joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471760
Capabilities:
Set socket configuration

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
mov esi, dword [esp + 0x48]
cmp dword [ebx + 8], 0xc
je 0x471795
mov dword [esp + 8], 0x48d
mov dword [esp + 4], str.src_win_tcp.c
mov dword [esp], str.handle__type__UV_TCP
call fcn.004a0380
sub dword [ebx + 0x40], 1
jne 0x471892
mov eax, dword [ebx + 0x2c]
test al, 1
je 0x4718e1
lea eax, [edi + 0x10]
cmp dword [edi + 0x10], eax
je 0x4718c0
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 8]
mov dword [eax], edx
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [eax + 4], edx
mov eax, dword [esi + 0x20]
test eax, eax
js 0x471910
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x7010
mov dword [esp + 4], 0xffff
mov eax, dword [ebx + 0x90]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
test eax, eax
jne 0x471905
mov edx, dword [ebx + 0x2c]
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x48], 0xe
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x84], 0xffffffff
or edx, 0x19000
mov dword [ebx + 0x44], ebx
mov dword [ebx + 0x8c], 0
mov dword [ebx + 0x2c], edx
add dword [edi + 0x58], 1
mov ebp, dword [esi + 0x3c]
mov dword [esp], eax
call fcn.0045b940
mov dword [esp], esi
mov dword [esp + 4], eax
call ebp
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x471920
sub eax, 1
mov edx, dword [ebx + 0x2c]
test eax, eax
mov dword [ebx + 0x3c], eax
jne 0x47188a
test dl, 1
jne 0x471944
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
jns 0x4717aa
mov dword [esp + 8], 0x48f
mov dword [esp + 4], str.src_win_tcp.c
mov dword [esp], 0x6464ac
call fcn.004a0380
lea eax, [edi + 0x10]
cmp dword [edi + 0x10], eax
jne 0x4717b6
mov dword [esp + 8], 0x48f
mov dword [esp + 4], str.src_win_tcp.c
mov dword [esp], 0x6464c7
call fcn.004a0380
jmp 0x4717b6
test al, 0x40
je 0x4717aa
mov edx, eax
and edx, 0xffffffbf
test al, 0x20
mov dword [ebx + 0x2c], edx
je 0x4717aa
mov eax, dword [ebx + 4]
sub dword [eax + 4], 1
jmp 0x4717aa
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x471855
mov dword [esp], eax
call fcn.0047d590
jmp 0x471855
mov dword [esp + 8], 0x4a3
mov dword [esp + 4], str.src_win_tcp.c
mov dword [esp], 0x6464e3
call fcn.004a0380
mov eax, dword [ebx + 0x3c]
jmp 0x471874
test dl, 8
jne 0x47188a
mov eax, dword [edi + 0x2c]
or edx, 8
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x28], eax
mov dword [edi + 0x2c], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x471a80
Capabilities:
Set socket configuration

Disassembly:
push esi
push ebx
sub esp, 0x34
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov eax, dword [ebx + 0x90]
cmp eax, 0xffffffff
jne 0x471ac0
test esi, esi
mov eax, dword [ebx + 0x2c]
jne 0x471ab0
and eax, 0xfdffffff
mov dword [ebx + 0x2c], eax
xor eax, eax
add esp, 0x34
pop ebx
pop esi
ret
or eax, 0x2000000
mov dword [ebx + 0x2c], eax
add esp, 0x34
xor eax, eax
pop ebx
pop esi
ret
lea edx, [esp + 0x2c]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x10], 4
mov dword [esp + 8], 1
mov dword [esp + 4], 6
mov dword [esp + 0xc], edx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
cmp eax, 0xffffffff
jne 0x471a98
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x471aa9
jmp 0x471a98

Function at 0x472650
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push ebx
sub esp, 0x24
mov dword [esp], 0xc
call fcn.00458a30
test eax, eax
je 0x472731
mov ebx, eax
mov eax, dword [esp + 0x34]
mov dword [ebx], eax
mov eax, dword [esp + 0x38]
mov dword [ebx + 4], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x4732d0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
test eax, eax
jne 0x4726e0
call dword [sym.imp.msvcrt.dll__errno]
mov esi, dword [eax]
mov dword [esp], ebx
call fcn.00458a40
cmp esi, 0xb
je 0x472710
jle 0x472720
cmp esi, 0xd
je 0x472700
cmp esi, 0x16
jne 0x472724
mov esi, 0xfffff019
add esp, 0x24
mov eax, esi
pop ebx
pop esi
ret
mov edx, dword [esp + 0x30]
xor esi, esi
mov dword [edx], eax
mov dword [ebx + 8], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 4
add esp, 0x24
mov eax, esi
pop ebx
pop esi
ret
mov esi, 0xfffff004
add esp, 0x24
mov eax, esi
pop ebx
pop esi
ret
mov esi, 0xfffff008
add esp, 0x24
mov eax, esi
pop ebx
pop esi
ret
test esi, esi
je 0x4726f7
mov esi, 0xfffff01a
add esp, 0x24
mov eax, esi
pop ebx
pop esi
ret
mov esi, 0xfffff027
jmp 0x4726f7
Function at 0x474c30
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, eax
movzx eax, cl
sub esp, 0x4c
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x1c], edx
movzx edi, byte [esp + 0x64]
lea ebx, [esp + 0x2a]
mov dword [esp + 0x18], eax
jmp 0x474c90
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 4], edi
mov dword [esp], eax
mov eax, ebx
call fcn.004749d0
mov dword [esp + 4], eax
mov eax, dword [esi + 0x90]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
sub esp, 8
test eax, eax
jne 0x474cc0
call ebp
cmp eax, 0x57
jne 0x474cd0
mov eax, dword [esi + 0x90]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
sub esp, 8
test eax, eax
jne 0x474c55
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x68]
mov dword [edx], eax
jmp 0x474c55
add esp, 0x4c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call ebp
mov ecx, dword [esp + 0x68]
mov dword [ecx], eax
add esp, 0x4c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4792d0
Capabilities:
Set socket configuration

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
cmp dword [edx + 0x38], 0xffffffff
mov dword [esp + 0x1c], 1
jne 0x479331
mov edi, eax
lea eax, [esp + 0x1c]
mov esi, ecx
mov ebx, edx
mov dword [esp + 4], 0x8004667e
mov dword [esp], ecx
mov dword [esp + 8], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x479324
mov eax, dword [esp + 0x30]
mov ecx, esi
mov edx, ebx
mov dword [esp], eax
mov eax, edi
call fcn.00479160
add esp, 0x20
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov eax, 0xfffff00e
jmp 0x47931d
Function at 0x47ad80
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x23c
mov edi, dword [esp + 0x250]
mov esi, dword [esp + 0x254]
test edi, edi
je 0x47aed0
test esi, esi
je 0x47aed0
lea ebx, [esp + 0x28]
mov dword [esp], 0x104
mov dword [esp + 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
sub esp, 8
test eax, eax
je 0x47ae95
cmp eax, 0x104
ja 0x47aee0
xor edx, edx
mov word [esp + eax*2 + 0x28], dx
lea edx, [eax - 1]
cmp word [esp + edx*2 + 0x28], 0x5c
je 0x47aeb0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call ebp
sub esp, 0x20
test eax, eax
je 0x47ae95
mov edx, dword [esi]
cmp edx, eax
jl 0x47aee7
test edx, edx
mov eax, 0x7fffffff
mov dword [esp + 0x1c], 0
cmovs edx, eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call ebp
sub esp, 0x20
test eax, eax
je 0x47ae95
sub eax, 1
mov dword [esi], eax
add esp, 0x23c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
call fcn.0045b940
add esp, 0x23c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 3
je 0x47aec1
xor eax, eax
mov word [esp + edx*2 + 0x28], ax
jmp 0x47ade9
cmp word [esp + 0x2a], 0x3a
jne 0x47aeb5
jmp 0x47ade9
mov eax, 0xfffff019
jmp 0x47aea3
mov eax, 0xfffff01a
jmp 0x47aea3
mov dword [esi], eax
mov eax, 0xfffff024
jmp 0x47aea3

Function at 0x47b100
Capabilities:
Enumerate processes

Disassembly:
push edi
push esi
push ebx
sub esp, 0x140
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0
mov dword [esp], 2
mov edi, eax
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov ebx, eax
lea esi, [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], esi
call sub.KERNEL32.dll_Process32First
sub esp, 8
test eax, eax
jne 0x47b163
jmp 0x47b185
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_Process32Next
sub esp, 8
test eax, eax
je 0x47b185
cmp dword [esp + 0x20], edi
jne 0x47b150
mov esi, dword [esp + 0x30]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, esi
add esp, 0x140
pop ebx
pop esi
pop edi
ret
mov esi, 0xffffffff
jmp 0x47b16d
Function at 0x47c810
Capabilities:
Get common file path
Get session user name

Disassembly:
push edi
push esi
push ebx
sub esp, 0x440
mov ebx, dword [esp + 0x450]
test ebx, ebx
je 0x47c980
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0x2c]
mov dword [esp + 4], 0x20008
mov dword [esp], eax
mov dword [esp + 8], edx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
sub esp, 0xc
test eax, eax
je 0x47c905
mov eax, dword [esp + 0x2c]
lea esi, [esp + 0x30]
lea edi, [esp + 0x238]
mov dword [esp + 0x30], 0x104
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
sub esp, 0xc
test eax, eax
jne 0x47c8b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
cmp ebx, 0x7a
je 0x47c9a8
mov dword [esp], ebx
call fcn.0045b940
add esp, 0x440
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [esp + 4], esi
lea esi, [esp + 0x36]
mov dword [esp + 0x30], 0x101
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
sub esp, 8
test eax, eax
jne 0x47c920
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x47c9a8
mov dword [esp], eax
call fcn.0045b940
add esp, 0x440
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
call fcn.0045b940
add esp, 0x440
pop ebx
pop esi
pop edi
ret
lea eax, [ebx + 0x10]
mov dword [ebx + 0x10], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.0047c0e0
test eax, eax
jne 0x47c8aa
mov dword [ebx], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call fcn.0047c0e0
test eax, eax
jne 0x47c990
mov dword [ebx + 0xc], 0
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 8], 0xffffffff
jmp 0x47c8aa
mov eax, 0xfffff019
jmp 0x47c8aa
mov edx, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp], edx
call fcn.00458a40
mov eax, dword [esp + 0x1c]
jmp 0x47c8aa
mov eax, 0xfffff027
jmp 0x47c8aa
Function at 0x47d330
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push esi
push ebx
sub esp, 0x434
lea eax, [esp + 0x2c]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
test eax, eax
jne 0x47d57b
mov dword [esp + 8], 0x6ac7cc
mov dword [esp + 4], 0
mov dword [esp], str.0.0.0.0
call fcn.00459ac0
test eax, eax
jne 0x47d54a
mov dword [esp + 8], 0x6ac7b0
mov dword [esp + 4], 0
mov dword [esp], 0x6476bb
call fcn.00459b30
test eax, eax
jne 0x47d54a
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
mov esi, dword [sym.imp.WS2_32.dll_socket]
call esi
sub esp, 0xc
cmp eax, 0xffffffff
mov ebx, eax
je 0x47d4e0
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x274
mov dword [esp + 8], 0x2005
mov dword [esp + 4], 0xffff
mov dword [esp], ebx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1bc]
mov dword [esp + 0xc], eax
call dword [sym.imp.WS2_32.dll_getsockopt]
sub esp, 0x14
cmp eax, 0xffffffff
je 0x47d54f
test byte [esp + 0x1be], 2
je 0x47d4c0
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
cmp eax, 0xffffffff
je 0x47d565
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0x17
call esi
sub esp, 0xc
cmp eax, 0xffffffff
mov ebx, eax
je 0x47d520
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x274
mov dword [esp + 8], 0x2005
mov dword [esp + 4], 0xffff
mov dword [esp], ebx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1bc]
mov dword [esp + 0xc], eax
call dword [sym.imp.WS2_32.dll_getsockopt]
sub esp, 0x14
cmp eax, 0xffffffff
je 0x47d54f
test byte [esp + 0x1be], 2
je 0x47d4d0
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
cmp eax, 0xffffffff
je 0x47d565
add esp, 0x434
pop ebx
pop esi
ret
mov dword [0x6ac7e0], 1
jmp 0x47d41b
mov dword [0x6ac7dc], 1
jmp 0x47d4a1
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
lea edx, [eax - 0x273b]
cmp edx, 1
jbe 0x47d430
sub eax, 0x273e
cmp eax, 1
jbe 0x47d430
call ebx
mov dword [esp + 4], str.socket
mov dword [esp], eax
call fcn.0045b880
mov esi, esi
lea edi, [edi]
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
lea edx, [eax - 0x273b]
cmp edx, 1
jbe 0x47d4b6
sub eax, 0x273e
cmp eax, 1
ja 0x47d505
add esp, 0x434
pop ebx
pop esi
ret
call sub.msvcrt.dll_abort
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 4], str.getsockopt
mov dword [esp], eax
call fcn.0045b880
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 4], str.closesocket
mov dword [esp], eax
call fcn.0045b880
mov dword [esp + 4], str.WSAStartup
mov dword [esp], eax
call fcn.0045b880
nop
lea esi, [esi]
Function at 0x481b50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
xor eax, eax
sub esp, 0x14
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x481b6e
mov esi, dword [esp + 0x28]
test esi, esi
je 0x481b6e
mov ecx, dword [ebx + 0x1c]
test ecx, ecx
je 0x481b74
add esp, 0x14
pop ebx
pop esi
ret
mov edx, dword [ebx + 0xa4]
cmp edx, 4
je 0x481b84
cmp edx, 9
jne 0x481b6e
mov esi, dword [ebx + 0x10]
movzx eax, byte [esi + 0xc4]
test al, al
jne 0x481c62
cmp byte [ebx + 0xd4], 0
je 0x481c70
mov eax, dword [esp + 0x28]
mov edx, dword [eax + 0x14]
test edx, edx
je 0x481be0
test byte [esi + 0xdd], 0x80
je 0x481ce0
cmp dword [esp + 0x24], 0x65
je 0x481ca3
mov dword [esp + 4], str.Application_used_invalid_status_code_for_upgrade_response__n
mov dword [esp], esi
call fcn.0048aef0
xor eax, eax
jmp 0x481b6e
mov dword [esp], eax
call fcn.0048da30
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x1c], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 0xac], eax
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x481c18
mov dword [esp + 4], str.HEAD
mov dword [esp], eax
call fcn.0048b740
test eax, eax
jne 0x481cc7
cmp dword [esp + 0x24], 0xc7
setbe dl
cmp dword [esp + 0x24], 0xcc
sete al
or dl, al
jne 0x481cc7
cmp dword [esp + 0x24], 0x130
je 0x481cc7
cmp dword [ebx + 0xa4], 4
je 0x481cf7
cmp byte [ebx + 0x9f], 0
jne 0x481c62
mov dword [esp], ebx
call fcn.00481d50
mov eax, 1
jmp 0x481b6e
test byte [esi + 0xdc], 8
je 0x481ba3
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [ebx + 0x54]
je 0x481ba3
mov dword [esp + 4], str.Attempted_to_queue_response_on_wrong_thread__n
mov dword [esp], esi
call fcn.0048aef0
xor eax, eax
jmp 0x481b6e
mov dword [esp], eax
call fcn.0048da30
mov eax, dword [esp + 0x28]
mov dword [ebx + 0xac], 0x65
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx + 0x2c]
test eax, eax
jne 0x481c00
mov eax, dword [esp + 0x28]
mov edx, dword [eax + 0x3c]
mov eax, dword [eax + 0x38]
mov dword [ebx + 0x7c], edx
mov dword [ebx + 0x78], eax
jmp 0x481c44
mov dword [esp + 4], str.Attempted_upgrade_connection_on_daemon_without_MHD_ALLOW_UPGRADE_option__n
mov dword [esp], esi
call fcn.0048aef0
xor eax, eax
jmp 0x481b6e
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x481c51
mov dword [esp + 4], str.POST
mov dword [esp], eax
call fcn.0048b740
test eax, eax
je 0x481d2c
mov byte [ebx + 0x9d], 1
mov dword [ebx + 0xa4], 9
jmp 0x481c51
mov dword [esp + 4], 0x647d8c
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call fcn.0048b740
test eax, eax
jne 0x481d16
jmp 0x481c51
Function at 0x485bf0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
push ebp
push edi
lea edi, [eax + 0x9c]
push esi
push ebx
mov esi, eax
sub esp, 0x1c
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp], edi
call ebp
mov ebx, dword [esi + 0x1c]
sub esp, 4
test ebx, ebx
jne 0x485d23
jmp 0x485d80
mov dword [eax], edx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
test eax, eax
je 0x485d40
mov dword [eax + 4], edx
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
test byte [esi + 0xdc], 4
je 0x485c61
cmp byte [ebx + 0x9e], 0
je 0x485d50
mov eax, dword [ebx + 0xd0]
test eax, eax
je 0x485c7d
mov dword [ebx + 0xd0], 0
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x20]
mov dword [esp], eax
call fcn.0048b3d0
mov eax, dword [esi + 0x40]
test eax, eax
je 0x485caa
lea edx, [ebx + 0x28]
mov dword [esp + 0xc], 1
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov edx, dword [esi + 0x44]
mov dword [esp], edx
call eax
mov ecx, dword [ebx + 0x84]
mov edx, dword [ebx + 0x4c]
mov eax, esi
call fcn.004851c0
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x485cd0
mov dword [esp], eax
call sym.xmrig_notls.exe_MHD_destroy_response
mov dword [ebx + 0x1c], 0
mov eax, dword [ebx + 0x98]
cmp eax, 0xffffffff
je 0x485cef
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
test eax, eax
jne 0x485d94
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x485cfe
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov dword [esp], edi
call ebp
mov ebx, dword [esi + 0x1c]
sub esp, 4
sub dword [esi + 0xcc], 1
mov byte [esi + 0xc6], 0
test ebx, ebx
je 0x485d80
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
test eax, eax
jne 0x485c20
mov dword [esi + 0x18], edx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
test eax, eax
jne 0x485c2f
mov dword [esi + 0x1c], edx
jmp 0x485c32
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebx + 0x50]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
jne 0x485dba
mov eax, dword [ebx + 0x50]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x485c61
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x6ab740]
mov dword [esp + 0xc], str.Close_socket_failed._n
mov dword [esp + 8], 0xc14
mov dword [esp + 4], str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov dword [esp], eax
call dword [0x6ab744]
mov eax, dword [0x6ab740]
mov dword [esp + 0xc], str.Failed_to_join_a_thread_n
mov dword [esp + 8], 0xbdf
mov dword [esp + 4], str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov dword [esp], eax
call dword [0x6ab744]
Function at 0x4879c0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x20]
mov esi, dword [ebx + 0x10]
test byte [esi + 0xdd], 0x20
je 0x487b35
mov edx, dword [ebx + 0xd0]
test edx, edx
je 0x487a00
mov dword [esp + 4], str.Error:_connection_scheduled_for__upgrade__cannot_be_suspended
mov dword [esp], esi
call fcn.0048aef0
add esp, 0x10
pop ebx
pop esi
pop edi
ret
lea edi, [esi + 0x9c]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
cmp byte [ebx + 0xdc], 0
jne 0x487ac5
test byte [esi + 0xdc], 4
jne 0x487a6a
mov ecx, dword [esi + 0xd4]
cmp dword [ebx + 0x8c], ecx
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
je 0x487af0
test eax, eax
je 0x487b20
mov dword [eax + 8], edx
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
test eax, eax
je 0x487b10
mov dword [eax + 0xc], edx
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
test eax, eax
je 0x487ac0
mov dword [eax], edx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
test eax, eax
je 0x487ae5
mov dword [eax + 4], edx
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov eax, dword [esi + 0x10]
mov dword [ebx], eax
mov eax, dword [esi + 0x14]
test eax, eax
je 0x487ae0
mov eax, dword [esi + 0x10]
mov dword [eax + 4], ebx
mov dword [esi + 0x10], ebx
mov byte [ebx + 0xd4], 1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esi + 8], edx
jmp 0x487a75
mov byte [ebx + 0xdc], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x4879f4
mov dword [esi + 0x14], ebx
jmp 0x487aa0
mov dword [esi + 0xc], edx
jmp 0x487a81
test eax, eax
je 0x487b30
mov dword [eax + 8], edx
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
test eax, eax
jne 0x487a59
mov dword [esi + 0x24], edx
jmp 0x487a5c
mov dword [esi + 0x2c], edx
jmp 0x487a5c
mov dword [esi + 0x28], edx
jmp 0x487a4b
mov dword [esi + 0x20], edx
jmp 0x487af7
mov eax, dword [0x6ab740]
mov dword [esp + 0xc], str.Cannot_suspend_connections_without_enabling_MHD_ALLOW_SUSPEND_RESUME__n
mov dword [esp + 8], 0xa5d
mov dword [esp + 4], str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov dword [esp], eax
call dword [0x6ab744]
nop
lea esi, [esi]
Function at 0x487b60
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x20]
mov ebx, dword [esi + 0x10]
test byte [ebx + 0xdd], 0x20
je 0x487c03
lea edi, [ebx + 0x9c]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
mov byte [esi + 0xdc], 1
mov byte [ebx + 0xc7], 1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
cmp dword [ebx + 0xbc], 0xffffffff
je 0x487bdd
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x649162
mov eax, dword [ebx + 0xc0]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
test eax, eax
jle 0x487be4
add esp, 0x10
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x487bdd
mov dword [esp + 4], str.Failed_to_signal_resume_via_inter_thread_communication_channel.
mov dword [esp], ebx
call fcn.0048aef0
jmp 0x487bdd
mov eax, dword [0x6ab740]
mov dword [esp + 0xc], str.Cannot_resume_connections_without_enabling_MHD_ALLOW_SUSPEND_RESUME__n
mov dword [esp + 8], 0xa7b
mov dword [esp + 4], str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov dword [esp], eax
call dword [0x6ab744]
lea esi, [esi]