joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481b10
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
jmp 0x481b10
sub esp, 0x2c
mov eax, dword [0x4d31c4]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
mov ebp, dword [esp + 0x44]
push edi
or edi, 0xffffffff
or ebx, edi
cmp dword [esp + 0x44], 0
jne 0x481d0a
mov eax, dword [esp + 0x3c]
cmp eax, 2
je 0x481b47
cmp eax, 1
jne 0x481d0a
test ebp, ebp
jne 0x481b6b
push 0x2726
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004634b5
add esp, 0x2c
ret
push esi
push 0
push dword [esp + 0x48]
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
js 0x481cf4
xorps xmm0, xmm0
mov eax, 2
movups xmmword [esp + 0x18], xmm0
push 0x7f000001
mov word [esp + 0x1c], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x1c], eax
xor eax, eax
mov word [esp + 0x1a], ax
lea eax, [esp + 0x18]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x481cc2
push 1
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x481cc2
push 0
push dword [esp + 0x48]
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
test edi, edi
js 0x481cc2
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x10
push eax
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x481cc2
cmp dword [esp + 0x10], 0x10
jne 0x481cb8
push 0x10
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x481cc2
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x10
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov ebx, eax
test ebx, ebx
js 0x481cc2
cmp dword [esp + 0x10], 0x10
jne 0x481cb8
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x481cc2
cmp dword [esp + 0x10], 0x10
jne 0x481cb8
mov ax, word [esp + 0x18]
cmp ax, word [esp + 0x28]
jne 0x481cb8
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x2c]
jne 0x481cb8
mov ax, word [esp + 0x1a]
cmp ax, word [esp + 0x2a]
jne 0x481cb8
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
mov dword [ebp], edi
xor eax, eax
pop edi
mov dword [ebp + 4], ebx
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004634b5
add esp, 0x2c
ret
mov dword [esp + 0x14], 0x2745
jmp 0x481ccc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 0x14], eax
mov ebp, dword [sym.imp.WS2_32.dll_closesocket]
cmp esi, 0xffffffff
je 0x481cda
push esi
call ebp
cmp edi, 0xffffffff
je 0x481ce2
push edi
call ebp
cmp ebx, 0xffffffff
je 0x481cea
push ebx
call ebp
push dword [esp + 0x14]
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop esi
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004634b5
add esp, 0x2c
ret
push 0x273f
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [esp + 0x34]
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004634b5
add esp, 0x2c
ret
Function at 0x482a60
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
push esi
mov esi, dword [sym.imp.WS2_32.dll_getaddrinfo]
lea eax, [esp + 8]
push edi
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0
push eax
xorps xmm0, xmm0
mov dword [esp + 0x10], 0
push 0x4d3b48
movaps xmmword [esp + 0x1c], xmm0
push 0x4d3b4c
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0xc
call esi
mov edi, eax
mov dword [esp + 0x18], 1
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
push 0x4d3b54
push str.1.2.3.4
call esi
mov edx, 1
test eax, eax
jne 0x482aec
mov eax, dword [0x4e8584]
test edi, edi
cmovne eax, edx
mov dword [0x4e8584], eax
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x482b05
mov eax, dword [0x4e8588]
cmp dword [ecx + 0xc], 0
cmove eax, edx
mov dword [0x4e8588], eax
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.WS2_32.dll_freeaddrinfo]
test eax, eax
je 0x482b1a
push eax
call esi
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x482b21
push ecx
call esi
pop edi
mov dword [0x4e858c], 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48d440
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x6e4
mov eax, dword [0x4d31c4]
xor eax, esp
mov dword [esp + 0x6e0], eax
push esi
mov esi, dword [esp + 0x6ec]
mov dword [esp + 4], 0x80
mov eax, dword [esi + 0x134]
cmp dword [eax + 0xf0], 0
je 0x48d498
call fcn.00498750
test eax, eax
je 0x48d498
mov eax, dword [esi + 0x134]
push dword [eax + 0xf0]
call fcn.004987f0
add esp, 4
test eax, eax
je 0x48d589
push ebx
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_recvfrom]
lea eax, [esp + 0xc]
push edi
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0x5dc
lea eax, [esp + 0x124]
push eax
push dword [esi]
call ebp
mov edi, eax
test edi, edi
js 0x48d51f
lea ebx, [esi + 8]
push 0
lea eax, [esp + 0x18]
push ebx
push eax
call fcn.004811e0
add esp, 0xc
test eax, eax
jne 0x48d560
mov dword [esi + 0x90], eax
lea eax, [esp + 0x114]
push edi
push eax
push dword [esi + 0x134]
call fcn.0048c8a0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0x5dc
lea eax, [esp + 0x124]
push eax
push dword [esi]
call ebp
mov edi, eax
test edi, edi
jns 0x48d4c7
push dword [esi]
call fcn.004806c0
add esp, 4
cmp eax, 0x2733
je 0x48d547
cmp eax, 0x2714
je 0x48d547
push eax
call fcn.00480720
push eax
push esi
call fcn.0048bc60
add esp, 0xc
mov ecx, dword [esp + 0x6f0]
pop edi
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.004634b5
add esp, 0x6e4
ret
push 0x80
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004822f0
push eax
push str.Address_mismatch_on_received_DNS_packet.__Apparent_source_was__s
push 1
call fcn.0048b8c0
add esp, 0x18
jmp 0x48d547
push 0x4db614
push 0x4db688
push 0x552
push 0x4db6c0
push 0x4db6c8
push 0xdeaddead
call fcn.004973e0
add esp, 0x18
push str.nameserver_read
push str._evthread_is_debug_lock_held__ns__base___lock_
push 0x552
push 0x4db7b0
push 0x4db7b8
push 2
call fcn.0046857e
add esp, 4
push eax
call fcn.004040c0
add esp, 0x18
call fcn.00476c0e
int3
Function at 0x48da60
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x64], 0
mov esi, dword [edi + 0x5c]
je 0x48da8b
call fcn.00498750
test eax, eax
je 0x48da8b
push dword [edi + 0x64]
call fcn.004987f0
add esp, 4
test eax, eax
je 0x48db44
push ebx
test esi, esi
je 0x48db06
mov ebx, dword [sym.imp.WS2_32.dll_sendto]
push dword [esi + 0x90]
lea eax, [esi + 0x10]
push eax
push 0
push dword [esi + 0xb0]
push dword [esi + 0xac]
push dword [edi]
call ebx
test eax, eax
jns 0x48dae8
push dword [edi]
call fcn.004806c0
add esp, 4
cmp eax, 0x2733
je 0x48db40
cmp eax, 0x2714
je 0x48db40
push eax
push eax
call fcn.00480720
add esp, 4
push eax
push str.Error__s___d__while_writing_response_to_port__dropping
push 1
call fcn.0048b8c0
add esp, 0x10
push esi
call fcn.0048ae80
add esp, 4
test eax, eax
jne 0x48db40
mov eax, dword [edi + 0x5c]
cmp esi, eax
je 0x48db9b
mov esi, eax
test esi, esi
jne 0x48da96
lea esi, [edi + 0x14]
push esi
call fcn.00484530
push edi
push 0x48b150
push 0x12
push dword [edi]
push dword [edi + 0x60]
push esi
call fcn.00483fd0
push 0
push esi
call fcn.004844c0
add esp, 0x24
test eax, eax
jns 0x48db40
push str.Error_from_libevent_when_adding_event_for_DNS_server.
push 1
call fcn.0048b8c0
add esp, 8
pop ebx
pop edi
pop esi
ret
push 0x4dbbe4
push 0x4dbbf8
push 0x58f
push 0x4dbc24
push 0x4dbc2c
push 0xdeaddead
call fcn.004973e0
add esp, 0x18
push 0x4dbc50
push str._evthread_is_debug_lock_held__port___lock_
push 0x58f
push 0x4dbc90
push 0x4dbc98
push 2
call fcn.0046857e
add esp, 4
push eax
call fcn.004040c0
add esp, 0x18
call fcn.00476c0e
push 0x4dbcf4
push 0x4dbd24
push 0x59d
push 0x4dbd70
push 0x4dbd80
push 0xdeaddead
call fcn.004973e0
add esp, 0x18
push str.server_port_flush
push str.req___port__pending_replies
push 0x59d
push str.evdns.c
push 0x4d7170
push 2
call fcn.0046857e
add esp, 4
push eax
call fcn.004040c0
add esp, 0x18
call fcn.00476c0e
int3
Function at 0x48e580
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x7c]
cmp dword [eax + 0xf0], 0
je 0x48e5b3
call fcn.00498750
test eax, eax
je 0x48e5b3
mov eax, dword [esi + 0x7c]
push dword [eax + 0xf0]
call fcn.004987f0
add esp, 4
test eax, eax
je 0x48e66b
mov eax, dword [esi + 0x80]
test eax, eax
je 0x48e62a
cmp dword [eax], esi
jne 0x48e62a
push edi
mov edi, dword [esp + 0x10]
push dword [edi + 0x88]
lea eax, [edi + 8]
push eax
push 0
push dword [esi + 8]
push dword [esi]
push dword [edi]
call dword [sym.imp.WS2_32.dll_sendto]
mov ecx, eax
test ecx, ecx
jns 0x48e61f
push dword [edi]
call fcn.004806c0
add esp, 4
cmp eax, 0x2733
je 0x48e617
cmp eax, 0x2714
je 0x48e617
push eax
call fcn.00480720
push eax
push dword [esi + 0x1c]
call fcn.0048bc60
add esp, 0xc
mov eax, 2
pop edi
pop esi
ret
pop edi
mov eax, 1
pop esi
ret
xor eax, eax
cmp ecx, dword [esi + 8]
pop edi
setne al
pop esi
ret
push 0x4da570
push 0x4da58c
push 0x891
push 0x4da5c4
push 0x4da5cc
push 0xdeaddead
call fcn.004973e0
add esp, 0x18
push str.evdns_request_transmit_to
push 0x4da60c
push 0x891
push 0x4da644
push 0x4da64c
jmp 0x48e6aa
push 0x4da398
push 0x4da3b4
push 0x890
push 0x4da400
push 0x4da434
push 0xdeaddead
call fcn.004973e0
add esp, 0x18
push 0x4da460
push 0x4da4a0
push 0x890
push 0x4da4ec
push 0x4da520
push 2
call fcn.0046857e
add esp, 4
push eax
call fcn.004040c0
add esp, 0x18
call fcn.00476c0e
int3
Function at 0x491ca0
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
sub esp, 0x50
mov eax, dword [0x4d31c4]
xor eax, esp
mov dword [esp + 0x4c], eax
push esi
push edi
mov edi, dword [esp + 0x5c]
mov eax, dword [edi + 0x18]
test eax, eax
je 0x491cc6
push eax
push 0
call fcn.00498780
add esp, 8
test byte [edi + 0x1c], 4
je 0x491cd4
or esi, 0xffffffff
jmp 0x491e23
push ebx
mov ebx, dword [esp + 0x64]
lea eax, [esp + 0xc]
push eax
push 0x4004667f
push ebx
mov dword [esp + 0x18], 0x1000
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
js 0x491d05
mov eax, dword [esp + 0xc]
test eax, eax
jle 0x491d05
cmp eax, 0x1000
jle 0x491d0a
mov eax, 0x1000
mov esi, dword [esp + 0x68]
test esi, esi
js 0x491d16
cmp esi, eax
jle 0x491d18
mov esi, eax
push 4
push esi
push edi
call fcn.004930c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x491d30
or esi, eax
jmp 0x491e22
push ebp
push 1
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x28]
push eax
push esi
push edi
call fcn.004934e0
mov ebp, eax
add esp, 0x18
xor ecx, ecx
test ebp, ebp
jle 0x491d66
mov eax, dword [esp + ecx*8 + 0x1c]
mov dword [esp + ecx*8 + 0x40], eax
mov eax, dword [esp + ecx*8 + 0x20]
mov dword [esp + ecx*8 + 0x3c], eax
inc ecx
cmp ecx, ebp
jl 0x491d51
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x20]
push eax
push ebp
lea eax, [esp + 0x50]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x491da2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2745
je 0x491db3
or esi, 0xffffffff
jmp 0x491e21
mov esi, dword [esp + 0x14]
cmp esi, 0xffffffff
jne 0x491daf
or esi, esi
jmp 0x491e21
test esi, esi
jne 0x491db7
xor esi, esi
jmp 0x491e21
mov dword [esp + 0x10], 0
mov ebx, esi
test ebp, ebp
jle 0x491e12
mov edx, dword [esp + 0x18]
mov dword [esp + 0x14], closesocket
mov ecx, dword [edx]
test byte [ecx + 0x10], 8
je 0x491ddd
xor eax, eax
jmp 0x491df0
mov eax, dword [ecx + 4]
sub eax, dword [ecx + 0xc]
sub eax, dword [ecx + 8]
cmp eax, 0x7fffffff
cmova eax, dword [esp + 0x14]
cmp eax, ebx
jge 0x491e0a
add dword [ecx + 0xc], eax
sub ebx, eax
mov eax, dword [esp + 0x10]
mov edx, dword [edx]
inc eax
mov dword [esp + 0x10], eax
cmp eax, ebp
jl 0x491dd1
jmp 0x491e12
mov eax, ecx
add dword [eax + 0xc], ebx
mov dword [edi + 8], edx
add dword [edi + 0xc], esi
add dword [edi + 0x10], esi
push edi
call fcn.00493640
add esp, 4
pop ebp
pop ebx
mov eax, dword [edi + 0x18]
test eax, eax
je 0x491e35
push eax
push 0
call fcn.00498790
add esp, 8
mov ecx, dword [esp + 0x54]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.004634b5
add esp, 0x50
ret
Function at 0x494d50
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x4d31c4]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
mov ebx, dword [esp + 0x98]
push ebp
mov ebp, dword [esp + 0x94]
push esi
push edi
xor edi, edi
mov esi, dword [ebp]
test ebx, ebx
jns 0x494d87
or eax, 0xffffffff
jmp 0x494e13
cmp dword [ebp + 0x18], edi
je 0x494da8
call fcn.00498750
test eax, eax
je 0x494da8
push dword [ebp + 0x18]
call fcn.004987f0
add esp, 4
test eax, eax
je 0x494e2c
test esi, esi
je 0x494e11
nop dword [eax]
cmp edi, 0x10
jge 0x494ddf
test ebx, ebx
je 0x494ddf
mov eax, dword [esi + 0x14]
add eax, dword [esi + 8]
mov dword [esp + edi*8 + 0x18], eax
mov eax, dword [esi + 0xc]
cmp ebx, eax
jb 0x494dda
mov dword [esp + edi*8 + 0x14], eax
inc edi
sub ebx, dword [esi + 0xc]
mov esi, dword [esi]
test esi, esi
jne 0x494db0
jmp 0x494ddf
mov dword [esp + edi*8 + 0x14], ebx
inc edi
test edi, edi
je 0x494e11
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push edi
lea eax, [esp + 0x28]
push eax
push dword [esp + 0xb8]
call dword [sym.imp.WS2_32.dll_WSASend]
mov ecx, dword [esp + 0x10]
or edx, 0xffffffff
test eax, eax
cmovne ecx, edx
mov eax, ecx
jmp 0x494e13
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004634b5
add esp, 0x88
ret
push 0x4ddd30
push 0x4ddd60
push 0x8e9
push 0x4dddb0
push 0x4dddc8
push 0xdeaddead
call fcn.004973e0
add esp, 0x18
push str.evbuffer_write_iovec
push 0x4dde28
push 0x8e9
push 0x4dde58
push 0x4dde64
push 2
call fcn.0046857e
add esp, 4
push eax
call fcn.004040c0
add esp, 0x18
call fcn.00476c0e
int3

Function at 0x497580
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x4e85d8]
test eax, eax
je 0x49759b
push dword [esp + 4]
call eax
add esp, 4
push dword [esp + 4]
call fcn.00473047
mov eax, dword [esp + 4]
cmp eax, 0xdeaddead
je fcn.00476c0e
push eax
call fcn.00473047
int3

Function at 0x499160
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov al, byte [0x4e8a68]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
dec al
push esi
push edi
xor edi, edi
inc al
mov cl, byte [0x4e8a69]
mov byte [0x4e8a68], al
movzx esi, al
mov eax, edi
cdq
inc edi
idiv ebp
mov eax, dword [esp + 0x14]
mov bl, byte [esi + 0x4e8a6a]
movzx eax, byte [edx + eax]
add al, bl
add cl, al
movzx eax, cl
mov byte [0x4e8a69], cl
movzx eax, byte [eax + 0x4e8a6a]
mov byte [esi + 0x4e8a6a], al
movzx eax, byte [0x4e8a69]
mov byte [eax + 0x4e8a6a], bl
mov al, byte [0x4e8a68]
cmp edi, 0x100
jl 0x499171
pop edi
pop esi
pop ebp
mov byte [0x4e8a69], al
pop ebx
ret
Function at 0x4991e0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub esp, 0x24
mov eax, dword [0x4d31c4]
xor eax, esp
mov dword [esp + 0x20], eax
cmp dword [0x4e8a58], 0
jne 0x49923a
push 0xf0000000
push 1
push 0
push 0
push 0x4e8b74
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x499230
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
je 0x499230
or eax, 0xffffffff
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004634b5
add esp, 0x24
ret
mov dword [0x4e8a58], 1
lea eax, [esp]
push eax
push 0x20
push dword [0x4e8b74]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x49921e
lea eax, [esp]
push 0x20
push eax
call fcn.00499160
lea eax, [esp + 8]
push 0x20
push eax
call fcn.00482620
mov ecx, dword [esp + 0x30]
add esp, 0x10
xor ecx, esp
mov dword [0x4e8b70], 1
xor eax, eax
call fcn.004634b5
add esp, 0x24
ret

Function at 0x49acd1
Capabilities:
Create thread

Disassembly:
cmp dword [0x4e8b78], 0
jne 0x49ac56
push 0x4e8b7c
call fcn.0049afb0
add esp, 4
push esi
push 0x30
push 1
call fcn.004854d0
mov esi, eax
add esp, 8
test esi, esi
jne 0x49ac6b
pop esi
ret
push edi
mov edi, dword [esp + 0xc]
mov eax, 2
test edi, edi
push 4
cmovle edi, eax
lea eax, [edi + edi]
mov word [esi + 0x1c], ax
cwde
push eax
call fcn.004854d0
add esp, 8
mov dword [esi + 0x24], eax
test eax, eax
je 0x49ad0c
push edi
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [esi], eax
mov dword [esi + 0x20], 0xffffffff
test eax, eax
je 0x49ad0c
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi + 0x2c], eax
test eax, eax
je 0x49ad0c
xor eax, eax
xor edi, edi
cmp ax, word [esi + 0x1c]
jge 0x49acf8
nop dword [eax]
push esi
push 0
push 0x49ae50
call fcn.0046cbea
add esp, 0xc
cmp eax, 0xffffffff
je 0x49ad0c
mov ecx, dword [esi + 0x24]
mov dword [ecx + edi*4], eax
inc edi
inc word [esi + 0x28]
movsx eax, word [esi + 0x1c]
cmp edi, eax
jl 0x49acd0
push 0x3e8
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
pop edi
mov eax, esi
pop esi
ret
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x49ad1b
push eax
call edi
mov eax, dword [esi + 0x24]
test eax, eax
je 0x49ad2b
push eax
call fcn.00485570
add esp, 4
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x49ad35
push eax
call edi
push esi
call fcn.00485570
add esp, 4
xor eax, eax
pop edi
pop esi
ret
Function at 0x49daa0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x98
mov eax, dword [0x4d31c4]
xor eax, esp
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0xa4]
push ebx
push ebp
push edi
mov edi, dword [esp + 0xa8]
mov dword [esp + 0x14], eax
test edi, edi
je 0x49dad7
test byte [edi + 0x1c], 0x10
je 0x49dad7
mov ebx, edi
jmp 0x49dad9
xor ebx, ebx
or ebp, 0xffffffff
mov dword [esp + 0x18], 0
test ebx, ebx
jne 0x49db02
pop edi
or eax, ebp
pop ebp
pop ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.004634b5
add esp, 0x98
ret
mov eax, dword [edi + 0x18]
test eax, eax
je 0x49db14
push eax
push 0
call fcn.00498780
add esp, 8
mov eax, dword [ebx + 0x50]
test al, 2
jne 0x49dc6f
test byte [edi + 0x1c], 4
push esi
jne 0x49dc42
test al, 1
jne 0x49dc42
push 0x80
lea eax, [ebx + 0x5c]
mov dword [ebx + 0x54], 0
push 0
push eax
mov dword [ebx + 0x58], 0
call fcn.00466310
mov esi, dword [esp + 0xbc]
push 0x10
push esi
push edi
call fcn.004930c0
add esp, 0x18
cmp eax, 0xffffffff
je 0x49dc42
push 0
push edi
call fcn.00492bf0
push 1
lea eax, [esp + 0x1c]
push eax
push 0x10
lea eax, [esp + 0x38]
push eax
push esi
push edi
call fcn.004934e0
mov ebp, eax
add esp, 0x20
xor edx, edx
mov dword [esp + 0x14], ebp
test ebp, ebp
jle 0x49dbb6
lea ecx, [ebx + 0x5c]
nop dword [eax + eax]
mov eax, dword [esp + edx*8 + 0x24]
lea ecx, [ecx + 8]
mov dword [ecx - 4], eax
mov eax, dword [esp + edx*8 + 0x28]
inc edx
mov dword [ecx - 8], eax
cmp edx, ebp
jl 0x49dba0
mov eax, dword [esp + 0x10]
mov dword [ebx + 0x58], ebp
xor ebp, ebp
mov esi, dword [eax]
mov dword [ebx + 0x54], esi
test esi, esi
je 0x49dbda
push 0x10
push esi
call fcn.00492e10
mov esi, dword [esi]
add esp, 8
inc ebp
test esi, esi
jne 0x49dbc8
mov esi, dword [esp + 0x14]
cmp ebp, esi
jne 0x49dcc6
push edi
call fcn.00492dc0
add esp, 4
lea eax, [esp + 0x1c]
push 0
push dword [esp + 0x1c]
push eax
lea eax, [esp + 0x2c]
push eax
push esi
lea eax, [ebx + 0x5c]
push eax
push dword [ebx + 0x4c]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x49dc3c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x49dc3c
push 0x10
push ebx
call fcn.0049e190
push 0
push edi
call fcn.00492c30
push edi
call fcn.00490b40
add esp, 0x14
or ebp, 0xffffffff
jmp 0x49dc42
or dword [ebx + 0x50], 1
xor ebp, ebp
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x49dc54
push ecx
push 0
call fcn.00498790
add esp, 8
mov ecx, dword [esp + 0xa4]
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004634b5
add esp, 0x98
ret
push 0x4e1fe4
push 0x4e1ffc
push 0x103
push 0x4e2018
push 0x4e2028
push 0xdeaddead
call fcn.004973e0
add esp, 0x18
push 0x4e204c
push str._buf_o__write_in_progress
push 0x103
push 0x4e2080
push 0x4e2090
push 2
call fcn.0046857e
add esp, 4
push eax
call fcn.004040c0
add esp, 0x18
call fcn.00476c0e
push 0x4e20b4
push 0x4e20cc
push 0x11f
push 0x4e20dc
push 0x4e20ec
push 0xdeaddead
call fcn.004973e0
add esp, 0x18
push str.evbuffer_launch_read
push str.npin__nvecs
push 0x11f
push str.buffer_iocp.c
push str._s:_d:_Assertion__s_failed_in__s
push 2
call fcn.0046857e
add esp, 4
push eax
call fcn.004040c0
add esp, 0x18
call fcn.00476c0e
int3
Function at 0x49dd20
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 8
push ebx
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x49dd38
test byte [edi + 0x1c], 0x10
je 0x49dd38
mov ebp, edi
jmp 0x49dd3a
xor ebp, ebp
or ebx, 0xffffffff
test edi, edi
jne 0x49dd4a
pop edi
pop ebp
or eax, ebx
pop ebx
add esp, 8
ret
mov eax, dword [edi + 0x18]
test eax, eax
je 0x49dd5c
push eax
push 0
call fcn.00498780
add esp, 8
mov eax, dword [ebp + 0x50]
test al, 1
jne 0x49de9b
test byte [edi + 0x1c], 2
jne 0x49de80
test al, 2
jne 0x49de80
mov eax, dword [edi + 0xc]
test eax, eax
je 0x49de7e
mov ebx, dword [esp + 0x1c]
test ebx, ebx
js 0x49dd90
cmp ebx, eax
jbe 0x49dd92
mov ebx, eax
push esi
push 1
push edi
call fcn.00492bf0
push 0x80
lea eax, [ebp + 0x5c]
mov dword [ebp + 0x54], 0
push 0
push eax
mov dword [ebp + 0x58], 0
call fcn.00466310
mov esi, dword [edi]
lea ecx, [ebp + 0x5c]
add esp, 0x14
mov dword [ebp + 0x54], esi
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], eax
nop
test esi, esi
je 0x49de20
mov eax, dword [esi + 0x14]
add eax, dword [esi + 8]
push 0x20
push esi
mov dword [ecx + 4], eax
call fcn.00492e10
mov eax, dword [esi + 0xc]
add esp, 8
cmp ebx, eax
jbe 0x49de11
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
add ecx, 8
mov eax, dword [esp + 0x1c]
sub ebx, dword [esi + 0xc]
inc eax
mov esi, dword [esi]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
cmp eax, 0x10
jl 0x49ddd0
jmp 0x49de20
mov eax, dword [esp + 0x10]
mov dword [eax], ebx
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
push edi
mov dword [ebp + 0x58], eax
call fcn.00492dc0
add esp, 4
lea eax, [esp + 0x14]
push 0
push dword [esp + 0x28]
push 0
push eax
push dword [esp + 0x2c]
lea eax, [ebp + 0x5c]
push eax
push dword [ebp + 0x4c]
call dword [sym.imp.WS2_32.dll_WSASend]
pop esi
test eax, eax
je 0x49de7a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x49de7a
push 0x20
push ebp
call fcn.0049e190
push 1
push edi
call fcn.00492c30
push edi
call fcn.00490b40
add esp, 0x14
or ebx, 0xffffffff
jmp 0x49de80
or dword [ebp + 0x50], 2
xor ebx, ebx
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x49de92
push ecx
push 0
call fcn.00498790
add esp, 8
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret
push 0x4e1f14
push 0x4e1f2c
push 0xb9
push 0x4e1f48
push 0x4e1f58
push 0xdeaddead
call fcn.004973e0
add esp, 0x18
push str.evbuffer_launch_write
push str._buf_o__read_in_progress
push 0xb9
push 0x4e1fb0
push 0x4e1fc0
push 2
call fcn.0046857e
add esp, 4
push eax
call fcn.004040c0
add esp, 0x18
call fcn.00476c0e
int3