joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b110
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
cmp dword [esi + 0x14], 0xf
mov ecx, dword [esi + 0x10]
jbe 0x46b127
add ecx, dword [esi]
mov esi, dword [esi]
jmp 0x46b129
add ecx, esi
sub ecx, esi
xor ebp, ebp
mov edi, 0x734297e9
mov ebx, ecx
xor ebx, edi
xor ebp, 0x8c858963
mov edx, 0xe35e67b1
cmp ecx, 4
jb 0x46b172
mov eax, ecx
shr eax, 2
mov dword [esp + 0x14], eax
nop
mov eax, dword [esi]
sub edi, 0x61c88647
add eax, edi
add esi, 4
mul edx
sub ecx, 4
xor ebp, edx
xor ebx, eax
sub dword [esp + 0x14], 1
mov edx, 0xe35e67b1
jne 0x46b150
xor edx, edx
cmp ecx, 1
jb 0x46b1a6
lea edx, [ecx - 1]
shr ecx, 1
and edx, 2
movzx eax, byte [ecx + esi]
shl ecx, 3
shl eax, cl
lea ecx, [edx*8]
mov dword [esp + 0x14], eax
movzx eax, byte [edx + esi]
mov edx, dword [esp + 0x14]
shl eax, cl
or edx, eax
movzx eax, byte [esi]
or edx, eax
lea eax, [edx - 0x61c88647]
mov ecx, 0xe35e67b1
add eax, edi
mul ecx
lea ecx, [edi + 0x3c6ef372]
xor ebp, edx
xor ebx, eax
add ecx, ebx
lea eax, [ebp + 0x1fcd5b23]
add eax, edi
mul ecx
pop edi
pop esi
xor edx, ebp
xor eax, ebx
pop ebp
xor eax, edx
pop ebx
ret 4
Function at 0x46b670
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x46b6bf
lea edx, [esi + 8]
mov edi, eax
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x46b682
mov eax, dword [esi]
jmp 0x46b7a8
cmp eax, 0x4e0
jb 0x46b7a8
push ebx
mov ebx, dword [esi + 0x9c4]
lea edi, [esi + 0x9c4]
push ebp
mov ebp, 0xe3
nop dword [eax]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x46b6e0
mov ebx, dword [esi + 0xd50]
lea edi, [esi + 0xd50]
mov ebp, 0x18c
nop dword [eax]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x46b730
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
pop ebx
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret
Function at 0x470ca0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x138c
call fcn.006df660
mov eax, dword [0x7f9c40]
xor eax, esp
mov dword [esp + 0x1388], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebx, 0x4e21
mov ebp, 0x7530
call fcn.006de259
mov dword [esp + 0x1394], 0xffffffff
mov ecx, 1
mov dword [esp + 0x14], eax
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
mov dword [esp + ecx*4 + 0x14], eax
inc ecx
cmp ecx, 0x270
jb 0x470ce1
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x270
call fcn.0046b670
mul ebx
cmp eax, 0x4e21
jae 0x470d32
cmp eax, 0x310f
jae 0x470d32
nop
lea ecx, [esp + 0x10]
call fcn.0046b670
mul ebx
cmp eax, 0x310f
jb 0x470d20
add dx, bp
mov ecx, edi
movzx esi, dx
push esi
push str.127.0.0.1
call fcn.00471950
test al, al
je 0x470cc8
mov ecx, dword [esp + 0x1398]
mov ax, si
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.006def69
add esp, 0x138c
ret
Function at 0x478480
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
cmp esi, 0xffffffff
je 0x47867f
cmp byte [esp + 0x1c], 0
push ebp
mov ebp, dword [esp + 0x1c]
je 0x4784dd
mov al, byte [ebp]
test al, 8
je 0x4784dd
or al, 8
xor ecx, ecx
push 4
mov byte [ebp], al
lea eax, [esp + 0x1c]
push eax
push 0x80
push 0xffff
push esi
mov dword [esp + 0x2c], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
setne al
movzx eax, al
push eax
lea eax, [esp + 0xc]
push eax
call fcn.0047ba10
add esp, 8
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x478500
mov ecx, dword [esp + 0x24]
xorps xmm0, xmm0
pop ebp
pop esi
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
add esp, 0xc
ret
push ebx
push edi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x7f5028
push eax
lea ecx, [esp + 0x18]
call fcn.0044c740
mov ecx, dword [esp + 0x2c]
movq xmm0, qword [eax]
movq qword [ecx], xmm0
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
mov ebx, dword [0x7f5030]
mov edi, dword [0x7f5034]
cmp ebx, 0x257edfd1
jne 0x478545
cmp edi, 0xb2ab117a
je 0x478555
cmp ebx, 0x257edfd0
jne 0x478559
cmp edi, 0xb2ab117a
jne 0x478559
mov al, 1
jmp 0x47857d
mov eax, dword [0x7f5028]
mov ecx, 0x7f5028
push 0x2733
mov eax, dword [eax + 0x18]
call eax
mov edi, dword [0x7f5034]
mov ebx, dword [0x7f5030]
mov ecx, dword [esp + 0x2c]
movzx eax, al
add eax, 2
mov dword [esp + 0x10], 0x2733
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x7f5028
movq xmm0, qword [esp + 0x10]
push eax
push ecx
movq qword [esp + 0x18], xmm0
call fcn.0046a970
add esp, 8
test al, al
jne 0x478639
cmp ebx, 0x257edfd1
jne 0x4785c9
cmp edi, 0xb2ab117a
je 0x4785d9
cmp ebx, 0x257edfd0
jne 0x4785dd
cmp edi, 0xb2ab117a
jne 0x4785dd
mov al, 1
jmp 0x4785f1
mov eax, dword [0x7f5028]
mov ecx, 0x7f5028
push 0x4d5
mov eax, dword [eax + 0x18]
call eax
mov edi, dword [esp + 0x2c]
movzx eax, al
add eax, 2
mov dword [esp + 0x10], 0x4d5
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x7f5028
movq xmm0, qword [esp + 0x10]
push eax
push edi
movq qword [esp + 0x18], xmm0
call fcn.0046a970
add esp, 8
test al, al
jne 0x47863d
mov eax, dword [esp + 0x20]
pop edi
pop ebx
pop ebp
pop esi
add esp, 0xc
ret
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [ebp], 0xfc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
test esi, esi
setne cl
movzx ecx, cl
push ecx
push edi
call fcn.0047ba10
add esp, 8
mov eax, esi
pop edi
pop ebx
pop ebp
pop esi
add esp, 0xc
ret
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x4787e0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x18]
cmp dword [esi + 8], 1
je 0x4787f2
mov eax, dword [esi]
jmp 0x478806
mov eax, dword [esi + 4]
xor edx, edx
mov ecx, 0x1ffff7
div ecx
imul eax, edx, 0x3e8
add eax, dword [esi]
cmp eax, 0x4cf
jg 0x47892c
je 0x4788d9
cmp eax, 0x79
je 0x478880
cmp eax, 0x4c9
jne 0x478997
mov ecx, dword [0x7f5030]
mov eax, dword [0x7f5034]
cmp ecx, 0x257edfd1
jne 0x478841
cmp eax, 0xb2ab117a
je 0x478850
cmp ecx, 0x257edfd0
jne 0x47885f
cmp eax, 0xb2ab117a
jne 0x47885f
mov al, 1
mov dword [esp + 4], 0x274d
jmp 0x47897c
mov eax, dword [0x7f5028]
mov ecx, 0x7f5028
push 0x274d
mov eax, dword [eax + 0x18]
call eax
mov dword [esp + 4], 0x274d
jmp 0x47897c
mov ecx, dword [0x7f5030]
mov eax, dword [0x7f5034]
cmp ecx, 0x257edfd1
jne 0x47889a
cmp eax, 0xb2ab117a
je 0x4788a9
cmp ecx, 0x257edfd0
jne 0x4788b8
cmp eax, 0xb2ab117a
jne 0x4788b8
mov al, 1
mov dword [esp + 4], 0x274c
jmp 0x47897c
mov eax, dword [0x7f5028]
mov ecx, 0x7f5028
push 0x274c
mov eax, dword [eax + 0x18]
call eax
mov dword [esp + 4], 0x274c
jmp 0x47897c
mov ecx, dword [0x7f5030]
mov eax, dword [0x7f5034]
cmp ecx, 0x257edfd1
jne 0x4788f3
cmp eax, 0xb2ab117a
je 0x478902
cmp ecx, 0x257edfd0
jne 0x47890e
cmp eax, 0xb2ab117a
jne 0x47890e
mov al, 1
mov dword [esp + 4], 0x2743
jmp 0x47897c
mov eax, dword [0x7f5028]
mov ecx, 0x7f5028
push 0x2743
mov eax, dword [eax + 0x18]
call eax
mov dword [esp + 4], 0x2743
jmp 0x47897c
cmp eax, 0x4d0
jne 0x478997
mov ecx, dword [0x7f5030]
mov eax, dword [0x7f5034]
cmp ecx, 0x257edfd1
jne 0x47894d
cmp eax, 0xb2ab117a
je 0x47895c
cmp ecx, 0x257edfd0
jne 0x478960
cmp eax, 0xb2ab117a
jne 0x478960
mov al, 1
jmp 0x478974
mov eax, dword [0x7f5028]
mov ecx, 0x7f5028
push 0x2751
mov eax, dword [eax + 0x18]
call eax
mov dword [esp + 4], 0x2751
mov dword [esp + 8], 0x7f5028
movq xmm0, qword [esp + 4]
movzx eax, al
add eax, 2
movq qword [esi], xmm0
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
test al, 1
je 0x4789b0
cmp eax, 1
jne 0x478a49
cmp dword [esi], 0
jne 0x478a49
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
jne 0x478a22
mov ecx, dword [0x7f5030]
mov eax, dword [0x7f5034]
cmp ecx, 0x257edfd1
jne 0x4789d3
cmp eax, 0xb2ab117a
je 0x4789e2
cmp ecx, 0x257edfd0
jne 0x4789e6
cmp eax, 0xb2ab117a
jne 0x4789e6
mov al, 1
jmp 0x4789fa
mov eax, dword [0x7f5028]
mov ecx, 0x7f5028
push 0x2719
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
mov dword [esp + 4], 0x2719
add eax, 2
mov dword [esp + 8], 0x7f5028
movq xmm0, qword [esp + 4]
movq qword [esi], xmm0
mov dword [esi + 8], eax
pop esi
add esp, 0xc
ret
push 0
push 0
push 0x7010
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
setne al
movzx eax, al
push eax
push esi
call fcn.0047ba10
add esp, 8
pop esi
add esp, 0xc
ret
Function at 0x478a50
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x478ac9
mov ecx, dword [0x7f5030]
mov eax, dword [0x7f5034]
cmp ecx, 0x257edfd1
jne 0x478a76
cmp eax, 0xb2ab117a
je 0x478a85
cmp ecx, 0x257edfd0
jne 0x478a89
cmp eax, 0xb2ab117a
jne 0x478a89
mov al, 1
jmp 0x478a9d
mov eax, dword [0x7f5028]
mov ecx, 0x7f5028
push 0x2719
mov eax, dword [eax + 0x18]
call eax
movzx ecx, al
mov eax, dword [esp + 0x1c]
add ecx, 2
mov dword [esp], 0x2719
mov dword [esp + 4], 0x7f5028
movq xmm0, qword [esp]
movq qword [eax], xmm0
mov dword [eax + 8], ecx
or eax, 0xffffffff
add esp, 0xc
ret
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov esi, eax
test esi, esi
jne 0x478af2
mov ecx, dword [esp + 0x20]
xorps xmm0, xmm0
pop esi
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
add esp, 0xc
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x7f5028
push eax
lea ecx, [esp + 0xc]
call fcn.0044c740
mov ecx, dword [esp + 0x20]
movq xmm0, qword [eax]
movq qword [ecx], xmm0
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x47c2b0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x28
push ebx
push edi
push 0
push 0
lea eax, [esp + 0x13]
mov byte [esp + 0x13], 0
push 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 1
push eax
push dword [ecx + 4]
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_WSASend]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x7f5028
push eax
lea ecx, [esp + 0x2c]
call fcn.0044c740
mov ebx, 0x1ffff7
movq xmm0, qword [eax]
mov edi, dword [eax + 8]
movq qword [esp + 0x18], xmm0
mov ecx, dword [esp + 0x18]
cmp edi, 1
je 0x47c321
mov eax, ecx
jmp 0x47c331
mov eax, dword [esp + 0x1c]
xor edx, edx
div ebx
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x40
jne 0x47c377
mov ecx, dword [0x7f5030]
mov eax, dword [0x7f5034]
cmp ecx, 0x257edfd1
jne 0x47c350
cmp eax, 0xb2ab117a
je 0x47c3cf
cmp ecx, 0x257edfd0
jne 0x47c35f
cmp eax, 0xb2ab117a
je 0x47c3cf
mov eax, dword [0x7f5028]
mov ecx, 0x7f5028
push 0x2746
call dword [eax + 0x18]
pop edi
pop ebx
add esp, 0x28
ret
cmp edi, 1
jne 0x47c38c
mov eax, dword [esp + 0x1c]
xor edx, edx
div ebx
imul eax, edx, 0x3e8
add ecx, eax
cmp ecx, 0x4d2
jne 0x47c3cf
mov ecx, dword [0x7f5030]
mov eax, dword [0x7f5034]
cmp ecx, 0x257edfd1
jne 0x47c3ae
cmp eax, 0xb2ab117a
je 0x47c3cf
cmp ecx, 0x257edfd0
jne 0x47c3bd
cmp eax, 0xb2ab117a
je 0x47c3cf
mov eax, dword [0x7f5028]
mov ecx, 0x7f5028
push 0x274d
call dword [eax + 0x18]
pop edi
pop ebx
add esp, 0x28
ret
Function at 0x47c3e0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x47c459
mov ecx, dword [0x7f5030]
mov eax, dword [0x7f5034]
cmp ecx, 0x257edfd1
jne 0x47c406
cmp eax, 0xb2ab117a
je 0x47c415
cmp ecx, 0x257edfd0
jne 0x47c419
cmp eax, 0xb2ab117a
jne 0x47c419
mov al, 1
jmp 0x47c42d
mov eax, dword [0x7f5028]
mov ecx, 0x7f5028
push 0x2719
mov eax, dword [eax + 0x18]
call eax
movzx ecx, al
mov eax, dword [esp + 0x20]
add ecx, 2
mov dword [esp], 0x2719
mov dword [esp + 4], 0x7f5028
movq xmm0, qword [esp]
movq qword [eax], xmm0
mov dword [eax + 8], ecx
or eax, 0xffffffff
add esp, 0xc
ret
push esi
mov esi, dword [esp + 0x20]
push edi
push esi
push dword [esp + 0x24]
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edi, eax
test edi, edi
js 0x47c4b0
cmp dword [esp + 0x20], 0x8004667e
xorps xmm0, xmm0
mov ecx, dword [esp + 0x28]
movq qword [ecx], xmm0
mov dword [ecx + 8], 0
jne 0x47c4d7
cmp dword [esi], 0
mov ecx, dword [esp + 0x1c]
mov al, byte [ecx]
je 0x47c4a4
or al, 1
mov byte [ecx], al
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret
and al, 0xfc
mov byte [ecx], al
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x7f5028
push eax
lea ecx, [esp + 0x10]
call fcn.0044c740
mov ecx, dword [esp + 0x28]
movq xmm0, qword [eax]
movq qword [ecx], xmm0
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret

Function at 0x47c5b0
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0
mov eax, dword [esi + 8]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, 0x7fdfc4
lock xadd dword [ecx], eax
mov ecx, dword [esi + 4]
test eax, eax
push 0
setne al
push ecx
test al, al
je 0x47c603
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
add esp, 8
ret
push sym.ClientofCSP.exe_public_virtual:_void___thiscall_DuiLib::CTreeViewUI::Notify_struct_DuiLib::tagTNotifyUI__
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
add esp, 8
ret
Function at 0x480480
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x2c]
push 0
push 0
push dword [esp + 0x30]
mov dword [esp + 0x38], 0
push eax
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
call dword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x7f5028
push eax
lea ecx, [esp + 0x14]
call fcn.0044c740
mov ebp, 0x1ffff7
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
cmp eax, 1
je 0x4804e6
mov eax, dword [esi]
mov ecx, eax
jmp 0x4804f7
mov eax, dword [esi + 4]
xor edx, edx
div ebp
mov ecx, dword [esi]
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x40
jne 0x480552
mov ecx, dword [0x7f5030]
mov eax, dword [0x7f5034]
cmp ecx, 0x257edfd1
jne 0x480516
cmp eax, 0xb2ab117a
je 0x480525
cmp ecx, 0x257edfd0
jne 0x480534
cmp eax, 0xb2ab117a
jne 0x480534
mov al, 1
mov dword [esp + 0xc], 0x2746
jmp 0x4805b8
mov eax, dword [0x7f5028]
mov ecx, 0x7f5028
push 0x2746
mov eax, dword [eax + 0x18]
call eax
mov dword [esp + 0xc], 0x2746
jmp 0x4805b8
cmp dword [esi + 8], 1
jne 0x480567
mov eax, dword [esi + 4]
xor edx, edx
div ebp
imul eax, edx, 0x3e8
add ecx, eax
cmp ecx, 0x4d2
jne 0x4805d3
mov ecx, dword [0x7f5030]
mov eax, dword [0x7f5034]
cmp ecx, 0x257edfd1
jne 0x480589
cmp eax, 0xb2ab117a
je 0x480598
cmp ecx, 0x257edfd0
jne 0x48059c
cmp eax, 0xb2ab117a
jne 0x48059c
mov al, 1
jmp 0x4805b0
mov eax, dword [0x7f5028]
mov ecx, 0x7f5028
push 0x274d
mov eax, dword [eax + 0x18]
call eax
mov dword [esp + 0xc], 0x274d
mov dword [esp + 0x10], 0x7f5028
movq xmm0, qword [esp + 0xc]
movzx eax, al
add eax, 2
movq qword [esi], xmm0
mov dword [esi + 8], eax
test ebx, ebx
je 0x4805e1
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x2c]
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi + 8], 0
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x480bd0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
push 1
push 0
push 0
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov esi, eax
cmp esi, 0xffffffff
je 0x480c2d
cmp dword [esp + 0x18], 0x17
xorps xmm0, xmm0
mov ecx, dword [esp + 0x24]
movq qword [ecx], xmm0
mov dword [ecx + 8], 0
jne 0x480c26
push 4
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, esi
pop esi
add esp, 0x10
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x7f5028
push eax
lea ecx, [esp + 0x10]
call fcn.0044c740
mov ecx, dword [esp + 0x24]
pop esi
movq xmm0, qword [eax]
movq qword [ecx], xmm0
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
or eax, 0xffffffff
add esp, 0x10
ret
Function at 0x483060
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7123f5
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x7f9c40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 8]
test al, 1
je 0x4830ef
cmp eax, 1
jne 0x48309e
cmp dword [esi], 0
je 0x4830ef
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.004848a0
movq xmm0, qword [esi]
mov eax, dword [esi + 8]
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x24], eax
push 0
lea eax, [ebp - 0x64]
mov dword [ebp - 4], 0
push eax
mov eax, dword [edi]
add eax, 0x44
push eax
call fcn.00484240
add esp, 0xc
lea ecx, [ebp - 0x64]
call fcn.00485500
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], edi
mov ecx, dword [eax]
lea ebx, [eax + 4]
mov dword [ebp - 0x10], ecx
lea ecx, [eax + 0x44]
mov eax, dword fs:[0x2c]
mov dword [ebp + 0x10], ecx
mov ecx, dword [0x800e58]
mov esi, dword [eax + ecx*4]
cmp byte [esi + 0xc], 0
jne 0x483122
call fcn.006dfa14
mov eax, dword [esi + 4]
test eax, eax
je 0x483131
mov eax, dword [eax + 4]
jmp 0x483133
xor eax, eax
push 8
push 0x98
push eax
push dword [ebp + 8]
call fcn.004603b0
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x18], esi
mov ecx, dword [ebx]
xorps xmm0, xmm0
mov dword [esi + 0x38], ecx
lea ecx, [esi + 0x40]
movq qword [esi + 0x20], xmm0
push edi
mov dword [ebp - 4], 1
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x489e00
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0x47afc0
mov byte [esi + 0x3c], 0
call fcn.004848a0
push dword [ebp + 0x10]
lea ecx, [esi + 0x78]
push 0
push 0
call fcn.00464140
mov eax, dword [ebp + 0xc]
mov edx, 0x1c
push esi
push esi
mov ecx, 0x10
mov dword [ebp - 0x14], esi
cmp word [eax], 2
cmovne ecx, edx
push ecx
mov ecx, dword [ebp - 0x10]
push eax
push 1
push dword [ebx + 0x1c]
add ecx, 0x14
push ebx
call fcn.00480cd0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 2
call fcn.0048aab0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x489180
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x712bed
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x7f9c40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov word [ebx + 0x57a1], 0
mov byte [ebx + 0x57a0], 0
cmp byte [ebx + 0x100], 0
mov ecx, dword [ebx + 0xf0]
je 0x4891e5
push 0xffffffffffffffff
lea eax, [ebx + 0x104]
push eax
lea eax, [ecx + 0x14]
mov ecx, dword [ecx + 0x34]
push eax
call fcn.00460ad0
mov byte [ebx + 0x100], 0
cmp byte [ebx + 0x148], 0
xorps xmm0, xmm0
mov ecx, dword [ebx + 0x138]
movq qword [ebp - 0x20], xmm0
je 0x48921b
push 0xffffffffffffffff
lea eax, [ebx + 0x14c]
push eax
lea eax, [ecx + 0x14]
mov ecx, dword [ecx + 0x34]
push eax
call fcn.00460ad0
mov byte [ebx + 0x148], 0
xorps xmm0, xmm0
cmp byte [ebx + 0x190], 0
mov ecx, dword [ebx + 0x180]
movq qword [ebp - 0x20], xmm0
je 0x48924e
push 0xffffffffffffffff
lea eax, [ebx + 0x194]
push eax
lea eax, [ecx + 0x14]
mov ecx, dword [ecx + 0x34]
push eax
call fcn.00460ad0
mov byte [ebx + 0x190], 0
xorps xmm0, xmm0
cmp byte [ebx + 0x1d8], 0
mov ecx, dword [ebx + 0x1c8]
movq qword [ebp - 0x20], xmm0
je 0x489281
push 0xffffffffffffffff
lea eax, [ebx + 0x1dc]
push eax
lea eax, [ecx + 0x14]
mov ecx, dword [ecx + 0x34]
push eax
call fcn.00460ad0
mov byte [ebx + 0x1d8], 0
xorps xmm0, xmm0
movq qword [ebp - 0x20], xmm0
call fcn.006dc9cf
push 0
push 0x2710
push edx
push eax
call fcn.006defa0
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
call fcn.004713e0
sub esp, 0x18
lea edi, [ebx + 0x5388]
mov ecx, esp
mov esi, eax
push edi
call fcn.00452ce0
mov ecx, esi
call fcn.004871f0
push 0x15
push str.sdk_stop_close_server
lea ecx, [ebx + 0xb0]
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x38], 0x1fb8
call fcn.0044ebf0
call fcn.004713e0
sub esp, 0xe4
lea ecx, [ebx + 8]
mov edx, esp
mov dword [ebp - 0x10], esp
mov esi, eax
push ecx
mov ecx, edx
call fcn.00466420
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
push edi
call fcn.00452ce0
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00485c10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48b1b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [esp + 0x18], 0
je 0x48b1d7
mov ecx, dword [esi + 4]
push 0
push 0
push dword [esp + 0x24]
call fcn.0047cd40
pop esi
ret 0x18
mov eax, dword [esp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x48b1f9
mov ecx, dword [esi + 4]
push 0
push 0x2719
push dword [esp + 0x24]
call fcn.0047cd40
pop esi
ret 0x18
mov eax, dword [esp + 0x14]
push ebx
push edi
mov edi, dword [esp + 0x24]
push 0
push edi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0
push eax
push dword [esp + 0x28]
push dword [esp + 0x28]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x48b23f
mov eax, 0x2746
jmp 0x48b24c
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x48b26b
cmp eax, 0x3e5
je 0x48b26b
push dword [esp + 0x20]
mov ecx, dword [esi + 4]
push eax
push edi
call fcn.0047cd40
pop edi
pop ebx
pop esi
ret 0x18
mov ecx, dword [esi + 4]
push edi
call fcn.0047ce70
pop edi
pop ebx
pop esi
ret 0x18