joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b600
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4785e8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4a0008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.boost::exception_detail::clone_base.0
mov ebx, dword [ebp + 8]
lea eax, [edi + 8]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [edi + 4], vtable.std::exception.0
push eax
movq qword [eax], xmm0
lea eax, [ebx + 8]
push eax
call dword [sym.imp.VCRUNTIME140.dll___std_exception_copy]
mov dword [edi + 4], vtable.boost::system::system_error.0
add esp, 8
movq xmm0, qword [ebx + 0x10]
movq qword [edi + 0x10], xmm0
mov eax, dword [ebx + 0x18]
mov dword [edi + 0x18], eax
mov dword [edi + 4], vtable.boost::thread_resource_error.0
lea esi, [edi + 0x1c]
mov byte [ebp - 4], 1
mov dword [esi], vtable.boost::exception.0
mov ecx, dword [ebx + 0x20]
mov dword [ebp + 8], esi
mov dword [esi + 4], ecx
test ecx, ecx
je 0x40b697
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [ebx + 0x24]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0x28]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x2c]
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 0x30]
mov dword [esi + 0x14], eax
mov eax, edi
mov dword [edi], vtable.boost::wrapexcept_class_boost::thread_resource_error_.0
mov dword [edi + 4], vtable.boost::wrapexcept_class_boost::thread_resource_error_.1.0
mov dword [esi], vtable.boost::wrapexcept_class_boost::thread_resource_error_.2.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x438c90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x438cbc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x438ce4
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x438cea
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x438d52
jg 0x438d01
test esi, esi
je 0x438d52
test ecx, ecx
jl 0x438d4d
jg 0x438d0b
test eax, eax
je 0x438d4d
cmp edi, ecx
jg 0x438d1f
jl 0x438d15
cmp esi, eax
jae 0x438d1f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x438d55
mov ecx, dword [ebp + 8]
jmp 0x438d5f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x438d79
jg 0x438d5f
test esi, esi
je 0x438d79
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x438d79
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x438d90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x438dbc
jl 0x438db0
test ecx, ecx
jne 0x438dbc
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x438dd5
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x438e23
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x438e29
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x438e29
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x438e96
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x438e52
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x438e84
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x438e96
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x438e60
test edi, edi
je 0x438e96
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x439220
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4a0008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x439250
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044f64d
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x439280
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x439280
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044f64d
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x439358
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x4392a9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4392b5
movsx eax, bl
jmp 0x4392ed
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x439317
sub eax, 1
je 0x439317
sub eax, 2
jne 0x439358
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044f64d
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x439335
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x439358
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044f64d
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f64d
mov esp, ebp
pop ebp
ret 4
Function at 0x439840
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4a0008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4398fc
cmp byte [esi + 0x3d], 0
je 0x4398fc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4398ea
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x4398b1
sub eax, 1
je 0x4398b5
sub eax, 2
jne 0x4398ea
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044f64d
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4398d3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4398ea
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044f64d
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044f64d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0044f64d
mov esp, ebp
pop ebp
ret

Function at 0x43b610
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push esi
xor esi, esi
mov eax, esi
mov bl, 8
shl eax, 0x18
nop dword [eax + eax]
lea edx, [eax + eax]
mov ecx, edx
xor ecx, 0x4c11db7
test eax, eax
cmovns ecx, edx
mov eax, ecx
add bl, 0xff
jne 0x43b620
mov dword [esi*4 + 0x4a4580], eax
inc esi
cmp esi, 0x100
jl 0x43b614
pop esi
pop ebx
ret
Function at 0x445530
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47dc7e
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4a0008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x38], esi
lea ecx, [esi + 4]
xorps xmm0, xmm0
lea edi, [esi + 0x20]
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.InterpreteMsgFlashCodice.0
movups xmmword [esi + 0x30], xmm0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0xf
mov byte [esi + 0x30], 0
push 0xc
push str.FLASH_CODICE
mov byte [ebp - 4], 1
call fcn.004028e0
push 0x74
mov byte [esi + 0x2c], 0
call fcn.0044f669
mov esi, eax
mov dword [ebp - 0x2c], esi
push 0x74
push 0
push esi
mov byte [ebp - 4], 2
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.0043d2e0
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
xorps xmm0, xmm0
mov esi, eax
mov dword [ebp - 0x2c], esi
push 6
movups xmmword [ecx], xmm0
push str.SCRIVI
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00402b90
mov ecx, esi
call fcn.0043d670
push 0
mov ecx, esi
call fcn.0043d700
mov eax, dword [edi + 4]
cmp eax, dword [edi + 8]
je 0x44563f
mov dword [eax], esi
add dword [edi + 4], 4
jmp 0x44564b
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov ecx, edi
call fcn.00402a20
push 0x74
call fcn.0044f669
mov esi, eax
mov dword [ebp - 0x30], esi
push 0x74
push 0
push esi
mov byte [ebp - 4], 3
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.0043d2e0
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
xorps xmm0, xmm0
mov esi, eax
mov dword [ebp - 0x2c], esi
push 6
movups xmmword [ecx], xmm0
push str.VALORE
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00402b90
mov ecx, esi
call fcn.0043d670
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push 0x486b58
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
call fcn.00402b90
sub esp, 0x18
mov byte [ebp - 4], 4
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00402e90
mov ecx, esi
call fcn.0043d7b0
mov eax, dword [edi + 4]
cmp eax, dword [edi + 8]
je 0x4456f1
mov dword [eax], esi
add dword [edi + 4], 4
jmp 0x4456fd
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov ecx, edi
call fcn.00402a20
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x445733
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x445729
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x445729
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0044f65b
add esp, 8
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f64d
mov esp, ebp
pop ebp
ret
Function at 0x44eb20
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x80408], 2
jne 0x44ecbb
push ebx
push edi
mov edi, dword [esi + 0x80414]
lea ebx, [esi + 0x801f8]
mov dword [esi + 0x802fc], 0
mov dword [ebx], 0
cmp edi, dword [esi + 0x80410]
jae 0x44eb9b
xor edx, edx
nop dword [eax + eax]
mov eax, dword [esi + 0x8040c]
add eax, edi
mov al, byte [eax + edx]
mov byte [esi + edx + 0x401e4], al
inc edx
mov edi, dword [esi + 0x80414]
lea eax, [edi + edx]
cmp eax, dword [esi + 0x80410]
sbb ecx, ecx
xor eax, eax
neg ecx
cmp edx, 0x40000
setl al
test eax, ecx
jne 0x44eb60
mov dword [esi + 0x801e8], edx
cmp dword [esi + 0x801e8], 0
jle 0x44ec96
mov edx, dword [ebx]
xor ecx, ecx
test edx, edx
je 0x44ebcc
mov edi, dword [esi + 0x801e4]
lea eax, [esi + 0x801fc]
nop dword [eax]
cmp dword [eax], edi
je 0x44ebcc
inc ecx
add eax, 4
cmp ecx, edx
jb 0x44ebc0
cmp ecx, edx
jne 0x44ebe4
cmp edx, 0x40
jae 0x44ebe4
mov eax, dword [esi + 0x801e4]
mov dword [esi + ecx*4 + 0x801fc], eax
inc dword [ebx]
lea eax, [esi + 0x80400]
push eax
push 0
push ebx
lea eax, [esi + 0x802fc]
push eax
push 0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x44ec22
push 6
push str.select
lea ecx, [esi + 0x194]
call fcn.004028e0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x1ac], eax
jmp 0x44ec96
test eax, eax
jle 0x44ec96
push ebx
push dword [esi + 0x801e4]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x44ec96
push 0
push dword [esi + 0x801e8]
lea eax, [esi + 0x401e4]
push eax
push dword [esi + 0x801e4]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44ec84
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
cmp eax, 0x2733
je 0x44ec84
push 4
push str.send
lea ecx, [esi + 0x194]
call fcn.004028e0
call ebx
mov dword [esi + 0x1ac], eax
jmp 0x44ec96
add dword [esi + 0x801f0], edi
sub dword [esi + 0x801e8], edi
add dword [esi + 0x80414], edi
mov eax, dword [esi + 0x80414]
pop edi
pop ebx
cmp eax, dword [esi + 0x80410]
jne 0x44ecb4
mov dword [esi + 0x80408], 3
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret
or eax, 0xffffffff
pop esi
ret
Function at 0x44ed80
Capabilities:
Convert ip address from string
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d41d
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4a0008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
lea edi, [esi + 0x1cc]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
mov eax, 2
cmovae ecx, dword [ebp + 8]
mov word [edi], ax
lea eax, [esi + 0x1d0]
push eax
push ecx
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
push dword [ebp + 0x20]
call dword [sym.imp.WS2_32.dll_htons]
push 6
push 1
push 2
mov word [esi + 0x1ce], ax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x1dc], eax
cmp eax, 0xffffffff
jne 0x44ee24
push 6
push str.socket
lea ecx, [esi + 0x194]
call fcn.004028e0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x1ac], eax
or edi, 0xffffffff
jmp 0x44eed4
push 0x10
push edi
push eax
call dword [sym.imp.WS2_32.dll_bind]
mov edi, eax
test edi, edi
je 0x44ee3d
push 4
push str.bind
jmp 0x44ee58
push 1
push dword [esi + 0x1dc]
call dword [sym.imp.WS2_32.dll_listen]
mov edi, eax
test edi, edi
je 0x44ee71
push 6
push str.listen
lea ecx, [esi + 0x194]
call fcn.004028e0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x1ac], eax
jmp 0x44eed4
lea eax, [esi + 0x1e0]
mov dword [eax], 1
push eax
push 0x8004667e
push dword [esi + 0x1dc]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x44eea0
push 0xb
push str.ioctlsocket
jmp 0x44ee05
mov eax, dword [esi + 0x1dc]
mov dword [esi + 0x801e4], eax
mov dword [esi + 0x801f4], 0
mov dword [esi + 0x801f0], 0
mov dword [esi + 0x801ec], 0
mov dword [esi + 0x801e8], 0
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x44ef0a
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44ef00
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x44ef00
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0044f65b
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x44ef20
Capabilities:
Get socket status
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4a0008]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], eax
push edi
xor edi, edi
lea edx, [esi + 0x801f8]
mov dword [edx], edi
lea ecx, [esi + 0x802fc]
mov eax, dword [esi + 0x1dc]
mov dword [esi + 0x80300], eax
lea eax, [esi + 0x80400]
push eax
push edi
push edx
push ecx
push edi
mov dword [ecx], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x44ef7f
push 6
push str.select
jmp 0x44f0bb
lea eax, [esi + 0x802fc]
mov ebx, 1
push eax
push dword [esi + 0x1dc]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x44f0d5
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x10
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 0x1dc]
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
je 0x44f0a7
push 0x80424
call fcn.0044f669
push 0x80424
mov edi, eax
push 0
push edi
mov dword [ebp - 0x28], edi
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
add esp, 0x10
movups xmmword [edi + 0x194], xmm0
mov dword [edi + 0x1a4], 0
mov eax, 0x202
mov dword [edi + 0x1a8], 0xf
mov byte [edi + 0x194], 0
movups xmmword [edi + 0x1b0], xmm0
mov dword [edi + 0x1c0], 0
mov dword [edi + 0x1c4], 0xf
mov byte [edi + 0x1b0], 0
mov dword [edi + 0x8040c], 0
mov dword [edi + 0x80418], 0
mov word [edi], ax
lea eax, [edi + 4]
push eax
push 0x202
mov dword [edi + 0x80408], 3
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov eax, dword [ebp - 0x20]
xor ebx, ebx
mov dword [edi + 0x1dc], eax
mov dword [edi + 0x801e4], eax
mov dword [edi + 0x801f4], 0
mov dword [edi + 0x801f0], 0
mov dword [edi + 0x801ec], 0
mov dword [edi + 0x801e8], 0
movups xmm0, xmmword [ebp - 0x1c]
movups xmmword [edi + 0x1cc], xmm0
jmp 0x44f0d5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x44f0d5
push 6
push str.accept
lea ecx, [esi + 0x194]
call fcn.004028e0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
or ebx, 0xffffffff
mov dword [esi + 0x1ac], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
xor ecx, ebp
mov dword [eax], edi
mov eax, ebx
pop edi
pop esi
pop ebx
call fcn.0044f64d
mov esp, ebp
pop ebp
ret 4

Function at 0x450439
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x450478
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x450478
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x450478
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x450478
cmp dword [ecx + 0x74], 0xe
jbe 0x450478
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x458300
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47f448
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4a0008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx], vtable.boost::exception_detail::clone_base.0
mov edi, dword [ebp + 8]
lea ecx, [ebx + 4]
mov dword [ebp - 4], 0
lea eax, [edi + 4]
push eax
call fcn.0046cb60
lea esi, [ebx + 0x20]
mov byte [ebp - 4], 1
mov dword [esi], vtable.boost::exception.0
mov ecx, dword [edi + 0x24]
mov dword [ebp + 8], esi
mov dword [esi + 4], ecx
test ecx, ecx
je 0x458366
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x28]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x14], eax
mov eax, ebx
mov dword [ebx], vtable.boost::wrapexcept_class_boost::filesystem::filesystem_error_.0
mov dword [ebx + 4], vtable.boost::wrapexcept_class_boost::filesystem::filesystem_error_.1.0
mov dword [esi], vtable.boost::wrapexcept_class_boost::filesystem::filesystem_error_.2.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4583b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47f47d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a0008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.boost::exception_detail::clone_base.0
push dword [ebp + 8]
lea ecx, [edi + 4]
mov dword [ebp - 4], 0
call fcn.0046cb60
mov ecx, dword [ebp + 0xc]
mov dword [edi + 0x20], vtable.boost::exception.0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xffffffff
mov dword [edi + 0x34], 0xffffffff
mov dword [edi], vtable.boost::wrapexcept_class_boost::filesystem::filesystem_error_.0
mov dword [edi + 4], vtable.boost::wrapexcept_class_boost::filesystem::filesystem_error_.1.0
mov dword [edi + 0x20], vtable.boost::wrapexcept_class_boost::filesystem::filesystem_error_.2.0
mov eax, dword [ecx]
mov dword [edi + 0x2c], eax
mov eax, dword [ecx + 8]
mov dword [edi + 0x30], eax
mov eax, dword [ecx + 4]
mov dword [edi + 0x28], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0x34], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x45a9e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478910
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x4a0008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test byte [esi + 0x3c], 1
je 0x45aa3e
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x45aa1e
mov eax, dword [esi + 0x30]
mov eax, dword [eax]
lea ecx, [ecx + eax*2]
jmp 0x45aa2b
mov eax, dword [esi + 0x2c]
mov ecx, dword [eax]
mov eax, dword [esi + 0x1c]
mov eax, dword [eax]
lea ecx, [eax + ecx*2]
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
sub ecx, eax
sar ecx, 1
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.0040b210
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov dword [eax], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
and dword [esi + 0x3c], 0xfffffffe
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret