joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4109e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x4109fe
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x410a40
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x410a5e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x410aa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x410ac2
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x410b20
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x410b42
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x410ba0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x410bca
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x410c30
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x410c5a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x410cc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x410d1f

Function at 0x410d2e
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x410d10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x410da0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x410dff

Function at 0x410e0e
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x410df0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret
Function at 0x413480
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x4139a0
test edx, edx
je 0x4139a0
call fcn.00413497
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x4139e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00413480
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x413a51
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x413a16
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x41e520
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x41e632
cmp byte [ebx + 0x3d], 0
je 0x41e632
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x41e550
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [ebp - 0x1c], 0
xorps xmm0, xmm0
mov dword [ebp - 8], ecx
cmp ecx, 0x10
movq qword [ebp - 0x1c], xmm0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], 8
cmovae eax, dword [ebp - 0x1c]
push esi
push edi
mov byte [eax + 8], 0
mov ecx, dword [ebp - 8]
nop
cmp ecx, 0x10
lea eax, [ebp - 4]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x1c]
cmovae edi, dword [ebp - 0x1c]
lea esi, [ebp - 0x1c]
cmovae esi, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x41e5be
sub eax, 1
je 0x41e5c2
mov ecx, dword [ebp - 8]
sub eax, 2
je 0x41e615
xor bl, bl
jmp 0x41e617
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
cmp ecx, 0x10
mov esi, dword [ebp - 4]
cmovae eax, edx
sub esi, eax
je 0x41e5f7
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x1c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0056522f
mov ecx, dword [ebp - 8]
add esp, 0x10
cmp esi, eax
jne 0x41e5ba
cmp byte [ebx + 0x3d], 0
je 0x41e615
test esi, esi
jne 0x41e580
push esi
push 8
lea ecx, [ebp - 0x1c]
call fcn.0041aa50
jmp 0x41e57b
mov bl, 1
pop edi
pop esi
cmp ecx, 0x10
jb 0x41e62b
inc ecx
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
call fcn.0041afa0
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425990
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 3
jne 0x4259bc
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x4259ad
pop edi
xor eax, eax
pop esi
pop ebp
ret
push dword [eax + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call ecx
jmp 0x4259f0
cmp dword [esi + 8], 0
jne 0x4259e0
push 0x58b6d4
push dword [eax + 8]
call fcn.00566810
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x4259e0
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [esi + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.00566a01
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x425a12
mov eax, dword [esi + 8]
test eax, eax
je 0x425a0c
push eax
call fcn.00564794
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x4266c0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4266fc
mov eax, dword [ebp - 0x190]
cmp al, 2
jne 0x4266f6
shr eax, 8
cmp al, 2
jne 0x4266f6
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov esp, ebp
pop ebp
ret

Function at 0x426b10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp + 0x10]
push esi
push edi
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.00427700
lea esi, [ebp - 0x104]
add esp, 0x10
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x426b40
mov edi, dword [ebp + 8]
sub esi, ecx
mov ecx, dword [edi + 0x198]
test ecx, ecx
je 0x426b79
cmp byte [edi + 0x4770], al
jne 0x426b79
lea edx, [ebp - 0x104]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x426b64
mov byte [edi + 0x4770], 1
cmp byte [edi + 0x3c8], 0
je 0x426be5
mov eax, dword [edi + 0x208]
mov byte [ebp + esi - 0x104], 0xa
inc esi
mov byte [ebp + esi - 0x104], 0
test eax, eax
je 0x426bb9
push dword [edi + 0x194]
lea ecx, [ebp - 0x104]
push esi
push ecx
push 0
push edi
call eax
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [edi + 0x190]
push 1
push 2
push 0x58c7b8
call fcn.0056522f
push dword [edi + 0x190]
lea eax, [ebp - 0x104]
push 1
push esi
push eax
call fcn.0056522f
add esp, 0x20
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x426bf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x426c93
cmp byte [edi + 0x3c8], 0
je 0x426c93
push esi
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x804]
push 0x801
push eax
call fcn.00427700
lea esi, [ebp - 0x804]
add esp, 0x10
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x426c37
mov eax, dword [edi + 0x208]
sub esi, ecx
test eax, eax
je 0x426c66
push dword [edi + 0x194]
lea ecx, [ebp - 0x804]
push esi
push ecx
push 0
push edi
call eax
add esp, 0x14
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push dword [edi + 0x190]
push 1
push 2
push 0x58c7b8
call fcn.0056522f
push dword [edi + 0x190]
lea eax, [ebp - 0x804]
push 1
push esi
push eax
call fcn.0056522f
add esp, 0x20
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x426ef0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push edi
mov esi, dword [edi + eax*4 + 0x1a8]
call fcn.004271a0
add esp, 8
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp ebx, 0xffffffff
jne 0x426f74
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x426f4c
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
mov dword [eax], 0x51
xor eax, eax
pop ebp
ret
push esi
push edi
call fcn.00425b60
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.00426b10
mov eax, dword [edi]
add esp, 0x14
mov dword [eax + 0x4774], esi
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x37
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x4271a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
shl eax, 4
push edi
mov edx, dword [ebx + ecx*4 + 0x1a8]
lea esi, [ebx + 0x1cc]
add esi, eax
mov dword [ebp + 8], edx
mov eax, dword [ebx + 0x2e0]
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x42725d
cmp dword [ebx + ecx*4 + 0x1bc], 0x426e40
jne 0x42725d
cmp dword [esi], 0
je 0x4271ef
test edi, edi
je 0x42725d
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push edx
call fcn.004369f0
add esp, 0x14
cmp eax, 0xffffffff
je 0x42725d
test al, 1
je 0x42725d
cmp dword [esi], 0
jne 0x427244
mov eax, dword [ebx]
mov eax, dword [eax + 0x388]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x5f80d0]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
jne 0x427244
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x42725d
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x427270
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x208]
test eax, eax
je 0x427299
push dword [esi + 0x194]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
add esp, 0x14
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x4272cf
push dword [esi + 0x190]
lea eax, [eax + eax*2]
push 1
add eax, 0x58c7b8
push 2
push eax
call fcn.0056522f
push dword [esi + 0x190]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0056522f
add esp, 0x20
xor eax, eax
pop esi
pop ebp
ret

Function at 0x42d760
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x42d77e
cmp dword [esi + 0x6c], 0
je 0x42d77e
push 2
push 3
push esi
call fcn.00441b10
add esp, 0xc
push dword [ebp + 0xc]
call fcn.00438730
add esp, 4
test esi, esi
je 0x42d79e
cmp dword [esi + 0x6c], 0
je 0x42d79e
push 3
push esi
call fcn.00441b50
add esp, 8
pop esi
pop ebp
ret
Function at 0x437550
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x602b64]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x4375a1
push 3
push 2
push eax
push 6
call fcn.004478c0
add esp, 0x10
test al, al
je 0x437595
mov dword [0x602b64], 2
mov esp, ebp
pop ebp
ret
mov dword [0x602b64], 1
jmp 0x4375a6
cmp eax, 2
je 0x4375e6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4375cd
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x4375e6
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esp, ebp
pop ebp
ret

Function at 0x4376a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push 4
push eax
push 1
mov esi, dword [edi]
push 6
push dword [ebp + 0xc]
mov dword [ebp + 8], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4376e8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.00425b60
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.00426bf0
add esp, 0x14
pop edi
pop esi
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.00426bf0
add esp, 8
pop edi
pop esi
pop ebp
ret
Function at 0x4377f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 8]
push edi
cmp dword [ebx + 0x94], 2
mov edi, dword [ebx]
mov dword [ebp - 4], edi
je 0x4379a6
cmp byte [ebx + 0x29e], 0
push esi
jne 0x43799c
cmp byte [ebx + 0x2ba], 0
jne 0x43799c
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x104]
mov dword [ebp + 8], 0x80
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x437871
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebx
call fcn.00425b60
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push edi
call fcn.00426b10
add esp, 0x18
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x84]
mov dword [ebp + 8], 0x80
push 0
push eax
call fcn.00584f50
add esp, 0xc
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x84]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x4378ca
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebx
call fcn.00425b60
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push edi
call fcn.00426b10
add esp, 0x18
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebx + 0x138]
push eax
lea esi, [ebx + 0x10a]
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.00437dc0
add esp, 0xc
test al, al
jne 0x43791b
call fcn.00564579
mov esi, eax
call fcn.00564579
push dword [esi]
mov edi, eax
push ebx
call fcn.00425b60
push eax
push dword [edi]
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push dword [ebp - 4]
call fcn.00426b10
add esp, 0x18
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [esi]
mov eax, dword [esi + 0x28]
movups xmmword [ebx + 0x60], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [ebx + 0x70], xmm0
movq xmm0, qword [esi + 0x20]
movq qword [ebx + 0x80], xmm0
mov dword [ebx + 0x88], eax
mov ax, word [esi + 0x2c]
mov word [ebx + 0x8c], ax
lea eax, [ebx + 0x16c]
push eax
lea eax, [ebx + 0x13c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00437dc0
add esp, 0xc
test al, al
jne 0x43799c
call fcn.00564579
mov esi, eax
call fcn.00564579
push dword [esi]
mov edi, eax
push ebx
call fcn.00425b60
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push dword [ebp - 4]
call fcn.00426b10
add esp, 0x18
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call fcn.00437470
add esp, 4
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4380f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 4
cmp byte [esi + 0x510], al
setne al
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x438139
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.00426bf0
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [esi + 0x514]
mov dword [ebp - 0x10], 1
call fcn.0043ff90
push dword [esi + 0x518]
imul eax, eax, 0x3e8
mov dword [ebp + 8], eax
mov dword [ebp - 0xc], eax
call fcn.0043ff90
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp + 8], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x4381a9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.00426bf0
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x441ce0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [eax], esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x441e83
push ebx
mov ebx, dword [ebp - 8]
push edi
test ebx, ebx
je 0x441e6e
nop dword [eax]
cmp dword [ebx + 4], 2
jne 0x441dd8
cmp dword [ebx + 0x18], 0
je 0x441dd8
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x441dd8
cmp eax, 0x10
jb 0x441dd8
push 0x20
call dword [0x5f80d0]
mov edi, eax
add esp, 4
test edi, edi
je 0x441e60
mov ecx, dword [ebx]
mov dword [edi], ecx
mov ecx, dword [ebx + 4]
mov dword [edi + 4], ecx
mov ecx, dword [ebx + 8]
mov dword [edi + 8], ecx
mov eax, dword [ebx + 0xc]
push 0x10
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0x10
mov dword [edi + 0x18], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x1c], 0
call dword [0x5f80d0]
add esp, 4
mov dword [edi + 0x18], eax
test eax, eax
je 0x441e4f
mov ecx, dword [ebx + 0x18]
movups xmm0, xmmword [ecx]
movups xmmword [eax], xmm0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x441dc6
push eax
call dword [0x5f80dc]
add esp, 4
mov dword [edi + 0x14], eax
test eax, eax
je 0x441e35
mov eax, dword [ebp - 4]
test esi, esi
cmove esi, edi
test eax, eax
je 0x441dd5
mov dword [eax + 0x1c], edi
mov dword [ebp - 4], edi
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
jne 0x441d20
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
test eax, eax
je 0x441df4
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test ebx, ebx
je 0x441e6a
test esi, esi
je 0x441e25
nop dword [eax]
push dword [esi + 0x18]
call dword [0x5f80d4]
push dword [esi + 0x14]
call dword [0x5f80d4]
mov edi, dword [esi + 0x1c]
push esi
call dword [0x5f80d4]
add esp, 0xc
mov esi, edi
test edi, edi
jne 0x441e00
mov eax, dword [ebp + 0x14]
xor esi, esi
pop edi
mov dword [eax], esi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push dword [edi + 0x18]
mov ebx, 8
call dword [0x5f80d4]
push edi
call dword [0x5f80d4]
add esp, 8
jmp 0x441de6
push edi
mov ebx, 8
call dword [0x5f80d4]
add esp, 4
jmp 0x441de6
mov ebx, 8
jmp 0x441de6
test esi, esi
jne 0x441e7a
mov ebx, 0x2af9
push ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
pop edi
mov dword [eax], esi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4420e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0x10000
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x20000
push 0
call fcn.0056cd10
add esp, 0x18
test eax, eax
je 0x442108
cmp eax, 0xffffffff
jne 0x44210a
xor eax, eax
pop ebp
ret