joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e50
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1a8
mov eax, dword [0x424340]
xor eax, esp
mov dword [esp + 0x1a4], eax
push edi
mov edi, dword [esp + 0x1b4]
push 0x403cc0
call fcn.00406b40
push fcn.00403cd0
push 0xf
call fcn.00407ee0
push fcn.00403cd0
push 2
call fcn.00407ee0
push fcn.00403cd0
push 0x17
call fcn.00407ee0
add esp, 0x1c
lea eax, [esp + 0x18]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x403ee1
push 0x93
push str..._srcmain.cpp
push str.WSAStartup
call fcn.00401b20
add esp, 0xc
xor eax, eax
pop edi
mov ecx, dword [esp + 0x1a4]
xor ecx, esp
call fcn.0040a9f3
add esp, 0x1a8
ret
push ebx
push esi
push 1
push 0x407e60
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push 0
push 0
call esi
push 0
push 0
push 1
push 0
mov dword [0x425530], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
mov dword [0x42552c], eax
call esi
push 0
push 0
push 0
mov dword [0x425524], eax
call esi
mov dword [0x42551c], eax
call fcn.00409370
call fcn.004094c0
push 0x403d40
mov dword [0x425528], eax
call fcn.0040abd3
push 0x190
call fcn.00409dbb
mov esi, eax
push esi
call fcn.00406c50
push esi
call fcn.00407d70
mov ebx, dword [esp + 0x1c8]
push esi
push edi
push ebx
call fcn.00407dd0
mov eax, dword [esi + 0x44]
add esp, 0x1c
cmp eax, 2
je 0x403fd5
cmp eax, 4
je 0x403fd5
test byte [esi + 0x40], 4
mov dword [esp + 0x10], str.IPerfService
mov dword [esp + 0x14], 0x4069b0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
je 0x403fb9
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x404053
mov edi, dword [edi]
push edi
push edi
push str.Usage:__s___s_c_host___options__nTry___s___help_for_more_information._n
call fcn.00409f74
add eax, 0x40
push eax
call fcn.00409e25
add esp, 0x10
jmp 0x404053
mov eax, dword [esi + 0x40]
test al, 4
je 0x403fe8
push edi
push ebx
call fcn.004065f0
add esp, 8
jmp 0x404053
test al, al
jns 0x40400d
call fcn.004067b0
test eax, eax
je 0x40400d
push str.IPerf_Service_is_removed._n
call fcn.00409f74
add eax, 0x40
push eax
call fcn.00409e25
add esp, 8
jmp 0x404053
cmp dword [esi + 0x44], 2
jne 0x40401c
push esi
call fcn.00402c70
add esp, 4
lea edx, [esp + 0xc]
push edx
push esi
mov dword [esp + 0x14], 0
call fcn.00406cb0
mov eax, dword [esp + 0x14]
mov dword [eax + 0x44], 3
mov ecx, dword [esp + 0x14]
mov dword [ecx + 0x1c], esi
mov edx, dword [esp + 0x14]
push edx
call fcn.00409630
add esp, 0xc
call fcn.004093c0
mov ecx, dword [esp + 0x1b0]
pop esi
pop ebx
pop edi
xor ecx, esp
xor eax, eax
call fcn.0040a9f3
add esp, 0x1a8
ret
Function at 0x404070
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, dword [esi + 0x3c]
mov edx, dword [esi + 0x2c]
xor eax, eax
cmp dword [esi + 0x44], 2
push edi
sete al
push eax
push ecx
push edx
call fcn.004092d0
add esp, 0xc
test dword [esi + 0x40], 0x400000
je 0x4040af
push str.The__Z_option_is_not_available_on_this_operating_system_n
call fcn.00409f74
add eax, 0x40
push eax
call fcn.00409e25
add esp, 8
test dword [esi + 0x40], 0x4000
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
je 0x40411d
mov eax, dword [esi + 0x70]
test eax, eax
jle 0x40411d
mov dword [esp + 0xc], eax
lea eax, [esi + 0x100]
push eax
call fcn.00408c60
add esp, 4
test eax, eax
push 4
jne 0x4040f5
mov edx, dword [esi + 0x2c]
lea ecx, [esp + 0x10]
push ecx
push 0xa
push eax
push edx
call edi
cmp eax, 0xffffffff
jne 0x40411d
push 0x74
jmp 0x40410b
mov ecx, dword [esi + 0x2c]
lea eax, [esp + 0x10]
push eax
push 0xa
push 0x29
push ecx
call edi
cmp eax, 0xffffffff
jne 0x40411d
push 0x7a
push str..._srcPerfSocket.cpp
push str.multicast_ttl
call fcn.00401b20
add esp, 0xc
mov eax, dword [esi + 0x28]
test eax, eax
jle 0x404155
push 4
lea edx, [esp + 0x10]
push edx
push 3
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x2c]
push 0
push eax
call edi
cmp eax, 0xffffffff
jne 0x404155
push 0x89
push str..._srcPerfSocket.cpp
push str.setsockopt_IP_TOS
call fcn.00401b20
add esp, 0xc
test dword [esi + 0x40], 0x800
jne 0x4041a9
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x2c]
push ecx
push edx
call fcn.00408f90
add esp, 8
test byte [esi + 0x40], 0x20
je 0x4041a9
mov ecx, dword [esi + 0x2c]
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push ecx
mov dword [esp + 0x20], 1
call edi
cmp eax, 0xffffffff
jne 0x4041a9
push 0x99
push str..._srcPerfSocket.cpp
push str.setsockopt_TCP_NODELAY
call fcn.00401b20
add esp, 0xc
pop edi
pop esi
ret
Function at 0x406280
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebp, dword [edi + 4]
xor ebx, ebx
push 0x20
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call fcn.00409dbb
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4063bb
mov dword [esi], ebx
mov eax, dword [edi]
push eax
call fcn.00404df0
mov ecx, dword [edi]
add esp, 4
mov dword [ecx + 0x14], eax
lea esp, [esp]
mov eax, dword [edi]
mov edx, dword [eax + 0x34]
mov ecx, dword [edi + 4]
push 0
push edx
mov edx, dword [eax + 0x2c]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
mov eax, dword [edi]
test dword [eax + 0x40], 0x800
je 0x406322
mov ecx, dword [ebp]
push ecx
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [esi], eax
mov edx, dword [ebp + 4]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [esi + 0x1c], eax
mov eax, ebx
cdq
lea ecx, [esi + 0x10]
push 0
push ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
call fcn.00401c80
add esp, 8
jmp 0x40632d
mov eax, ebx
cdq
add dword [esp + 0x10], eax
adc dword [esp + 0x14], edx
mov eax, dword [esi]
test eax, eax
jge 0x40633a
neg eax
mov dword [esi], eax
or ebx, 0xffffffff
mov eax, dword [edi]
test dword [eax + 0x40], 0x800
je 0x406352
mov edx, dword [eax + 0x14]
push esi
push edx
call fcn.00405120
add esp, 8
test ebx, ebx
jg 0x4062c0
lea eax, [esi + 0x10]
push 0
push eax
call fcn.00401c80
mov ecx, dword [edi]
add esp, 8
test dword [ecx + 0x40], 0x800
jne 0x406390
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
mov ecx, dword [edi]
mov edx, dword [ecx + 0x14]
push esi
push edx
call fcn.00405120
add esp, 8
mov eax, dword [edi]
mov ecx, dword [eax + 0x14]
push esi
push ecx
call fcn.004051b0
mov edx, dword [edi]
mov eax, dword [edx + 0x40]
add esp, 8
test eax, 0x800
je 0x4063da
test eax, 0x4000
jne 0x4063da
mov ecx, edi
call fcn.00405fc0
jmp 0x4063da
push 0x95
push 0x41f470
push str.Out_of_memory__Closing_server_thread_n
call fcn.00401af0
mov eax, dword [edi]
push eax
call fcn.004096f0
add esp, 0x10
mov ecx, dword [0x42551c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [edi]
add edx, 0x78
push 0x425520
push edx
call fcn.00402ec0
mov eax, dword [0x42551c]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test esi, esi
je 0x406415
push esi
call fcn.0040998b
add esp, 4
mov ecx, dword [edi]
mov edx, dword [ecx + 0x14]
push edx
call fcn.00405200
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x406430
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x10c
mov eax, dword [0x424340]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov esi, dword [esp + 0x114]
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.IPerfService
push 0
mov dword [0x425548], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push esi
mov edi, eax
call fcn.0040bc9c
mov eax, dword [0x425548]
push eax
push str.IPerfService
lea ecx, [esp + 0x1c]
push str._s_error:__d
push ecx
call fcn.0040a95c
add esp, 0x14
test edi, edi
lea edx, [esp + 0x10]
mov dword [esp + 8], edx
mov dword [esp + 0xc], esi
je 0x4064bb
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [esp + 0x110]
pop edi
pop esi
xor ecx, esp
call fcn.0040a9f3
add esp, 0x10c
ret
Function at 0x4065f0
Capabilities:
Create service
Query service status
Start service

Disassembly:
sub esp, 0x208
mov eax, dword [0x424340]
xor eax, esp
mov dword [esp + 0x204], eax
push ebp
mov ebp, dword [esp + 0x214]
push 0x200
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40665a
push 0x100
push 0x426500
call fcn.004064e0
push eax
push str.IPerf_Service
push str.Unable_to_install__s____s_n
call fcn.0040bc9c
add esp, 0x14
pop ebp
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.0040a9f3
add esp, 0x208
ret
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x40677a
push ebx
push esi
push 0xf01ff
push str.IPerfService
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x4066bb
push eax
push eax
push 0x41dc1b
push eax
push eax
lea ecx, [esp + 0x28]
push ecx
push 1
push 3
push 0x10
push 0xf01ff
push str.IPerf_Service
push str.IPerfService
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
jmp 0x4066cd
push str.IPerf_Service
push str._s_already_installed._n
call fcn.0040bc9c
add esp, 8
test esi, esi
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x406741
push 0x426620
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x406722
cmp dword [0x426624], 1
jne 0x406708
mov edx, dword [esp + 0x21c]
add ebp, 4
push ebp
add edx, 0xffffffff
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
jmp 0x40670c
mov eax, dword [esp + 0x10]
test eax, eax
je 0x406722
push str.IPerf_Service
push str._s_started._n
call fcn.0040bc9c
add esp, 8
push esi
call ebx
push edi
call ebx
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.0040a9f3
add esp, 0x208
ret
push 0x100
push 0x426500
call fcn.004064e0
push eax
push str.CreateService_failed____s_n
call fcn.0040bc9c
add esp, 0x10
push edi
call ebx
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.0040a9f3
add esp, 0x208
ret
push 0x100
push 0x426500
call fcn.004064e0
push eax
push str.OpenSCManager_failed____s_n
call fcn.0040bc9c
mov ecx, dword [esp + 0x21c]
add esp, 0x10
pop edi
pop ebp
xor ecx, esp
call fcn.0040a9f3
add esp, 0x208
ret
Function at 0x4067b0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ecx
push ebp
push edi
push 0xf003f
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
je 0x4068e1
push esi
push 0xf01ff
push str.IPerfService
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x4068d3
push 0x426620
push 1
push esi
mov dword [esp + 0x18], 1
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40688c
push ebx
push str.IPerf_Service
push str.Stopping__s.
call fcn.0040bc9c
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x426620
push esi
call ebx
test eax, eax
je 0x406869
jmp 0x406840
cmp dword [0x426624], 3
jne 0x406869
push 0x41f5d4
call fcn.0040bc9c
add esp, 4
push 0x3e8
call edi
push 0x426620
push esi
call ebx
test eax, eax
jne 0x406840
cmp dword [0x426624], 1
pop ebx
push str.IPerf_Service
jne 0x40687f
push str._n_s_stopped._n
jmp 0x406884
push str._n_s_failed_to_stop._n
call fcn.0040bc9c
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x4068ab
push str.IPerf_Service
push str._s_removed._n
call fcn.0040bc9c
add esp, 8
jmp 0x4068c8
push 0x100
push 0x426500
call fcn.004064e0
push eax
push str.DeleteService_failed____s_n
call fcn.0040bc9c
add esp, 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [esp + 0xc]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, edi
pop edi
pop ebp
pop ecx
ret
push 0x100
push 0x426500
call fcn.004064e0
push eax
push str.OpenSCManager_failed____s_n
call fcn.0040bc9c
add esp, 0x10
mov eax, edi
pop edi
pop ebp
pop ecx
ret
Function at 0x406b50
Capabilities:
Create thread

Disassembly:
cmp dword [0x42403c], 0xffffffff
jne 0x406bd8
push esi
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x42555c], eax
jne 0x406b87
call esi
push eax
push str.failed_to_create_timer_event:__d
call fcn.0040bc9c
add esp, 8
xor eax, eax
push 0x425560
mov dword [0x42554c], eax
mov dword [0x425550], eax
mov dword [0x425554], eax
mov dword [0x425558], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0x406aa0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, 0xffffffff
mov dword [0x42403c], eax
jne 0x406bd7
call esi
push eax
push str.failed_to_create_timer_thread:__d
call fcn.0040bc9c
add esp, 8
pop esi
push 0x425560
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x406c0e
mov ecx, dword [0x42554c]
mov dword [eax], ecx
mov edx, dword [0x425550]
mov dword [eax + 4], edx
mov ecx, dword [0x425554]
mov dword [eax + 8], ecx
mov edx, dword [0x425558]
mov dword [eax + 0xc], edx
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov dword [0x42554c], ecx
mov edx, dword [eax + 4]
mov dword [0x425550], edx
mov ecx, dword [eax + 8]
mov dword [0x425554], ecx
mov edx, dword [eax + 0xc]
push 0x425560
mov dword [0x425558], edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x42555c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
ret

Function at 0x407f00
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x4255e0]
mov ecx, eax
add eax, 1
test ecx, ecx
mov dword [0x4255e0], eax
jne 0x407f23
push ecx
call fcn.0040a293
add esp, 4
push 0
call fcn.00409c20
ret

Function at 0x408040
Capabilities:
Resolve dns

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x1c], ecx
je 0x4080e4
cmp word [ecx + 8], 2
push ebx
push ebp
push edi
jne 0x4080b5
cmp word [ecx + 0xa], 4
jne 0x4080b5
mov edi, dword [ecx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x4080b5
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov edx, dword [eax]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebx
push ebp
call fcn.00407fd0
test eax, eax
mov dword [esi], eax
je 0x4080d8
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x408090
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x24]
push 0x400
push ecx
push 0x401
push edx
call fcn.0040c461
add esp, 0x10
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0x18
pop edi
pop ebp
pop ebx
mov eax, 8
pop esi
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x4080f4.11001
jmp dword [eax*4 + 0x408118]
mov eax, 0x2af9
pop esi
ret 0x18
mov eax, 0x2afa
pop esi
ret 0x18
mov eax, 0x2afb
pop esi
ret 0x18
Function at 0x408950
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
mov eax, dword [0x424340]
xor eax, esp
mov dword [esp + 0x22c], eax
cmp dword [0x4255e4], 0
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x4083a0
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x408690
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.00408350
je 0x4089c2
movzx eax, word [esp + 0x234]
mov eax, dword [eax*8 + 0x424044]
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0040a9f3
add esp, 0x230
ret 4
push 0x104
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x408abf
push ebx
push ebp
push esi
push edi
lea edx, [esp + 0x134]
push edx
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.0040c29f
push str.ws2_32
lea ecx, [esp + 0x38]
push 0x10c
push ecx
call fcn.0040c5ee
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x408a3d
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x408a84
push esi
call ebp
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x2c]
push 0x10c
push ecx
call fcn.0040c29f
push str.wship6
lea edx, [esp + 0x38]
push 0x10c
push edx
call fcn.0040c5ee
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call edi
mov esi, eax
test esi, esi
je 0x408abb
push str.getaddrinfo
push esi
call ebx
test eax, eax
je 0x408aef
xor edi, edi
mov ecx, dword [esp + edi*8 + 0x10]
push ecx
push esi
call ebx
test eax, eax
mov dword [esp + edi*8 + 0x14], eax
je 0x408aef
add edi, 1
cmp edi, 3
jl 0x408a86
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [0x424044], edx
mov dword [0x42404c], eax
mov dword [fcn.00408350], ecx
pop edi
pop esi
pop ebp
pop ebx
movzx edx, word [esp + 0x234]
mov ecx, dword [esp + 0x22c]
mov eax, dword [edx*8 + 0x424044]
xor ecx, esp
mov dword [0x4255e4], 1
call fcn.0040a9f3
add esp, 0x230
ret 4
push esi
call ebp
jmp 0x408abb
Function at 0x408b00
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [0x4255e8]
test eax, eax
jne 0x408b15
push eax
call fcn.00408950
mov dword [0x4255e8], eax
push esi
push edi
mov edi, dword [esp + 0x10]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push edi
call eax
mov esi, eax
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
test esi, esi
je 0x408b75
push 0
push 0x400
push 0x4260e0
push 0x400
push esi
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0x4260e0
push str.error:__s_n
call fcn.00409f74
add eax, 0x40
push eax
call fcn.00409e25
add esp, 0xc
push 1
call fcn.00409c20
mov esi, dword [esp + 8]
cmp dword [esi + 0x18], 0
jne 0x408b87
push edi
push str.getaddrinfo_failed_to_get_an_address..._target_was__s_n
jmp 0x408b5d
cmp dword [esp + 0x18], 0
mov eax, esi
je 0x408ba1
mov ecx, 0x17
cmp dword [eax + 4], ecx
je 0x408bb8
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x408b95
mov eax, esi
mov edi, 2
cmp dword [eax + 4], edi
je 0x408be9
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x408ba8
pop edi
pop esi
pop ecx
ret
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
call fcn.0040c660
mov eax, dword [0x4255ec]
add esp, 0xc
test eax, eax
jne 0x408c12
push 2
call fcn.00408950
push esi
mov dword [0x4255ec], eax
call eax
pop edi
pop esi
pop ecx
ret
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
call fcn.0040c660
mov eax, dword [0x4255ec]
add esp, 0xc
test eax, eax
jne 0x408c12
push edi
call fcn.00408950
mov dword [0x4255ec], eax
push esi
call eax
pop edi
pop esi
pop ecx
ret

Function at 0x4092d0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
jle 0x409319
cmp dword [esp + 0xc], 0
mov dword [esp + 8], eax
push 4
jne 0x4092fb
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 0x1002
push 0xffff
push ecx
jmp 0x40930f
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push 0x1001
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jl 0x40931b
xor eax, eax
ret

Function at 0x409630
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor eax, eax
push eax
mov eax, dword [esi + 0x184]
lea edi, [esi + 0x184]
push eax
call fcn.00409420
add esp, 8
test eax, eax
je 0x4096df
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x409666
push eax
call fcn.00409630
add esp, 4
mov ecx, dword [0x4260dc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
push 0xffffffffffffffff
push ecx
call ebx
mov edx, dword [0x4260dc]
mov ebp, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
add dword [0x4255f0], 1
push edx
call ebp
push edi
push 0
push esi
push 0x409790
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x18c], eax
jne 0x4096dd
push 0x99
push str...compatThread.c
push 0x420150
call fcn.00401af0
mov eax, dword [0x4260dc]
add esp, 0xc
push 0xffffffffffffffff
push eax
call ebx
mov ecx, dword [0x4260dc]
sub dword [0x4255f0], 1
push ecx
call ebp
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x4096f0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
xor eax, eax
push eax
mov eax, dword [esi + 0x184]
push eax
call fcn.00409420
add esp, 8
test eax, eax
jne 0x40978a
mov ecx, dword [0x4260dc]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [0x4260d8]
sub dword [0x4255f0], 1
push edx
call dword [sym.imp.KERNEL32.dll_PulseEvent]
mov eax, dword [0x4260dc]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [esi + 0x184]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call fcn.00409420
add esp, 8
test eax, eax
je 0x409772
push esi
call fcn.00406e00
mov edx, dword [esi + 0x18c]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov eax, dword [esi + 0x18c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call fcn.00406e00
add esp, 4
pop esi
ret