joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a9d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ebx, dword [eax + 4]
push edi
mov edi, dword [eax]
sub ebx, edi
mov eax, dword [esi + 0xcc]
lea edx, [esi + 0xc8]
mov dword [ebp - 4], ebx
lea ecx, [esi + 0xc4]
mov dword [ebp - 8], edx
mov dword [ebp + 8], ecx
test eax, eax
je 0x45aa53
mov ecx, eax
test ebx, ebx
je 0x45aa3d
mov ecx, 0x20
dec ebx
sub ecx, eax
movzx eax, byte [edi]
shl eax, cl
xor dword [esi + 0xc8], eax
mov eax, dword [esi + 0xc4]
shr eax, cl
xor byte [edi], al
inc edi
mov eax, dword [esi + 0xcc]
add eax, 0xfffffff8
mov dword [esi + 0xcc], eax
mov ecx, eax
test eax, eax
jne 0x45aa06
mov dword [ebp - 4], ebx
test ecx, ecx
jne 0x45ab81
push dword [edx]
mov ecx, esi
call fcn.0045aef0
jmp 0x45aa59
mov dword [ebp + 8], ecx
mov dword [ebp - 8], edx
mov eax, ebx
and eax, 0xfffffffc
add eax, edi
mov dword [ebp - 0xc], eax
cmp edi, eax
jae 0x45ab2d
mov ebx, eax
nop dword [eax]
mov ecx, esi
call fcn.0045a5d0
movzx edx, byte [edi + 3]
movzx eax, byte [edi + 2]
mov ecx, dword [esi + 0x40]
xor ecx, dword [esi + 0x48]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [edi]
shl edx, 8
or edx, eax
mov eax, dword [esi + 0x44]
xor ecx, edx
xor ecx, dword [esi + 0x7c]
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x48]
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x4c]
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x50]
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x54]
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x58]
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x5c]
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x60]
mov dword [esi + 0x5c], eax
mov eax, dword [esi + 0x64]
mov dword [esi + 0x60], eax
mov eax, dword [esi + 0x68]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x6c]
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x70]
mov dword [esi + 0x6c], eax
mov eax, dword [esi + 0x74]
mov dword [esi + 0x70], eax
mov eax, dword [esi + 0x78]
mov dword [esi + 0x74], eax
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x78], eax
xor dword [esi + 0x34], edx
mov eax, dword [ebp + 8]
mov dword [esi + 0x7c], ecx
xor edx, dword [eax]
mov eax, edx
mov byte [edi], dl
shr eax, 0x18
mov byte [edi + 3], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 2], al
mov eax, edx
shr eax, 8
mov byte [edi + 1], al
add edi, 4
cmp edi, ebx
jb 0x45aa70
mov ebx, dword [ebp - 4]
and ebx, 3
je 0x45ab81
mov ecx, esi
call fcn.0045a5d0
mov edx, dword [ebp - 8]
mov eax, 0x20
mov dword [esi + 0xcc], 0x20
mov dword [edx], 0
test ebx, ebx
je 0x45ab81
mov ecx, 0x20
dec ebx
sub ecx, eax
movzx eax, byte [edi]
shl eax, cl
xor dword [edx], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
shr eax, cl
xor byte [edi], al
inc edi
mov eax, dword [esi + 0xcc]
add eax, 0xfffffff8
mov dword [esi + 0xcc], eax
test eax, eax
jne 0x45ab51
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45ab90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ebx, dword [eax + 4]
push edi
mov edi, dword [eax]
sub ebx, edi
cmp dword [esi + 0xcc], 0
je 0x45abb6
push dword [esi + 0xc8]
call fcn.0045aef0
mov ecx, esi
call fcn.0045a5d0
mov eax, dword [esi + 0xcc]
lea ecx, [esi + 4]
shl eax, 3
mov edx, 4
xor eax, dword [esi + 0x34]
xor eax, 0x6996c53a
mov dword [esi + 0xcc], 0
mov dword [esi + 0x34], eax
mov eax, dword [ecx + 0x3c]
lea ecx, [ecx + 0x10]
xor dword [ecx - 0x14], eax
mov eax, dword [ecx + 0x30]
xor dword [ecx - 0x10], eax
mov eax, dword [ecx + 0x34]
xor dword [ecx - 0xc], eax
mov eax, dword [ecx + 0x38]
xor dword [ecx - 8], eax
sub edx, 1
jne 0x45abe3
mov ecx, esi
call fcn.0045a8c0
test ebx, ebx
je 0x45ac73
nop
mov ecx, esi
call fcn.0045a5d0
cmp ebx, 4
jb 0x45ac52
movzx eax, byte [esi + 0xc7]
mov byte [edi + 3], al
movzx eax, byte [esi + 0xc6]
mov byte [edi + 2], al
movzx eax, byte [esi + 0xc5]
mov byte [edi + 1], al
movzx eax, byte [esi + 0xc4]
mov byte [edi], al
add edi, 4
sub ebx, 4
jne 0x45ac10
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor edx, edx
test ebx, ebx
je 0x45ac73
xor ecx, ecx
nop word [eax + eax]
mov eax, dword [esi + 0xc4]
shr eax, cl
add ecx, 8
mov byte [edx + edi], al
inc edx
cmp edx, ebx
jb 0x45ac60
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x45ad70
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
mov edx, dword [eax + 4]
sub edx, dword [eax]
push edi
mov ecx, edx
mov dword [ebp - 8], edx
xor edi, edi
lea esi, [ebx + 0x34]
and ecx, 0xfffffffc
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], ecx
jbe 0x45addc
nop dword [eax + eax]
mov ecx, dword [eax]
movzx eax, byte [ecx + edi + 2]
add ecx, edi
movzx edx, byte [ecx + 3]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 1]
shl edx, 8
or edx, eax
movzx eax, byte [ecx]
shl edx, 8
mov ecx, ebx
or edx, eax
xor dword [esi], edx
call fcn.0045a5d0
mov eax, dword [ebp + 8]
add edi, 4
cmp edi, dword [ebp - 0xc]
jb 0x45ada0
mov edx, dword [ebp - 8]
jmp 0x45addf
mov dword [ebp - 4], esi
cmp edi, edx
jae 0x45ae3f
mov eax, dword [eax]
mov esi, edx
add eax, edi
sub esi, edi
push esi
push eax
lea eax, [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp esi, 4
jge 0x45ae0f
jae 0x45aee6
mov byte [ebp + esi + 8], 0
inc esi
cmp esi, 4
jl 0x45adfe
movzx edx, byte [ebp + 0xb]
movzx eax, byte [ebp + 0xa]
shl edx, 8
or edx, eax
mov eax, dword [ebp + 8]
shl edx, 8
movzx ecx, ah
or edx, ecx
movzx eax, al
shl edx, 8
mov ecx, ebx
or edx, eax
xor dword [ebx + 0x34], edx
call fcn.0045a5d0
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor dword [esi], edx
mov ecx, ebx
call fcn.0045a5d0
mov eax, dword [ebx]
mov ecx, ebx
mov dword [ebx + 0x40], eax
mov eax, dword [ebx + 4]
mov dword [ebx + 0x44], eax
mov eax, dword [ebx + 8]
mov dword [ebx + 0x48], eax
mov eax, dword [ebx + 0xc]
mov dword [ebx + 0x4c], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0x50], eax
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x54], eax
mov eax, dword [ebx + 0x18]
mov dword [ebx + 0x58], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebx + 0x5c], eax
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x60], eax
mov eax, dword [ebx + 0x24]
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x68], eax
mov eax, dword [ebx + 0x2c]
mov dword [ebx + 0x6c], eax
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x70], eax
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0x74], eax
mov eax, dword [ebx + 0x38]
mov dword [ebx + 0x78], eax
mov eax, dword [ebx + 0x3c]
mov dword [ebx + 0x7c], eax
call fcn.0045a8c0
pop edi
pop esi
lea eax, [ebx + 4]
mov edx, 4
pop ebx
nop dword [eax]
mov ecx, dword [eax + 0x3c]
lea eax, [eax + 0x10]
xor dword [eax - 0x14], ecx
mov ecx, dword [eax + 0x30]
xor dword [eax - 0x10], ecx
mov ecx, dword [eax + 0x34]
xor dword [eax - 0xc], ecx
mov ecx, dword [eax + 0x38]
xor dword [eax - 8], ecx
sub edx, 1
jne 0x45aec0
mov esp, ebp
pop ebp
ret 4
call fcn.00550291
int3
Function at 0x45cdd0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
mov eax, dword [0x62aabc]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x45cf42
mov eax, dword [ebp - 0x1c4]
cmp al, 2
jne 0x45cfa9
shr eax, 8
cmp al, 2
jne 0x45cfa9
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
push 0
push 0x631434
call fcn.00475390
add esp, 0x10
test eax, eax
jne 0x45cf42
push eax
push 0x630f58
call fcn.004744f0
add esp, 8
test eax, eax
jne 0x45cf42
push eax
push 0x630f54
call fcn.004744f0
add esp, 8
test eax, eax
jne 0x45cf42
lea eax, [ebp - 0x34]
push edi
push eax
call fcn.0046bed0
lea eax, [ebp - 0x34]
push 0x631400
push eax
call fcn.0046be80
push 0x631434
call fcn.00475660
xor eax, eax
mov ecx, 0xc8
mov edi, 0x62d248
rep stosd dword es:[edi], eax
push 0x631434
call fcn.00475760
lea eax, [ebp - 0x24]
push eax
call fcn.00463610
lea eax, [ebp - 0x24]
push 0xc
push eax
call fcn.004636c0
lea eax, [ebp - 0x24]
push 2
push eax
call fcn.004636e0
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.00463700
lea eax, [ebp - 0x24]
push 0xa
push eax
call fcn.00463680
lea eax, [ebp - 0x24]
push 0x1388
push eax
call fcn.00463660
add esp, 0x40
lea eax, [ebp - 0x24]
push 0x64
push eax
call fcn.004636a0
lea eax, [ebp - 0x24]
push eax
push 0x631100
call fcn.00463a00
add esp, 0x10
pop edi
test eax, eax
jne 0x45cf33
lea eax, [ebp - 0x24]
push eax
push 0x631280
call fcn.00463a00
add esp, 8
test eax, eax
jne 0x45cf33
lea eax, [ebp - 0x24]
push eax
push 0x630f80
call fcn.00463a00
add esp, 8
test eax, eax
je 0x45cf55
mov dword [0x62d238], 0
call fcn.0045c700
mov eax, 0xffffff8b
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054f742
mov esp, ebp
pop ebp
ret
push esi
push 0x467050
call fcn.00468800
push 0x46c170
call fcn.004687e0
push 0x631100
push 0x631440
call fcn.004644d0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x45cf98
call fcn.0045c700
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054f742
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054f742
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 0xffffff8b
xor ecx, ebp
call fcn.0054f742
mov esp, ebp
pop ebp
ret
Function at 0x466730
Capabilities:
Connect socket
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x62aabc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push esi
call fcn.00471c00
add esp, 4
cmp eax, 0xffffffff
je 0x4667d7
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 0x110], 5
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x108], 1
test eax, eax
jns 0x4667ce
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4667ce
lea eax, [ebp - 0x110]
push eax
push 0
lea eax, [ebp - 0x108]
push eax
push 0
lea eax, [esi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jns 0x4667cc
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054f742
mov esp, ebp
pop ebp
ret
je 0x4667b9
push esi
call fcn.00471bd0
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0054f742
mov esp, ebp
pop ebp
ret
Function at 0x468da0
Capabilities:
Convert ip address from string
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x62aabc]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x5629b8]
movq xmm0, qword [str.ShutDown]
push esi
push 0xf7
mov byte [ebp - 0xfc], al
lea eax, [ebp - 0xfb]
push 0
push eax
movq qword [ebp - 0x104], xmm0
call sub.VCRUNTIME140.dll_memset
lea esi, [ebp - 0x104]
add esp, 0xc
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x468df0
mov eax, dword [0x62d574]
sub esi, ecx
sub eax, 1
jne 0x468ee5
push ebx
push eax
push 2
push 2
mov dword [0x62d574], 2
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x468e53
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
lea eax, [ebp - 0x204]
push 0x100
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror_s]
add esp, 0xc
xor eax, eax
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054f742
mov esp, ebp
pop ebp
ret
cmp dword [0x62d574], 0
je 0x468edd
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
nop dword [eax]
lea eax, [ebp - 0x210]
mov word [ebp - 0x214], cx
push eax
push str.127.0.0.1
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
movzx eax, word [0x630f50]
push eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
mov word [ebp - 0x212], ax
lea eax, [ebp - 0x214]
push eax
push 0
push esi
lea eax, [ebp - 0x104]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_sendto]
push 1
call edi
cmp dword [0x62d574], 0
je 0x468edc
push 0x3e8
call edi
cmp dword [0x62d574], 0
mov ecx, 2
jne 0x468e70
pop edi
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0054f742
mov esp, ebp
pop ebp
ret
Function at 0x469440
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x62aabc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
mov dword [ebp - 0x88], 0x80
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x46948e
or eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054f742
mov esp, ebp
pop ebp
ret
mov ax, word [ebp - 0x84]
cmp ax, 2
je 0x4694a1
cmp ax, 0x17
jne 0x4694b0
push dword [ebp - 0x82]
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esi], ax
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0054f742
mov esp, ebp
pop ebp
ret

Function at 0x4695e0
Capabilities:
Convert ip address from string
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x62aabc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x98
push 0
push esi
mov dword [ebp - 0x108], 1
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 0x10]
lea ecx, [esi + 8]
add esp, 0xc
mov dword [esi], eax
mov dword [esi + 0x8c], 0xffffffff
mov dword [esi + 4], edi
mov dword [esi + 0x88], ecx
sub eax, 4
je 0x46966f
sub eax, 2
je 0x469749
mov eax, dword [esi + 0x8c]
cmp eax, 0xffffffff
je 0x469650
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
mov dword [esi + 0x8c], 0xffffffff
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054f742
mov esp, ebp
pop ebp
ret
mov eax, 2
mov word [ecx], ax
lea eax, [ecx + 4]
push eax
push edi
push 2
mov dword [esi + 0x94], 0x10
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x46963e
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x8c], eax
cmp eax, 0xffffffff
jne 0x4696ec
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
lea eax, [ebp - 0x104]
push 0x100
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror_s]
lea eax, [ebp - 0x104]
push eax
push 4
push str.init_socket_suff__:_IPv_c_socket_not_available:__s_n
push 0x309
push str.D:UsersphiliDropboxDevelopmentlibpupnppupnpupnp_srcgenlibminiserverminiserver.c
push 4
push 2
call fcn.00417540
add esp, 0x28
jmp 0x46963e
push 4
lea ecx, [ebp - 0x108]
push ecx
push 4
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x469749
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
lea eax, [ebp - 0x104]
push 0x100
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror_s]
lea eax, [ebp - 0x104]
push eax
push str.init_socket_suff__:_unable_to_set_SO_REUSEADDR:__s_n
push 0x333
push str.D:UsersphiliDropboxDevelopmentlibpupnppupnpupnp_srcgenlibminiserverminiserver.c
push 4
push 2
call fcn.00417540
add esp, 0x24
jmp 0x46963e
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0054f742
mov esp, ebp
pop ebp
ret
Function at 0x46a600
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x62aabc]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
mov ecx, 0x62d164
mov dword [edi + 0x24], 0xffffffff
lea edx, [ecx + 1]
mov dword [edi + 0x28], 0xffffffff
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46a630
sub ecx, edx
je 0x46a6ae
push 0
push 2
push 2
mov byte [ebp - 0x105], 4
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi + 0x24], eax
cmp eax, 0xffffffff
jne 0x46a687
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
lea eax, [ebp - 0x104]
push 0x100
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror_s]
add esp, 0xc
mov eax, 0xffffff33
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054f742
mov esp, ebp
pop ebp
ret
push 1
lea ecx, [ebp - 0x105]
push ecx
push 0xa
push 0
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [edi + 0x24]
call fcn.00471c00
mov eax, dword [edi + 0x24]
add esp, 4
mov dword [0x627c04], eax
mov ecx, 0x62d164
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46a6b6
lea eax, [edi + 0x10]
push ebx
sub ecx, edx
je 0x46a6f8
push eax
call fcn.0046a2b0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x46a6fe
push dword [edi + 0x24]
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [edi + 0x28]
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, ebx
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054f742
mov esp, ebp
pop ebp
ret
mov dword [eax], 0xffffffff
mov ecx, dword [ebp - 4]
xor eax, eax
pop ebx
xor ecx, ebp
pop edi
call fcn.0054f742
mov esp, ebp
pop ebp
ret
Function at 0x46a710
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xab0
mov eax, dword [0x62aabc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xorps xmm0, xmm0
mov dword [ebp - 0xa90], 0x80
push edi
push 0x1d0
movups xmmword [ebp - 0xab0], xmm0
lea esi, [ebp - 0xa0c]
mov dword [ebp - 0xa98], 0
movq qword [ebp - 0xaa0], xmm0
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x46a7b5
mov eax, dword [ebp + 8]
cmp eax, dword [0x627c04]
jne 0x46a784
push 9
push ebx
call fcn.00470d80
add esp, 8
jmp 0x46a78d
push ebx
call fcn.00470d50
add esp, 4
lea eax, [ebx + 0x114]
push 0x9c4
push eax
call fcn.00465230
add esp, 8
test eax, eax
jne 0x46a7ad
mov esi, dword [ebx + 0x114]
jmp 0x46a7b5
push ebx
call edi
add esp, 4
xor ebx, ebx
lea eax, [ebp - 0xa90]
push eax
lea eax, [ebp - 0xa8c]
push eax
push 0
push 0x9c3
push esi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebp - 0xa94], eax
test eax, eax
jle 0x46a8e1
mov byte [eax + esi], 0
lea eax, [ebp - 0x48]
movzx ecx, word [ebp - 0xa8c]
push 0x41
sub ecx, 2
je 0x46a815
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x40
lea eax, [ebp - 0x48]
push str._Invalid_address_family_
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add esp, 0x18
jmp 0x46a824
push eax
lea eax, [ebp - 0xa88]
push eax
push 2
call sub.WS2_32.dll_inet_ntop
lea eax, [ebp - 0x48]
push eax
push esi
push str.Start_of_received_response______________________________________________________n_s_nEnd_of_received_response________________________________________________________nFrom_host__s_n
push 0x36e
push str.D:UsersphiliDropboxDevelopmentlibpupnppupnpupnp_src_ssdp_ssdp_server.c
push 0
push 2
call fcn.00417540
add esp, 0x1c
test ebx, ebx
je 0x46a8f1
mov ecx, dword [ebp - 0xa94]
lea edi, [ebx + 0x150]
mov eax, dword [ebx + 0x114]
lea esi, [ebp - 0xa8c]
add dword [ebx + 0x118], ecx
push ebx
push 0x46a910
mov byte [ecx + eax], 0
lea eax, [ebp - 0xab0]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00463720
lea eax, [ebp - 0xab0]
push 0x46a5e0
push eax
call fcn.00463700
lea eax, [ebp - 0xab0]
push 1
push eax
call fcn.00463760
push 0
lea eax, [ebp - 0xab0]
push eax
push 0x631280
call fcn.00463790
add esp, 0x28
test eax, eax
je 0x46a8f1
push ebx
call fcn.0046fcd0
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054f742
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x46a8f1
push ebx
call fcn.0046fcd0
push ebx
call edi
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054f742
mov esp, ebp
pop ebp
ret
Function at 0x470160
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x144]
mov ecx, dword [esi + 0x148]
add ecx, dword [eax]
mov eax, dword [esi + 0x148]
mov dword [esi + 0x10c], ecx
mov dword [esi + 0x110], 0
mov dword [esi + 0x140], eax
cmp dword [esi + 0xcc], 0
je 0x4701b6
mov eax, dword [esi + 4]
add eax, 0xfffffffe
cmp eax, 7
ja case.0x4701af.4
movzx eax, byte [eax + 0x470390]
jmp dword [eax*4 + 0x470388]
mov eax, dword [esi + 0xb4]
cmp eax, 0xcc
je case.0x4701af.2
cmp eax, 0x130
je case.0x4701af.2
cmp eax, 0x64
jl 0x4701e2
cmp eax, 0xc7
jle case.0x4701af.2
mov eax, dword [esi + 0xb0]
cmp eax, 3
je case.0x4701af.2
cmp eax, 9
je case.0x4701af.2
cmp eax, 6
je case.0x4701af.2
cmp eax, 7
je case.0x4701af.2
cmp eax, 8
je case.0x4701af.2
push ebx
push edi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x28], 0x16
push eax
lea edi, [esi + 0xd8]
push 0
push edi
call fcn.00462ef0
add esp, 0xc
test eax, eax
je 0x4702aa
mov eax, dword [eax + 8]
mov ebx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
add eax, ebx
mov dword [ebp - 4], eax
mov al, byte [eax]
mov byte [ebp + 0xb], al
mov al, byte [ebx]
test al, al
je 0x470270
mov edi, ebx
movsx eax, al
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [edi], al
lea edi, [edi + 1]
mov al, byte [edi]
add esp, 4
test al, al
jne 0x470252
lea edi, [esi + 0xd8]
mov eax, dword [ebp - 4]
push str.chunked
push ebx
mov byte [eax], 0
call sub.VCRUNTIME140.dll_strstr
mov ecx, dword [ebp - 4]
add esp, 8
mov dl, byte [ebp + 0xb]
mov byte [ecx], dl
test eax, eax
je 0x4702aa
sub eax, ebx
js 0x4702aa
pop edi
pop ebx
mov dword [esi + 0x134], 3
mov eax, 6
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x54], 3
push eax
push 0
push edi
call fcn.00462ef0
add esp, 0xc
test eax, eax
je 0x470332
mov eax, dword [eax + 8]
mov ebx, dword [eax + 0x10]
mov edi, dword [eax + 0xc]
mov dword [ebp + 8], edi
test ebx, ebx
je 0x470313
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push 0xa
mov dword [eax], 0
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov edi, eax
add esp, 0xc
test edi, edi
js 0x470313
mov ecx, dword [ebp + 8]
add ecx, ebx
cmp dword [ebp - 4], ecx
jne 0x470313
cmp edi, 0x7fffffff
jne 0x470316
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0x22
jne 0x470316
or edi, 0xffffffff
mov dword [esi + 0x138], edi
mov eax, 6
pop edi
pop ebx
mov dword [esi + 0x134], 2
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0xcc], 0
je 0x470361
cmp dword [esi + 4], 8
jne 0x47034b
mov dword [esi + 0x12c], 1
pop edi
pop ebx
mov dword [esi + 0x128], 0x19b
mov eax, 3
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
mov dword [esi + 0x134], 4
mov eax, 6
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x130], 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret