joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408480
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x40856a
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x4084fd
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00407c40
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4084c3
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x408633
call fcn.0040850f
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x4085ca
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00408060
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x40857b
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x408633
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00408060
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x40862e
jmp 0x408633
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x409360
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40937e
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x4093c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x4093de
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret
Function at 0x409420
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x409442
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x4094a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x4094c2
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x409520
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40954a
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret

Function at 0x4095b0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x4095da
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x409640
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x40969f
Function at 0x4096ae
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x409690
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x409720
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x40977f

Function at 0x40978e
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x409770
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret
Function at 0x40be00
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x40c320
test edx, edx
je 0x40c320
call fcn.0040be17
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x40c360
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0040be00
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x40c3d1
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x40c396
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x40cce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x40cd64
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x40cd3c
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x40cd44
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.0040cd69
Function at 0x44e690
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x6a7d40]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44e742
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x6a89a0]
mov esi, eax
mov eax, dword [0x6a89a4]
cmp ecx, 0x257edfd1
jne 0x44e6d9
cmp eax, 0xb2ab117a
je 0x44e6e8
cmp ecx, 0x257edfd0
jne 0x44e6ef
cmp eax, 0xb2ab117a
jne 0x44e6ef
test esi, esi
setne al
jmp 0x44e6ff
mov eax, dword [0x6a8998]
mov ecx, 0x6a8998
push esi
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
add eax, 2
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x6a8998
mov dword [esp + 8], str.F:huanjing_vcpkg_2023.08.09installedx86_windows_staticinclude_boost_asiodetailimplwin_tss_ptr.ipp
mov dword [esp + 0xc], str.win_tss_ptr_create
mov dword [esp + 0x10], 0x2e
mov dword [esp + 0x14], 0x1a
test al, 1
je 0x44e742
cmp eax, 1
jne 0x44e755
test esi, esi
jne 0x44e755
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.005df387
mov esp, ebp
pop ebp
ret
lea eax, [esp + 8]
mov edx, 0x699fe4
push eax
lea ecx, [esp + 0x1c]
call fcn.0044e5c0
int3
Function at 0x44f4d0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60d510
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x6a7d40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
cmp dword [esi + 0x60], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], vtable.boost::asio::detail::win_iocp_io_context.0
je 0x44f590
call fcn.0044f990
mov ebx, dword [esi + 0x60]
push 0xffffffffffffffff
push 0
mov eax, dword [ebx + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [ebx + 8]
call edi
xor eax, eax
mov ecx, 0x6ac094
lock xadd dword [ecx], eax
mov ecx, dword [ebx + 4]
push 0
push ecx
test eax, eax
je 0x44f55c
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x44f572
push method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_56
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [esi + 0x60]
test ebx, ebx
je 0x44f589
push dword [ebx + 4]
call edi
push 0xc
push ebx
call fcn.005dfa12
add esp, 8
mov dword [esi + 0x60], 0
lea ecx, [esi + 0x54]
call fcn.004578a0
lea eax, [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [esi + 0x30]
test eax, eax
je 0x44f5ac
push eax
call edi
mov ebx, dword [esi + 0x2c]
test ebx, ebx
je 0x44f5c3
push dword [ebx + 4]
call edi
push 0xc
push ebx
call fcn.005dfa12
add esp, 8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x44f5cd
push eax
call edi
test byte [ebp + 8], 1
mov dword [esi], vtable.boost::asio::execution_context::service.0
je 0x44f5e4
push 0x64
push esi
call fcn.005dfa12
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005df387
mov esp, ebp
pop ebp
ret 4
Function at 0x4504d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x6a7d40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
cmp ebx, 0xffffffff
je 0x450692
cmp byte [ebp + 8], 0
je 0x450532
mov al, byte [edx]
test al, 8
je 0x450532
or al, 8
xor ecx, ecx
push 4
mov byte [edx], al
lea eax, [ebp - 8]
push eax
push 0x80
push 0xffff
push ebx
mov dword [ebp - 8], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea ecx, [ebp - 0x18]
setne dl
call fcn.00450450
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
mov ecx, esi
test ebx, ebx
setne dl
call fcn.00450450
test ebx, ebx
je 0x450680
mov esi, dword [0x6a89a4]
push edi
mov edi, dword [0x6a89a0]
cmp edi, 0x257edfd1
jne 0x45056c
cmp esi, 0xb2ab117a
je 0x45057c
cmp edi, 0x257edfd0
jne 0x450580
cmp esi, 0xb2ab117a
jne 0x450580
mov al, 1
jmp 0x4505a0
mov eax, dword [0x6a8998]
mov ecx, 0x6a8998
push 0x2733
mov eax, dword [eax + 0x18]
call eax
mov esi, dword [0x6a89a4]
mov edi, dword [0x6a89a0]
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x18]
movzx eax, al
add eax, 2
mov dword [ebp - 0x18], 0x2733
mov dword [ebp - 0x14], 0x6a8998
mov dword [ebp - 0x10], eax
call fcn.0044da80
test al, al
jne 0x450637
cmp edi, 0x257edfd1
jne 0x4505d6
cmp esi, 0xb2ab117a
je 0x4505e6
cmp edi, 0x257edfd0
jne 0x4505ea
cmp esi, 0xb2ab117a
jne 0x4505ea
mov al, 1
jmp 0x4505fe
mov eax, dword [0x6a8998]
mov ecx, 0x6a8998
push 0x4d5
mov eax, dword [eax + 0x18]
call eax
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x18]
movzx eax, al
add eax, 2
mov dword [ebp - 0x18], 0x4d5
mov dword [ebp - 0x14], 0x6a8998
mov dword [ebp - 0x10], eax
call fcn.0044da80
test al, al
jne 0x450637
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005df387
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 8]
push eax
push 0x8004667e
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp - 0x20]
push esi
and byte [eax], 0xfc
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 0xc]
mov esi, eax
test esi, esi
setne dl
call fcn.00450450
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005df387
mov esp, ebp
pop ebp
ret
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005df387
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.005df387
mov esp, ebp
pop ebp
ret
Function at 0x4509a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6a7d40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push 0
push 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 8]
mov dword [ebp - 0xc], 0
push edx
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov dword [ebp - 0x14], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [0x6a89a0]
mov esi, eax
mov ecx, dword [0x6a89a4]
cmp edx, 0x257edfd1
jne 0x450a02
cmp ecx, 0xb2ab117a
je 0x450a12
cmp edx, 0x257edfd0
jne 0x450a19
cmp ecx, 0xb2ab117a
jne 0x450a19
test esi, esi
setne al
jmp 0x450a29
mov eax, dword [0x6a8998]
mov ecx, 0x6a8998
push esi
mov eax, dword [eax + 0x18]
call eax
movzx ecx, al
mov ebx, 0x1ffff7
mov dword [edi], esi
mov dword [edi + 4], 0x6a8998
mov dword [ebp - 0x10], ebx
lea eax, [ecx + 2]
mov dword [edi + 8], eax
cmp ecx, 0xffffffff
je 0x450a51
mov eax, esi
mov ebx, 0x6a8998
jmp 0x450a65
xor edx, edx
mov eax, 0x6a8998
div ebx
mov ebx, dword [edi + 4]
imul eax, edx, 0x3e8
add eax, esi
cmp eax, 0x40
jne 0x450abc
mov ecx, dword [0x6a89a0]
mov eax, dword [0x6a89a4]
cmp ecx, 0x257edfd1
jne 0x450a84
cmp eax, 0xb2ab117a
je 0x450a93
cmp ecx, 0x257edfd0
jne 0x450aa0
cmp eax, 0xb2ab117a
jne 0x450aa0
mov al, 1
mov dword [edi], 0x2746
jmp 0x450b22
mov eax, dword [0x6a8998]
mov ecx, 0x6a8998
push 0x2746
mov eax, dword [eax + 0x18]
call eax
mov dword [edi], 0x2746
jmp 0x450b22
cmp ecx, 0xffffffff
je 0x450ac5
mov eax, esi
jmp 0x450ad4
xor edx, edx
mov eax, ebx
div dword [ebp - 0x10]
imul eax, edx, 0x3e8
add eax, esi
cmp eax, 0x4d2
jne 0x450b34
mov ecx, dword [0x6a89a0]
mov eax, dword [0x6a89a4]
cmp ecx, 0x257edfd1
jne 0x450af5
cmp eax, 0xb2ab117a
je 0x450b04
cmp ecx, 0x257edfd0
jne 0x450b08
cmp eax, 0xb2ab117a
jne 0x450b08
mov al, 1
jmp 0x450b1c
mov eax, dword [0x6a8998]
mov ecx, 0x6a8998
push 0x274d
mov eax, dword [eax + 0x18]
call eax
mov dword [edi], 0x274d
movzx eax, al
add eax, 2
mov dword [edi + 4], 0x6a8998
mov dword [edi + 8], eax
jmp 0x450b73
cmp ecx, 0xffffffff
je 0x450b3d
mov eax, esi
jmp 0x450b4c
xor edx, edx
mov eax, ebx
div dword [ebp - 0x10]
imul eax, edx, 0x3e8
add eax, esi
cmp eax, 0x2738
je 0x450b8d
cmp ecx, 0xffffffff
jne 0x450b6b
xor edx, edx
mov eax, ebx
mov ecx, 0x1ffff7
div ecx
imul eax, edx, 0x3e8
add esi, eax
cmp esi, 0xea
je 0x450b8d
cmp dword [ebp - 0x14], 0
je 0x450b8d
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005df387
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xorps xmm0, xmm0
mov eax, dword [ebp - 8]
xor ecx, ebp
movq qword [edi], xmm0
mov dword [edi + 8], 0
pop edi
pop esi
pop ebx
call fcn.005df387
mov esp, ebp
pop ebp
ret
Function at 0x450eb0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x6a7d40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 8]
push edi
push 0
push 0
push 0
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0
push edx
push ecx
call dword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [0x6a89a0]
mov edi, eax
mov ecx, dword [0x6a89a4]
cmp edx, 0x257edfd1
jne 0x450f08
cmp ecx, 0xb2ab117a
je 0x450f18
cmp edx, 0x257edfd0
jne 0x450f1f
cmp ecx, 0xb2ab117a
jne 0x450f1f
test edi, edi
setne al
jmp 0x450f2f
mov eax, dword [0x6a8998]
mov ecx, 0x6a8998
push edi
mov eax, dword [eax + 0x18]
call eax
movzx ecx, al
mov dword [esi], edi
mov dword [esi + 4], 0x6a8998
mov dword [ebp - 0xc], 0x1ffff7
lea eax, [ecx + 2]
mov dword [esi + 8], eax
cmp ecx, 0xffffffff
je 0x450f56
mov eax, edi
mov edx, 0x6a8998
jmp 0x450f6b
xor edx, edx
mov eax, 0x6a8998
div dword [ebp - 0xc]
imul eax, edx, 0x3e8
mov edx, dword [esi + 4]
add eax, edi
cmp eax, 0x40
jne 0x450fc2
mov ecx, dword [0x6a89a0]
mov eax, dword [0x6a89a4]
cmp ecx, 0x257edfd1
jne 0x450f8a
cmp eax, 0xb2ab117a
je 0x450f99
cmp ecx, 0x257edfd0
jne 0x450fa6
cmp eax, 0xb2ab117a
jne 0x450fa6
mov al, 1
mov dword [esi], 0x2746
jmp 0x451029
mov eax, dword [0x6a8998]
mov ecx, 0x6a8998
push 0x2746
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x2746
jmp 0x451029
cmp ecx, 0xffffffff
jne 0x450fda
mov eax, edx
mov ecx, 0x1ffff7
xor edx, edx
div ecx
imul eax, edx, 0x3e8
add edi, eax
cmp edi, 0x4d2
jne 0x451039
mov ecx, dword [0x6a89a0]
mov eax, dword [0x6a89a4]
cmp ecx, 0x257edfd1
jne 0x450ffc
cmp eax, 0xb2ab117a
je 0x45100b
cmp ecx, 0x257edfd0
jne 0x45100f
cmp eax, 0xb2ab117a
jne 0x45100f
mov al, 1
jmp 0x451023
mov eax, dword [0x6a8998]
mov ecx, 0x6a8998
push 0x274d
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x274d
movzx eax, al
add eax, 2
mov dword [esi + 4], 0x6a8998
mov dword [esi + 8], eax
test ebx, ebx
je 0x451051
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005df387
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xorps xmm0, xmm0
mov eax, dword [ebp - 8]
xor ecx, ebp
movq qword [esi], xmm0
pop edi
mov dword [esi + 8], 0
pop esi
pop ebx
call fcn.005df387
mov esp, ebp
pop ebp
ret
Function at 0x455b50
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x6a7d40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x34], 0
je 0x455c0f
cmp dword [ebp + 8], 0
jne 0x455c1f
mov ecx, dword [esi + 0x30]
push edi
call fcn.0044f990
mov edi, dword [esi + 0x34]
push 0xffffffffffffffff
push 0
mov eax, dword [edi + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, 0x6ac094
lock xadd dword [ecx], eax
mov ecx, dword [edi + 4]
push 0
push ecx
test eax, eax
je 0x455bc5
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x455bdb
push method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_56
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [esi + 0x34]
test edi, edi
je 0x455bf6
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc
push edi
call fcn.005dfa12
add esp, 8
pop edi
mov dword [esi + 0x34], 0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005df387
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp + 8], 0
je 0x455c1f
mov eax, dword [esi + 0x30]
xor ecx, ecx
add eax, 0x1c
xchg dword [eax], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005df387
mov esp, ebp
pop ebp
ret 4