esp + 0x11c]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00486b00
add esp, 0x110
ret
Function at 0x44bac0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4a4080]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x118]
mov ecx, dword [esp + 0x114]
push ebx
mov ebx, dword [esp + 0x124]
push ebp
mov ebp, dword [esp + 0x118]
mov dword [esp + 8], eax
push esi
push edi
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + ecx*4 + 0x128]
shl ecx, 4
mov dword [esp + 0x14], edx
lea esi, [ecx + 0x158]
mov ecx, dword [esp + 0x12c]
add esi, eax
mov edx, dword [esi]
test edx, edx
je 0x44bb87
mov edi, dword [esi + 8]
mov eax, dword [esi + 0xc]
cmp edi, eax
jbe 0x44bb47
sub edi, eax
cmp ecx, edi
cmovb edi, ecx
add eax, edx
push edi
push eax
push dword [esp + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [esi + 0xc], edi
mov eax, dword [esi + 0xc]
jmp 0x44bb49
xor edi, edi
cmp eax, dword [esi + 8]
jne 0x44bb74
push dword [esi]
call dword [0x4a4020]
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test edi, edi
jle 0x44bb80
mov dword [ebx], 0
jmp 0x44bbe8
mov ecx, dword [esp + 0x12c]
push 0
push ecx
push dword [esp + 0x18]
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x44bbe8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x44bbbd
mov dword [ebx], 0x51
jmp 0x44bbe8
push 0x100
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.00435db0
push eax
push 0x492cb4
push ebp
call fcn.0044b720
mov dword [ebp + 0x938], esi
add esp, 0x18
mov dword [ebx], 0x38
mov ecx, dword [esp + 0x118]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00486b00
add esp, 0x10c
ret
Function at 0x44bc10
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4a4080]
xor eax, esp
mov dword [esp + 0x108], eax
mov edx, dword [esp + 0x114]
mov eax, dword [esp + 0x118]
push ebx
push ebp
mov ebp, dword [esp + 0x118]
mov dword [esp + 0xc], eax
push esi
push edi
mov ecx, dword [ebp + 0xc]
mov edi, dword [esp + 0x130]
mov eax, dword [ecx + edx*4 + 0x128]
lea esi, [ecx + 0x158]
mov dword [esp + 0x10], eax
mov eax, edx
shl eax, 4
add esi, eax
mov eax, dword [ecx + 0x238]
mov ebx, dword [esi + 4]
sub ebx, dword [esi + 8]
test byte [eax + 0x44], 3
je 0x44bcfa
cmp dword [ecx + edx*4 + 0x140], 0x459f60
jne 0x44bcfa
cmp dword [esi], 0
je 0x44bc8f
test ebx, ebx
je 0x44bcfa
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [esp + 0x20]
call fcn.0045b860
add esp, 0x14
cmp eax, 0xffffffff
je 0x44bcfa
test al, 1
je 0x44bcfa
mov ecx, dword [esi]
test ecx, ecx
jne 0x44bce0
mov eax, dword [ebp + 0x4c0]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x4a401c]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
test ecx, ecx
je 0x44bd36
mov ebx, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, dword [esi + 8]
push 0
push ebx
add eax, ecx
push eax
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x44bcfa
add dword [esi + 8], eax
push 0
push dword [esp + 0x130]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
mov dword [edi], 0
cmp ebx, 0xffffffff
jne 0x44bd6c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x44bd41
mov dword [edi], 0x51
jmp 0x44bd6c
mov dword [edi], 0x1b
or eax, 0xffffffff
jmp 0x44bd6e
push 0x100
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.00435db0
push eax
push 0x492ca0
push ebp
call fcn.0044b720
mov dword [ebp + 0x938], esi
add esp, 0x18
mov dword [edi], 0x37
mov eax, ebx
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00486b00
add esp, 0x10c
ret
Function at 0x44be00
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x110
mov eax, dword [0x4a4080]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x11c]
mov edx, dword [esp + 0x118]
push ebx
mov ebx, dword [esp + 0x118]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x128]
mov dword [esp + 4], eax
mov ecx, dword [ebx + 0xc]
cmp edx, dword [ecx + 0x128]
je 0x44be67
cmp edx, dword [ecx + 0x12c]
je 0x44be67
mov eax, 0x2b
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.00486b00
add esp, 0x110
ret
push ebp
push esi
xor eax, eax
mov esi, 0x158
push edi
mov edi, dword [ecx + 0x12c]
cmp edx, edi
mov dword [esp + 0x18], edi
sete al
lea eax, [eax*4 + 0x128]
mov ebp, dword [eax + ecx]
mov eax, 0x168
cmove esi, eax
mov eax, dword [ecx + 0x238]
add esi, ecx
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x44], 3
je 0x44bf31
xor eax, eax
cmp edx, dword [esp + 0x18]
sete al
lea eax, [eax*4 + 0x140]
cmp dword [eax + ecx], 0x459f60
jne 0x44bf31
cmp dword [esi], 0
je 0x44becc
test edi, edi
je 0x44bf31
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.0045b860
add esp, 0x14
cmp eax, 0xffffffff
je 0x44bf31
test al, 1
je 0x44bf31
mov ecx, dword [esi]
test ecx, ecx
jne 0x44bf1a
mov eax, dword [ebx + 0x4c0]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x4a401c]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
test ecx, ecx
je 0x44bf63
mov edi, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x44bf31
add dword [esi + 8], eax
push 0
push dword [esp + 0x134]
push dword [esp + 0x1c]
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
jne 0x44bf98
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x44bf6e
lea eax, [edi + 0x52]
jmp 0x44bf98
mov ecx, dword [esp + 0x10]
mov eax, 0x1b
jmp 0x44bfa3
push 0x100
lea eax, [esp + 0x20]
push eax
push esi
call fcn.00435db0
push eax
push 0x492ca0
push ebx
call fcn.0044b720
add esp, 0x18
mov dword [ebx + 0x938], esi
mov eax, 0x37
mov ecx, dword [esp + 0x10]
mov dword [ecx], edi
cmp edi, 0xffffffff
jne 0x44bfa9
mov dword [ecx], 0
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00486b00
add esp, 0x110
ret

Function at 0x44caa0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push 0
push dword [esp + 0xc]
call fcn.00459f20
add esp, 8
test al, al
je 0x44cacb
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.004459d0
add esp, 8
test eax, eax
je 0x44caf1
mov al, 1
pop ecx
ret
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x128]
cmp eax, 0xffffffff
je 0x44caf1
push 2
push 1
lea ecx, [esp + 0xb]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
setne al
pop ecx
ret
xor al, al
pop ecx
ret