joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438410
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0x601860
call fcn.00429170
mov eax, dword [0x60188c]
mov ebx, dword [ebp + 8]
push 0x601860
mov esi, dword [eax + ebx*4]
call fcn.00429180
add esp, 8
test byte [esi + 0x58], 1
je 0x438563
mov eax, dword [0x601878]
test eax, eax
je 0x43845f
push 4
lea ecx, [ebp + 0xc]
push ecx
push 1
push 6
push ebx
call eax
add esp, 0x14
jmp 0x43851c
cmp dword [0x601894], 0
push edi
mov edi, dword fs:[0x2c]
je 0x4384aa
mov eax, dword [edi]
cmp dword [eax + 0x21d0], 0
jne 0x4384aa
push 0x601860
call fcn.00429170
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [eax + ebx*4]
call fcn.00429180
add esp, 8
test dword [esi + 0x58], 0x10000000
jne 0x4384aa
mov esi, 1
jmp 0x4384ac
xor esi, esi
push 0x601860
call fcn.00429170
mov eax, dword [0x60188c]
add esp, 4
test esi, esi
mov esi, dword [eax + ebx*4]
push 0x601860
call fcn.00429180
add esp, 4
cmp dword [esi + 0x3c], 0
je 0x4384ff
cmp dword [esi + 0xc], 2
jne 0x4384ff
cmp word [esi + 0x5c], 0
je 0x4384ff
mov eax, dword [edi]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x4384f4
call fcn.005414b2
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x43851b
push 4
lea eax, [ebp + 0xc]
push eax
push 1
push 6
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_setsockopt]
push eax
call fcn.0053b370
add esp, 4
pop edi
test eax, eax
je 0x438563
mov eax, dword [0x601894]
xor ecx, ecx
test eax, eax
setne cl
lea ecx, [ecx*4 + 3]
test eax, eax
jne 0x43855c
cmp ecx, 5
jbe 0x438544
cmp dword [0x601c18], ecx
jl 0x43855c
or ecx, 0x360000
push str.failed_setsockopt_TCP_NODELAY_:__m
push ecx
call fcn.004241a0
add esp, 8
pop esi
pop ebx
pop ebp
ret
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x438570
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x601860
mov dword [ebp + 0xc], edi
call fcn.00429170
mov eax, dword [ebp + 8]
push 0x601860
lea esi, [eax*4]
mov eax, dword [0x60188c]
mov ebx, dword [esi + eax]
call fcn.00429180
mov eax, dword [ebx + 0x58]
add esp, 8
test al, 1
je 0x43863c
test edi, edi
jne 0x4385e7
test al, al
jns 0x4385e7
push edi
push edi
push dword [ebx + 0x60]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
push eax
call fcn.0053b370
add esp, 4
test eax, eax
je 0x4385e7
push str.WSAEventSelect:__m
push 0x360003
call fcn.004241a0
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x601860
call fcn.00429170
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [esi + eax]
call fcn.00429180
add esp, 8
lea eax, [ebp + 0xc]
push eax
push 0x8004667e
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push eax
call fcn.0053b370
add esp, 4
test eax, eax
je 0x43863c
push str.failed_ioctl_FIOBIO_:__m
push 0x360003
call fcn.004241a0
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebx + 0x58]
neg edi
sbb edi, edi
and eax, 0xffffff7f
and edi, 0x80
or edi, eax
xor eax, eax
mov dword [ebx + 0x58], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4399f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
push eax
call fcn.0053b370
add esp, 4
test eax, eax
je 0x439a22
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
mov ax, word [ebp - 0x12]
mov word [ecx + 0x78], ax
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0x7c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x43a160
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
or ebx, 0xffffffff
mov eax, dword [esi + 0x58]
test eax, 0x4000000
je 0x43a19e
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x43a18f
call fcn.005414b2
pop esi
mov dword [eax], 0x2746
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
cmp word [esi + 0x5c], 0
push edi
je 0x43a243
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [esi + 0x6c]
call fcn.00447ea0
mov ecx, dword [ebp + 8]
add esp, 0x10
cmp dword [ebp + 0x10], ecx
cmovb ecx, dword [ebp + 0x10]
push dword [ebp + 0x14]
push ecx
push dword [ebp - 4]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_recv]
push eax
call fcn.0053b370
mov edi, eax
add esp, 4
test edi, edi
jns 0x43a34e
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x43a205
call fcn.005414b2
cmp dword [eax], 0x2738
jne 0x43a34e
push edi
push dword [esi + 0x6c]
call fcn.00447ee0
add esp, 8
cmp dword [ebp + 0x18], 0
jne 0x43a23a
push edi
push dword [ebp + 0xc]
push dword [esi + 0x6c]
call fcn.00436ab0
push dword [esi + 0x6c]
call fcn.00447f40
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, 0x4080
jne 0x43a2a5
test eax, 0x400
jne 0x43a285
push esi
call fcn.00436d60
add esp, 4
test eax, eax
je 0x43a285
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x43a275
call fcn.005414b2
pop edi
pop esi
mov dword [eax], 0x2746
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x58]
test eax, 0x400
je 0x43a2a5
mov edi, dword [sym.imp.KERNEL32.dll_SleepEx]
push 1
push 0xffffffffffffffff
call edi
mov eax, dword [esi + 0x58]
test eax, 0x400
jne 0x43a295
test eax, 0x4000
je 0x43a314
push dword [esi + 0x6c]
call fcn.004480e0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x43a2ef
cmp dword [ebp + 0x18], 0
mov ebx, ecx
jne 0x43a2ef
mov eax, dword [ebp + 0x10]
cmp ecx, eax
cmovb eax, ecx
push eax
push dword [ebp + 0xc]
push dword [esi + 0x6c]
call fcn.00436ab0
add esp, 0xc
mov ebx, eax
test byte [esi + 0x58], 0x20
jne 0x43a2f5
push dword [esi + 0x6c]
call fcn.00447f40
add esp, 4
test byte [esi + 0x58], 0x20
je 0x43a304
push dword [esi + 0x6c]
call fcn.004480e0
add esp, 4
test eax, eax
jne 0x43a30b
and dword [esi + 0x58], 0xffffbfff
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
test al, al
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
jns 0x43a33f
test eax, eax
jne 0x43a32f
call fcn.005414b2
pop edi
pop esi
mov dword [eax], 0x2733
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x43a348
call fcn.005414b2
mov dword [eax], 0x2714
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a730
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00447e20
mov ecx, dword [ebp + 0x18]
mov edi, eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0x10
mov eax, dword [ecx + 4]
mov dword [ebp + 0x18], eax
movzx eax, word [ecx + 2]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x80]
mov dword [ebp + 8], eax
movzx eax, word [esi + 0x78]
test ax, ax
je 0x43a773
mov ebx, eax
jmp 0x43a7fd
mov ebx, dword [esi + 0x74]
xorps xmm0, xmm0
movups xmmword [ebp - 0x20], xmm0
mov eax, 2
mov dword [ebp - 8], 0x10
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x20]
push 0x10
push eax
push ebx
mov dword [ebp - 0x1c], 0
call dword [sym.imp.WS2_32.dll_bind]
push eax
call fcn.0053b370
add esp, 4
test eax, eax
je 0x43a7c4
push str.bind_failed__m
push 0x360003
call fcn.004241a0
add esp, 8
xor eax, eax
jmp 0x43a7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_getsockname]
push eax
call fcn.0053b370
add esp, 4
test eax, eax
je 0x43a7f6
push str.getsockname_failed__m
push 0x360003
call fcn.004241a0
add esp, 8
xor eax, eax
jmp 0x43a7fa
movzx eax, word [ebp - 0x1e]
movzx ebx, ax
push dword [ebp + 0x10]
mov word [esi + 0x78], bx
push dword [ebp + 0xc]
push edi
call fcn.00447d30
push dword [ebp + 0x18]
push dword [ebp + 8]
push dword [ebp - 0xc]
push ebx
push edi
call fcn.00448830
push 0x11
push dword [ebp + 0x18]
push dword [ebp + 8]
push edi
call fcn.00448780
add esp, 0x30
cmp word [esi + 0x5c], 0
je 0x43a851
mov eax, dword [esi + 0x58]
and eax, 0x200000
shl eax, 4
push eax
push edi
call fcn.00447dc0
add esp, 8
mov ebx, 0x20
jmp 0x43a856
mov ebx, 0x1c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.00447e60
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp - 0x10]
push esi
call fcn.0043a420
mov esi, eax
add esp, 0x1c
test esi, esi
jle 0x43a87e
sub esi, ebx
push edi
call fcn.00447d00
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a890
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x601860
call fcn.00429170
mov eax, dword [ebp + 8]
push 0x601860
lea edi, [eax*4]
mov eax, dword [0x60188c]
mov esi, dword [edi + eax]
call fcn.00429180
add esp, 8
cmp dword [esi + 0x3c], 0
je 0x43a92b
cmp dword [esi + 0xc], 2
jne 0x43a92b
cmp word [esi + 0x5c], 0
je 0x43a92b
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x10
jae 0x43a8fd
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x43a8f0
call fcn.005414b2
pop edi
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
pop ebp
ret
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [eax], 0x10
mov eax, 2
pop edi
movups xmmword [ecx], xmm0
mov word [ecx], ax
mov eax, dword [esi + 0x80]
mov dword [ecx + 4], eax
mov ax, word [esi + 0x78]
mov word [ecx + 2], ax
xor eax, eax
pop esi
pop ebp
ret
push 0x601860
call fcn.00429170
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [edi + eax]
call fcn.00429180
add esp, 8
cmp dword [esi + 0x3c], 0
jne 0x43a96c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_getsockname]
push eax
call fcn.0053b370
add esp, 4
pop edi
pop esi
pop ebp
ret
or eax, 0xffffffff
push eax
call fcn.0053b370
add esp, 4
pop edi
pop esi
pop ebp
ret

Function at 0x43a9c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x601860
call fcn.00429170
mov ecx, dword [ebp + 8]
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [eax + ecx*4]
call fcn.00429180
mov eax, dword [esi + 0x58]
add esp, 8
test al, 0x40
je 0x43aa9e
test al, 1
je 0x43aa2c
cmp dword [esi + 0x3c], 0
je 0x43aa08
cmp dword [esi + 0xc], 2
jne 0x43aa08
cmp word [esi + 0x5c], 0
jne 0x43aa2c
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_recvfrom]
push eax
call fcn.0053b370
add esp, 4
pop esi
pop ebp
ret
test eax, reloc.WS2_32.dll_connect
jne 0x43aa66
cmp dword [esi + 0x3c], 0
je 0x43aa46
cmp dword [esi + 0xc], 2
jne 0x43aa46
cmp word [esi + 0x5c], 0
jne 0x43aa66
push eax
push str.invalid_type:__d
push 0x76d
push str.vsock_recvfrom
push 0x360202
call fcn.00424510
add esp, 0x14
pop esi
pop ebp
ret
cmp dword [esi + 0xc], 0
jne 0x43aa83
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0043a160
add esp, 0x14
pop esi
pop ebp
ret
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0043a360
add esp, 0x18
pop esi
pop ebp
ret
push str.recvfrom_from_non_packet_socket
push 0x360000
call fcn.00424700
int3
Function at 0x43aac0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x601860
call fcn.00429170
mov ecx, dword [ebp + 8]
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [eax + ecx*4]
call fcn.00429180
mov eax, dword [esi + 0x58]
add esp, 8
test al, 0x40
jne 0x43ab0d
push eax
push str.invalid_type:__d
push 0x72e
push str.vsock_send
push 0x360202
call fcn.00424510
mov eax, dword [esi + 0x58]
add esp, 0x14
mov ecx, dword [esi + 0x3c]
test eax, reloc.WS2_32.dll_connect
jne 0x43ab6a
test ecx, ecx
je 0x43ab28
cmp dword [esi + 0xc], 2
jne 0x43ab28
cmp word [esi + 0x5c], 0
jne 0x43ab6a
test al, 1
je 0x43ab4a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_send]
push eax
call fcn.0053b370
add esp, 4
pop esi
pop ebp
ret
push eax
push str.invalid_type:__d
push 0x733
push str.vsock_send
push 0x360202
call fcn.00424510
add esp, 0x14
pop esi
pop ebp
ret
test ecx, ecx
je 0x43abb1
cmp dword [esi + 0xc], 2
jne 0x43abb1
cmp word [esi + 0x5c], 0
je 0x43abb1
test eax, 0x1000000
je 0x43abc6
cmp dword [esi + 0x14], 0x11
lea eax, [esi + 0x94]
push 0x10
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
jne 0x43aba6
call fcn.0043a730
add esp, 0x18
pop esi
pop ebp
ret
call fcn.0043a680
add esp, 0x18
pop esi
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0043a420
add esp, 0x10
pop esi
pop ebp
ret
push str.cannot_use_send_when_socket_not_connected
push 0x360000
call fcn.00424700
int3
Function at 0x43abe0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x601860
call fcn.00429170
mov ecx, dword [ebp + 8]
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [eax + ecx*4]
call fcn.00429180
mov eax, dword [esi + 0x58]
add esp, 8
test al, 0x40
je 0x43acec
test eax, reloc.WS2_32.dll_connect
jne 0x43ac73
cmp dword [esi + 0x3c], 0
je 0x43ac2b
cmp dword [esi + 0xc], 2
jne 0x43ac2b
cmp word [esi + 0x5c], 0
jne 0x43ac73
test al, 1
je 0x43ac53
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_sendto]
push eax
call fcn.0053b370
add esp, 4
pop esi
pop ebp
ret
push eax
push str.invalid_type:__d
push 0x783
push str.vsock_sendto
push 0x360202
call fcn.00424510
add esp, 0x14
pop esi
pop ebp
ret
push edi
mov edi, dword [ebp + 0x18]
test edi, edi
jne 0x43ac92
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi]
call fcn.0043aac0
add esp, 0x10
pop edi
pop esi
pop ebp
ret
cmp dword [esi + 0xc], 2
jne 0x43acfb
cmp dword [esi + 0x14], 0x11
jne 0x43accc
push esi
call fcn.0043b0b0
add esp, 4
test eax, eax
je 0x43acb2
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [ebp + 0x1c]
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0043a730
add esp, 0x18
pop edi
pop esi
pop ebp
ret
cmp dword [esi + 0x10], 3
jne 0x43acfb
push dword [ebp + 0x1c]
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0043a680
add esp, 0x18
pop edi
pop esi
pop ebp
ret
push str.sendto_to_non_packet_socket
push 0x360000
call fcn.00424700
push str.invalid_socket_address
push 0x360000
call fcn.00424700
int3
Function at 0x43ad10
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x601860
call fcn.00429170
mov ecx, dword [ebp + 8]
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [eax + ecx*4]
call fcn.00429180
mov ebx, dword [ebp + 0xc]
add esp, 8
mov edi, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
cmp ebx, 0xffff
jne 0x43ad75
cmp edx, 0x20
jne 0x43ad94
cmp edi, 4
jne 0x43ae21
mov ecx, dword [ebp + 0x14]
mov eax, dword [esi + 0x58]
mov ecx, dword [ecx]
neg ecx
sbb ecx, ecx
and eax, 0xffdfffff
and ecx, 0x200000
or ecx, eax
mov dword [esi + 0x58], ecx
jmp 0x43adbf
test ebx, ebx
jne 0x43ad94
cmp edx, 0xc
jne 0x43ad94
cmp edi, 8
jne 0x43ae30
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
mov dword [esi + 0x8c], eax
jmp 0x43adc2
cmp edx, 0x19
jne 0x43adbf
mov ecx, dword [esi + 0x58]
mov eax, ecx
and eax, reloc.WS2_32.dll_listen
cmp eax, 1
jne 0x43adbf
test cl, 0x40
je 0x43adbf
cmp dword [esi + 0xc], 2
jne 0x43adbf
cmp dword [esi + 0x14], 0x11
je 0x43adf7
cmp dword [esi + 0x10], 3
je 0x43adf7
mov ecx, dword [ebp + 0x14]
cmp dword [esi + 0x3c], 0
je 0x43ae06
cmp dword [esi + 0xc], 2
jne 0x43ae06
cmp word [esi + 0x5c], 0
je 0x43ae06
cmp edx, 4
je 0x43adff
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x43adf1
call fcn.005414b2
mov dword [eax], 0x16
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push edi
push ecx
push edx
push ebx
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_setsockopt]
push eax
call fcn.0053b370
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
push str.incorrect_SO_BROADCAST_parameters
push 0x360000
call fcn.00424700
push str.incorrect_IP_ADD_MEMBERSHIP_parameters
push 0x360000
call fcn.00424700
int3
Function at 0x43afb0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push 0x601860
call fcn.00429170
mov ecx, dword [ebp + 8]
mov eax, dword [0x60188c]
push 0x601860
mov edi, dword [eax + ecx*4]
call fcn.00429180
add esp, 8
mov dword [ebp - 4], 0x10
test dword [edi + 0x58], 0x800000
lea esi, [edi + 0xec]
jne 0x43b080
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x60]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x43b012
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
movzx eax, word [ebp - 0x12]
mov dword [esi + 8], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0x10
push eax
push dword [edi + 0x60]
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x43b009
cmp dword [edi + 0x48], eax
je 0x43b048
movups xmm0, xmmword [edi + 0x44]
movups xmmword [ebp - 0x14], xmm0
mov eax, dword [ebp - 0x10]
mov dword [esi + 0xc], eax
mov ecx, dword [ebp - 0x14]
shr ecx, 0x10
cmp dword [ebp + 0xc], 0
mov dword [esi + 0x10], ecx
je 0x43b066
mov eax, dword [esi + 8]
mov dword [esi + 8], ecx
mov dword [esi + 0x10], eax
push esi
mov dword [esi], 5
call fcn.00439190
add esp, 4
test eax, eax
jne 0x43b009
or dword [edi + 0x58], 0x800000
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4438b0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00420e40
add esp, 8
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push eax
call fcn.0053b3a0
xor ecx, ecx
add esp, 4
cmp eax, 0xffffffff
cmove eax, ecx
pop ebp
ret
Function at 0x443b00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x4c
push 0
push esi
call fcn.0053f280
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
push 0
push eax
push esi
mov dword [esi], eax
mov dword [esi + 4], ecx
call fcn.00443de0
push esi
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
call fcn.00443c90
add esp, 0x1c
test eax, eax
jne 0x443bab
mov edi, dword [esi + 8]
lea eax, [ebp + 8]
push eax
push 0x40
push 0x32
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x443bab
test edi, edi
je 0x443bab
push dword [ebp + 0x10]
push dword [esi + 8]
push dword [esi + 0x18]
push edi
push esi
call fcn.00443f30
movq xmm0, qword [edi]
lea edx, [ebp + 0x10]
mov ecx, dword [ebp + 8]
add esp, 0x14
movq qword [esi + 0x24], xmm0
movzx eax, word [edi + 8]
mov word [esi + 0x2c], ax
mov eax, dword [esi + 4]
push edx
push ecx
push 0x32
movq xmm0, qword [eax]
movq qword [esi + 0x42], xmm0
movzx eax, word [eax + 8]
push edi
mov word [esi + 0x4a], ax
mov dword [ebp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
xor eax, eax
pop esi
pop ebp
ret
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x443bc7
push 0x8000
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esi + 0x10], 0
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret

Function at 0x443bd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
je 0x443c85
push edi
mov edi, dword [esi + 8]
lea eax, [ebp + 8]
push eax
push 0x40
push 0x32
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x443c62
test edi, edi
je 0x443c62
push dword [esi + 0x18]
push dword [esi + 0x10]
push edi
call fcn.0053f3e0
lea eax, [ebp - 4]
push eax
push 0xf
lea eax, [ebp - 0xc34]
push eax
push dword [esi + 0x20]
push 0x32
push dword [esi + 0xc]
push 0
push dword [esi + 8]
call fcn.00407290
add esp, 0x2c
cmp eax, 3
je 0x443c4e
lea eax, [ebp - 0xc34]
push eax
push dword [esi + 0x10]
push dword [esi + 0x18]
push edi
push dword [esi + 8]
call fcn.00443e60
add esp, 0x14
mov eax, dword [ebp + 8]
lea ecx, [ebp + 8]
push ecx
push eax
push 0x32
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [ebp + 0xc], 0
pop edi
je 0x443c85
mov eax, dword [esi + 0x10]
test eax, eax
je 0x443c85
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esi + 0x10], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x443c90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
lea eax, [ebp - 4]
push ebx
mov ebx, dword [ebp + 8]
push edi
push eax
push 0xf
lea eax, [ebp - 0xc34]
xor edi, edi
push eax
push dword [ebx + 0x20]
push 0x32
push dword [ebx + 0xc]
push edi
push dword [ebx + 8]
call fcn.00407290
add esp, 0x20
cmp eax, 3
je 0x443dd7
push 0x40
push 0x1000
push 0x1e
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp + 8], eax
test eax, eax
je 0x443dd7
cmp dword [ebx + 0x14], edi
jne 0x443ced
mov dword [ebx + 0x14], eax
mov ecx, dword [ebx + 8]
mov eax, ecx
push esi
mov esi, dword [ebx + 4]
sub eax, esi
mov edx, esi
sub edx, ecx
cmp ecx, esi
mov esi, dword [ebp - 4]
cmovbe eax, edx
cmp eax, 0x80000000
sbb edx, edx
xor ecx, ecx
and edx, 0xfffffffb
add edx, 0xa
test esi, esi
je 0x443d30
lea eax, [ebp - 0xb74]
nop dword [eax]
cmp edi, edx
jge 0x443d30
add edi, dword [eax]
inc ecx
add eax, 0xd0
cmp ecx, esi
jb 0x443d20
push edi
push dword [ebx + 0xc]
push dword [ebp + 8]
call fcn.0053f3e0
mov esi, dword [ebx + 8]
mov ecx, esi
mov edx, dword [ebx + 0x14]
sub ecx, edx
lea eax, [esi + edi]
push eax
lea eax, [edx + edi]
push eax
mov eax, edx
sub eax, esi
cmp edx, esi
mov esi, dword [ebp + 8]
cmovbe eax, ecx
cmp eax, 0x80000000
sbb eax, eax
and eax, 0xfffffffb
add eax, 0xa
push eax
lea eax, [esi + edi]
push eax
push ebx
call fcn.00443f30
lea eax, [ebp - 0xc34]
push eax
push dword [ebx + 8]
push edi
push esi
push esi
call fcn.00443e60
add esp, 0x34
test eax, eax
jne 0x443dbf
mov ecx, dword [ebx + 0x14]
mov eax, ecx
mov dword [ebx + 0x10], esi
mov esi, dword [ebx + 8]
mov edx, esi
sub eax, esi
mov dword [ebx + 0x18], edi
sub edx, ecx
cmp ecx, esi
pop esi
cmovbe eax, edx
cmp eax, 0x80000000
sbb eax, eax
and eax, 0xfffffffb
add eax, 0xa
add eax, edi
mov dword [ebx + 0x1c], eax
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop esi
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret