joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f93c
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1a0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rax, qword [rbp + 0x20]
mov qword [rbp - 8], rax
mov eax, 0
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, dword [rbp + 0x28]
cmp eax, ecx
jl 0x49f97a
jmp 0x49fb45
mov eax, dword [rbp - 0xc]
movsxd rax, eax
mov rcx, qword [rbp - 8]
add rcx, rax
mov qword [rbp - 0x18], rcx
mov eax, dword [rbp + 0x28]
mov ecx, dword [rbp - 0xc]
sub eax, ecx
mov dword [rbp - 0x1c], eax
mov rax, qword [rbp + 0x18]
mov ecx, dword [rax]
movsxd rcx, ecx
mov eax, 0
mov r9, rax
mov eax, dword [rbp - 0x1c]
mov r8, rax
mov rax, qword [rbp - 0x18]
mov r11, rax
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.ws2_32.dll_send
mov dword [rbp - 0x20], eax
mov eax, dword [rbp - 0x20]
cmp eax, 0
jge 0x49fb35
call fcn.0049c6b2
mov dword [rbp - 0x24], eax
mov eax, dword [rbp - 0x24]
mov ecx, dword [0x0051278c]
cmp eax, ecx
jne 0x49fa8e
mov rax, qword [rbp + 0x18]
mov r11, rax
lea rax, [rbp - 0x88]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004a00a3
mov eax, 0x30
mov r8, rax
lea rax, [rbp - 0x88]
mov r11, rax
lea rax, [rbp - 0x58]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
movzx eax, byte [rbp - 0x58]
cmp eax, 0
je 0x49fa89
movabs rax, 0x28
mov r8, rax
lea rax, [rbp - 0x58]
mov r11, rax
lea rax, [rbp - 0xb8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0xb8]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x49fb9e
jmp 0x49f967
mov eax, dword [rbp - 0x24]
mov r11, rax
lea rax, [rbp - 0x118]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0049c386
mov eax, 0x30
mov r8, rax
lea rax, [rbp - 0x118]
mov r11, rax
lea rax, [rbp - 0xe8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
movzx eax, byte [rbp - 0xe8]
cmp eax, 0
je 0x49fb35
movabs rax, 0x28
mov r8, rax
lea rax, [rbp - 0xe8]
mov r11, rax
lea rax, [rbp - 0x148]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0x148]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x49fb9e
mov eax, dword [rbp - 0xc]
mov ecx, dword [rbp - 0x20]
add eax, ecx
mov dword [rbp - 0xc], eax
jmp 0x49f967
mov eax, dword [rbp - 0xc]
mov dword [rbp - 0x17c], eax
mov eax, 4
mov r8, rax
lea rax, [rbp - 0x178]
mov r11, rax
lea rax, [rbp - 0x17c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0042c0a5
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0x178]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x49fb9e
leave
ret
Function at 0x49f947
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1a0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rax, qword [rbp + 0x20]
mov qword [rbp - 8], rax
mov eax, 0
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, dword [rbp + 0x28]
cmp eax, ecx
jl 0x49f97a
jmp 0x49fb45
mov eax, dword [rbp - 0xc]
movsxd rax, eax
mov rcx, qword [rbp - 8]
add rcx, rax
mov qword [rbp - 0x18], rcx
mov eax, dword [rbp + 0x28]
mov ecx, dword [rbp - 0xc]
sub eax, ecx
mov dword [rbp - 0x1c], eax
mov rax, qword [rbp + 0x18]
mov ecx, dword [rax]
movsxd rcx, ecx
mov eax, 0
mov r9, rax
mov eax, dword [rbp - 0x1c]
mov r8, rax
mov rax, qword [rbp - 0x18]
mov r11, rax
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.ws2_32.dll_send
mov dword [rbp - 0x20], eax
mov eax, dword [rbp - 0x20]
cmp eax, 0
jge 0x49fb35
call fcn.0049c6b2
mov dword [rbp - 0x24], eax
mov eax, dword [rbp - 0x24]
mov ecx, dword [0x0051278c]
cmp eax, ecx
jne 0x49fa8e
mov rax, qword [rbp + 0x18]
mov r11, rax
lea rax, [rbp - 0x88]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004a00a3
mov eax, 0x30
mov r8, rax
lea rax, [rbp - 0x88]
mov r11, rax
lea rax, [rbp - 0x58]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
movzx eax, byte [rbp - 0x58]
cmp eax, 0
je 0x49fa89
movabs rax, 0x28
mov r8, rax
lea rax, [rbp - 0x58]
mov r11, rax
lea rax, [rbp - 0xb8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0xb8]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x49fb9e
jmp 0x49f967
mov eax, dword [rbp - 0x24]
mov r11, rax
lea rax, [rbp - 0x118]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0049c386
mov eax, 0x30
mov r8, rax
lea rax, [rbp - 0x118]
mov r11, rax
lea rax, [rbp - 0xe8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
movzx eax, byte [rbp - 0xe8]
cmp eax, 0
je 0x49fb35
movabs rax, 0x28
mov r8, rax
lea rax, [rbp - 0xe8]
mov r11, rax
lea rax, [rbp - 0x148]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0x148]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x49fb9e
mov eax, dword [rbp - 0xc]
mov ecx, dword [rbp - 0x20]
add eax, ecx
mov dword [rbp - 0xc], eax
jmp 0x49f967
mov eax, dword [rbp - 0xc]
mov dword [rbp - 0x17c], eax
mov eax, 4
mov r8, rax
lea rax, [rbp - 0x178]
mov r11, rax
lea rax, [rbp - 0x17c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0042c0a5
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0x178]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x49fb9e
leave
ret
Function at 0x4a2986
Capabilities:
Set socket configuration

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x210
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, dword [rbp + 0x18]
mov dword [rbp - 0xc], eax
mov eax, 4
mov r8, rax
lea rax, [rbp - 0xc]
mov r11, rax
lea rax, [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 4
mov r8, rax
lea rax, [rbp - 8]
mov r11, rax
lea rax, [rbp - 4]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 1
mov r9, rax
mov eax, 4
mov r8, rax
lea rax, [rbp - 4]
mov r11, rax
lea rax, [rbp - 0x70]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004a2f87
mov eax, 0x30
mov r8, rax
lea rax, [rbp - 0x70]
mov r11, rax
lea rax, [rbp - 0x40]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
movzx eax, byte [rbp - 0x40]
cmp eax, 0
je 0x4a2a8a
movabs rax, 0x28
mov r8, rax
lea rax, [rbp - 0x40]
mov r11, rax
lea rax, [rbp - 0xa0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0xa0]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4a2c51
mov eax, 1
mov r8, rax
lea rax, [rbp - 4]
mov r11, rax
lea rax, [rbp - 0x100]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004a2e1c
mov eax, 0x30
mov r8, rax
lea rax, [rbp - 0x100]
mov r11, rax
lea rax, [rbp - 0xd0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
movzx eax, byte [rbp - 0xd0]
cmp eax, 0
je 0x4a2b0c
mov eax, 0x20
mov r8, rax
lea rax, [rbp - 0xc8]
mov r11, rax
lea rax, [rbp - 0x120]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 1
mov dword [rbp - 0x124], eax
mov eax, dword [rbp + 0x18]
movsxd rax, eax
lea rcx, [rbp - 0x124]
mov r8, rcx
mov ecx, dword [0x00512794]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.ws2_32.dll_ioctlsocket
mov r11, rax
lea rax, [rbp - 0x188]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0049bfab
mov eax, 0x30
mov r8, rax
lea rax, [rbp - 0x188]
mov r11, rax
lea rax, [rbp - 0x158]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
movzx eax, byte [rbp - 0x158]
cmp eax, 0
je 0x4a2be2
movabs rax, 0x28
mov r8, rax
lea rax, [rbp - 0x158]
mov r11, rax
lea rax, [rbp - 0x1b8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0x1b8]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4a2c51
mov eax, 4
mov r8, rax
lea rax, [rbp - 4]
mov r11, rax
lea rax, [rbp - 0x1ec]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 4
mov r8, rax
lea rax, [rbp - 0x1e8]
mov r11, rax
lea rax, [rbp - 0x1ec]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0042c0a5
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0x1e8]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
leave
ret
Function at 0x4a2e1c
Capabilities:
Set socket configuration

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x100
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
movzx eax, byte [rbp + 0x20]
cmp eax, 0
jne 0x4a2e45
jmp 0x4a2e4a
jmp 0x4a2e51
mov eax, 1
jmp 0x4a2e56
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp + 0x18]
mov ecx, dword [rax]
movsxd rcx, ecx
mov eax, 4
mov qword [rsp + 0x20], rax
lea rax, [rbp - 4]
mov r9, rax
mov eax, 0x1b
mov r8, rax
mov eax, 0x29
mov r11, rax
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.ws2_32.dll_setsockopt
mov r11, rax
lea rax, [rbp - 0x68]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0049bfab
mov eax, 0x30
mov r8, rax
lea rax, [rbp - 0x68]
mov r11, rax
lea rax, [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
movzx eax, byte [rbp - 0x38]
cmp eax, 0
je 0x4a2f2c
movabs rax, 0x28
mov r8, rax
lea rax, [rbp - 0x38]
mov r11, rax
lea rax, [rbp - 0x98]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0x98]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4a2f85
mov eax, 0
mov byte [rbp - 0xc8], al
movabs rax, 0x2f
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0xc7]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0xc8]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
leave
ret

Function at 0x4a2f87
Capabilities:
Set socket configuration

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xf0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rax, qword [rbp + 0x18]
mov ecx, dword [rax]
movsxd rcx, ecx
mov eax, 4
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x28]
mov r9, rax
mov eax, dword [rbp + 0x20]
mov r8, rax
mov eax, 0xffff
mov r11, rax
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.ws2_32.dll_setsockopt
mov r11, rax
lea rax, [rbp - 0x60]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0049bfab
mov eax, 0x30
mov r8, rax
lea rax, [rbp - 0x60]
mov r11, rax
lea rax, [rbp - 0x30]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
movzx eax, byte [rbp - 0x30]
cmp eax, 0
je 0x4a306d
movabs rax, 0x28
mov r8, rax
lea rax, [rbp - 0x30]
mov r11, rax
lea rax, [rbp - 0x90]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0x90]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4a30c6
mov eax, 0
mov byte [rbp - 0xc0], al
movabs rax, 0x2f
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0xbf]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0xc0]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
leave
ret
Function at 0x4a402b
Capabilities:
Set socket configuration

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xf0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x18]
add rax, 0x78
movzx ecx, byte [rbp + 0x20]
mov byte [rax], cl
mov eax, 0
mov dword [rbp - 4], eax
mov rax, qword [rbp + 0x18]
add rax, 0x78
movzx ecx, byte [rax]
cmp ecx, 0
jne 0x4a4074
mov eax, 1
mov dword [rbp - 4], eax
mov rax, qword [rbp + 0x18]
mov ecx, dword [rax]
movsxd rcx, ecx
lea rax, [rbp - 4]
mov r8, rax
mov eax, dword [0x00512794]
mov r11, rax
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.ws2_32.dll_ioctlsocket
mov r11, rax
lea rax, [rbp - 0x68]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0049bfab
mov eax, 0x30
mov r8, rax
lea rax, [rbp - 0x68]
mov r11, rax
lea rax, [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
movzx eax, byte [rbp - 0x38]
cmp eax, 0
je 0x4a4130
movabs rax, 0x28
mov r8, rax
lea rax, [rbp - 0x38]
mov r11, rax
lea rax, [rbp - 0x98]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0x98]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4a4189
mov eax, 0
mov byte [rbp - 0xc8], al
movabs rax, 0x2f
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0xc7]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0xc8]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
leave
ret
Function at 0x4a4036
Capabilities:
Set socket configuration

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xf0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x18]
add rax, 0x78
movzx ecx, byte [rbp + 0x20]
mov byte [rax], cl
mov eax, 0
mov dword [rbp - 4], eax
mov rax, qword [rbp + 0x18]
add rax, 0x78
movzx ecx, byte [rax]
cmp ecx, 0
jne 0x4a4074
mov eax, 1
mov dword [rbp - 4], eax
mov rax, qword [rbp + 0x18]
mov ecx, dword [rax]
movsxd rcx, ecx
lea rax, [rbp - 4]
mov r8, rax
mov eax, dword [0x00512794]
mov r11, rax
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.ws2_32.dll_ioctlsocket
mov r11, rax
lea rax, [rbp - 0x68]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0049bfab
mov eax, 0x30
mov r8, rax
lea rax, [rbp - 0x68]
mov r11, rax
lea rax, [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
movzx eax, byte [rbp - 0x38]
cmp eax, 0
je 0x4a4130
movabs rax, 0x28
mov r8, rax
lea rax, [rbp - 0x38]
mov r11, rax
lea rax, [rbp - 0x98]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0x98]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4a4189
mov eax, 0
mov byte [rbp - 0xc8], al
movabs rax, 0x2f
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0xc7]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0xc8]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
leave
ret
Function at 0x4a7520
Capabilities:
Set socket configuration

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x100
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
movzx eax, byte [rbp + 0x28]
cmp eax, 0
je 0x4a754d
jmp 0x4a7552
jmp 0x4a7559
mov eax, 1
jmp 0x4a755e
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp + 0x18]
mov ecx, dword [rax]
movsxd rcx, ecx
mov eax, 4
mov qword [rsp + 0x20], rax
lea rax, [rbp - 4]
mov r9, rax
mov eax, dword [rbp + 0x20]
mov r8, rax
mov eax, 0xffff
mov r11, rax
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.ws2_32.dll_setsockopt
mov r11, rax
lea rax, [rbp - 0x68]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0049bfab
mov eax, 0x30
mov r8, rax
lea rax, [rbp - 0x68]
mov r11, rax
lea rax, [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
movzx eax, byte [rbp - 0x38]
cmp eax, 0
je 0x4a7632
movabs rax, 0x28
mov r8, rax
lea rax, [rbp - 0x38]
mov r11, rax
lea rax, [rbp - 0x98]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0x98]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4a768b
mov eax, 0
mov byte [rbp - 0xc8], al
movabs rax, 0x2f
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0xc7]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0xc8]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
leave
ret
Function at 0x4a768d
Capabilities:
Set socket configuration

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x100
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
movzx eax, byte [rbp + 0x20]
cmp eax, 0
jne 0x4a76b6
jmp 0x4a76bb
jmp 0x4a76c2
mov eax, 1
jmp 0x4a76c7
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp + 0x18]
mov ecx, dword [rax]
movsxd rcx, ecx
mov eax, 4
mov qword [rsp + 0x20], rax
lea rax, [rbp - 4]
mov r9, rax
mov eax, 0x1b
mov r8, rax
mov eax, 0x29
mov r11, rax
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.ws2_32.dll_setsockopt
mov r11, rax
lea rax, [rbp - 0x68]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0049bfab
mov eax, 0x30
mov r8, rax
lea rax, [rbp - 0x68]
mov r11, rax
lea rax, [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
movzx eax, byte [rbp - 0x38]
cmp eax, 0
je 0x4a779d
movabs rax, 0x28
mov r8, rax
lea rax, [rbp - 0x38]
mov r11, rax
lea rax, [rbp - 0x98]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0x98]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4a77f6
mov eax, 0
mov byte [rbp - 0xc8], al
movabs rax, 0x2f
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0xc7]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x30
mov r8, rcx
lea rcx, [rbp - 0xc8]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
leave
ret
Function at 0x4ee524
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [0x005105b8]
cmp eax, 0
jne 0x4ee562
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x4ee56c
mov eax, 0
jmp 0x4ee7fe
mov rax, qword [0x00510040]
cmp rax, 0
je 0x4ee592
mov eax, 0
mov r10, rax
mov rcx, r10
mov r11, qword [0x00510040]
call r11
mov eax, dword [0x0050ffbc]
cmp eax, 0
je 0x4ee617
call fcn.004f8ad7
cmp eax, 0
je 0x4ee617
mov eax, dword [0x005105c4]
cmp eax, 0
jne 0x4ee5c3
jmp 0x4ee5d5
lea rax, str.GC_try_to_collect_inner:_finishing_collection_in_progress_n
mov r10, rax
mov rcx, r10
call fcn.0050136a
call fcn.004f8ad7
cmp eax, 0
je 0x4ee617
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x4ee605
mov eax, 0
jmp 0x4ee7fe
mov eax, 1
mov r10, rax
mov rcx, r10
call fcn.004ee85a
jmp 0x4ee5d5
call fcn.004ee2ab
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [0x005105c4]
mov ecx, dword [0x0050ffb8]
or eax, ecx
cmp eax, 0
je 0x4ee66c
mov eax, dword [0x005105c4]
cmp eax, 0
je 0x4ee65c
lea rax, str.Initiating_full_world_stop_collection__n
mov r10, rax
mov rcx, r10
call fcn.0050136a
mov eax, 1
mov dword [rbp - 8], eax
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 4], eax
call fcn.004e914e
mov eax, dword [0x005105d0]
cmp eax, 0
jne 0x4ee694
mov rax, qword [rbp + 0x10]
lea rcx, [0x004edcc6]
cmp rax, rcx
je 0x4ee6c1
mov eax, 0
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004fd965
cmp eax, 0
jne 0x4ee6c1
mov eax, 0
jmp 0x4ee7fe
call fcn.004f94df
call fcn.004f8fa5
mov eax, 1
mov dword [0x00510038], eax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
call fcn.004eea5d
cmp eax, 0
jne 0x4ee711
mov eax, dword [0x0050ffbc]
cmp eax, 0
jne 0x4ee707
call fcn.004f94df
call fcn.004e9288
mov eax, 0
jmp 0x4ee7fe
call fcn.004ef234
mov eax, dword [rbp - 8]
cmp eax, 0
je 0x4ee7d3
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
mov ecx, dword [rbp - 4]
sub eax, ecx
mov dword [rbp - 0x18], eax
mov eax, 0
mov dword [rbp - 0x1c], eax
mov eax, dword [0x0050ffb8]
cmp eax, 0
je 0x4ee7a3
mov eax, dword [0x0050ffb0]
mov ecx, dword [rbp - 0x18]
add eax, ecx
mov dword [0x0050ffb0], eax
mov eax, dword [0x0050ffb4]
mov ecx, dword [rbp - 0x1c]
add eax, ecx
mov dword [0x0050ffb4], eax
mov eax, dword [0x0050ffb4]
cmp eax, 0xf4240
jb 0x4ee7a3
mov eax, dword [0x0050ffb4]
sub eax, 0xf4240
mov dword [0x0050ffb4], eax
mov eax, dword [0x0050ffb0]
mov ecx, eax
add eax, 1
mov dword [0x0050ffb0], eax
mov eax, dword [0x005105c4]
cmp eax, 0
je 0x4ee7d3
mov eax, dword [rbp - 0x1c]
mov r8, rax
mov eax, dword [rbp - 0x18]
mov r11, rax
lea rax, str.Complete_collection_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0050136a
mov rax, qword [0x00510040]
cmp rax, 0
je 0x4ee7f9
mov eax, 5
mov r10, rax
mov rcx, r10
mov r11, qword [0x00510040]
call r11
mov eax, 1
leave
ret
Function at 0x4ee52f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [0x005105b8]
cmp eax, 0
jne 0x4ee562
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x4ee56c
mov eax, 0
jmp 0x4ee7fe
mov rax, qword [0x00510040]
cmp rax, 0
je 0x4ee592
mov eax, 0
mov r10, rax
mov rcx, r10
mov r11, qword [0x00510040]
call r11
mov eax, dword [0x0050ffbc]
cmp eax, 0
je 0x4ee617
call fcn.004f8ad7
cmp eax, 0
je 0x4ee617
mov eax, dword [0x005105c4]
cmp eax, 0
jne 0x4ee5c3
jmp 0x4ee5d5
lea rax, str.GC_try_to_collect_inner:_finishing_collection_in_progress_n
mov r10, rax
mov rcx, r10
call fcn.0050136a
call fcn.004f8ad7
cmp eax, 0
je 0x4ee617
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x4ee605
mov eax, 0
jmp 0x4ee7fe
mov eax, 1
mov r10, rax
mov rcx, r10
call fcn.004ee85a
jmp 0x4ee5d5
call fcn.004ee2ab
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [0x005105c4]
mov ecx, dword [0x0050ffb8]
or eax, ecx
cmp eax, 0
je 0x4ee66c
mov eax, dword [0x005105c4]
cmp eax, 0
je 0x4ee65c
lea rax, str.Initiating_full_world_stop_collection__n
mov r10, rax
mov rcx, r10
call fcn.0050136a
mov eax, 1
mov dword [rbp - 8], eax
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 4], eax
call fcn.004e914e
mov eax, dword [0x005105d0]
cmp eax, 0
jne 0x4ee694
mov rax, qword [rbp + 0x10]
lea rcx, [0x004edcc6]
cmp rax, rcx
je 0x4ee6c1
mov eax, 0
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004fd965
cmp eax, 0
jne 0x4ee6c1
mov eax, 0
jmp 0x4ee7fe
call fcn.004f94df
call fcn.004f8fa5
mov eax, 1
mov dword [0x00510038], eax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
call fcn.004eea5d
cmp eax, 0
jne 0x4ee711
mov eax, dword [0x0050ffbc]
cmp eax, 0
jne 0x4ee707
call fcn.004f94df
call fcn.004e9288
mov eax, 0
jmp 0x4ee7fe
call fcn.004ef234
mov eax, dword [rbp - 8]
cmp eax, 0
je 0x4ee7d3
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
mov ecx, dword [rbp - 4]
sub eax, ecx
mov dword [rbp - 0x18], eax
mov eax, 0
mov dword [rbp - 0x1c], eax
mov eax, dword [0x0050ffb8]
cmp eax, 0
je 0x4ee7a3
mov eax, dword [0x0050ffb0]
mov ecx, dword [rbp - 0x18]
add eax, ecx
mov dword [0x0050ffb0], eax
mov eax, dword [0x0050ffb4]
mov ecx, dword [rbp - 0x1c]
add eax, ecx
mov dword [0x0050ffb4], eax
mov eax, dword [0x0050ffb4]
cmp eax, 0xf4240
jb 0x4ee7a3
mov eax, dword [0x0050ffb4]
sub eax, 0xf4240
mov dword [0x0050ffb4], eax
mov eax, dword [0x0050ffb0]
mov ecx, eax
add eax, 1
mov dword [0x0050ffb0], eax
mov eax, dword [0x005105c4]
cmp eax, 0
je 0x4ee7d3
mov eax, dword [rbp - 0x1c]
mov r8, rax
mov eax, dword [rbp - 0x18]
mov r11, rax
lea rax, str.Complete_collection_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0050136a
mov rax, qword [0x00510040]
cmp rax, 0
je 0x4ee7f9
mov eax, 5
mov r10, rax
mov rcx, r10
mov r11, qword [0x00510040]
call r11
mov eax, 1
leave
ret