joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e6f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
mov esi, dword [esp + 0x48]
cmp dword [ebx + 8], 0xc
je 0x46e725
mov dword [esp + 8], 0x48d
mov dword [esp + 4], str.src_win_tcp.c
mov dword [esp], str.handle__type__UV_TCP
call fcn.0049c730
sub dword [ebx + 0x40], 1
jne 0x46e822
mov eax, dword [ebx + 0x2c]
test al, 1
je 0x46e871
lea eax, [edi + 0x10]
cmp dword [edi + 0x10], eax
je 0x46e850
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 8]
mov dword [eax], edx
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [eax + 4], edx
mov eax, dword [esi + 0x20]
test eax, eax
js 0x46e8a0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x7010
mov dword [esp + 4], 0xffff
mov eax, dword [ebx + 0x90]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
test eax, eax
jne 0x46e895
mov edx, dword [ebx + 0x2c]
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x48], 0xe
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x84], 0xffffffff
or edx, 0x19000
mov dword [ebx + 0x44], ebx
mov dword [ebx + 0x8c], 0
mov dword [ebx + 0x2c], edx
add dword [edi + 0x58], 1
mov ebp, dword [esi + 0x3c]
mov dword [esp], eax
call fcn.004588d0
mov dword [esp], esi
mov dword [esp + 4], eax
call ebp
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x46e8b0
sub eax, 1
mov edx, dword [ebx + 0x2c]
test eax, eax
mov dword [ebx + 0x3c], eax
jne 0x46e81a
test dl, 1
jne 0x46e8d4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
jns 0x46e73a
mov dword [esp + 8], 0x48f
mov dword [esp + 4], str.src_win_tcp.c
mov dword [esp], 0x54766c
call fcn.0049c730
lea eax, [edi + 0x10]
cmp dword [edi + 0x10], eax
jne 0x46e746
mov dword [esp + 8], 0x48f
mov dword [esp + 4], str.src_win_tcp.c
mov dword [esp], 0x547687
call fcn.0049c730
jmp 0x46e746
test al, 0x40
je 0x46e73a
mov edx, eax
and edx, 0xffffffbf
test al, 0x20
mov dword [ebx + 0x2c], edx
je 0x46e73a
mov eax, dword [ebx + 4]
sub dword [eax + 4], 1
jmp 0x46e73a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x46e7e5
mov dword [esp], eax
call fcn.0047a520
jmp 0x46e7e5
mov dword [esp + 8], 0x4a3
mov dword [esp + 4], str.src_win_tcp.c
mov dword [esp], 0x5476a3
call fcn.0049c730
mov eax, dword [ebx + 0x3c]
jmp 0x46e804
test dl, 8
jne 0x46e81a
mov eax, dword [edi + 0x2c]
or edx, 8
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x28], eax
mov dword [edi + 0x2c], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x46ea10
Capabilities:
Set socket configuration

Disassembly:
push esi
push ebx
sub esp, 0x34
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov eax, dword [ebx + 0x90]
cmp eax, 0xffffffff
jne 0x46ea50
test esi, esi
mov eax, dword [ebx + 0x2c]
jne 0x46ea40
and eax, 0xfdffffff
mov dword [ebx + 0x2c], eax
xor eax, eax
add esp, 0x34
pop ebx
pop esi
ret
or eax, 0x2000000
mov dword [ebx + 0x2c], eax
add esp, 0x34
xor eax, eax
pop ebx
pop esi
ret
lea edx, [esp + 0x2c]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x10], 4
mov dword [esp + 8], 1
mov dword [esp + 4], 6
mov dword [esp + 0xc], edx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
cmp eax, 0xffffffff
jne 0x46ea28
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x46ea39
jmp 0x46ea28

Function at 0x46f5e0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push ebx
sub esp, 0x24
mov dword [esp], 0xc
call fcn.004559c0
test eax, eax
je 0x46f6c1
mov ebx, eax
mov eax, dword [esp + 0x34]
mov dword [ebx], eax
mov eax, dword [esp + 0x38]
mov dword [ebx + 4], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x470260
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
test eax, eax
jne 0x46f670
call dword [sym.imp.msvcrt.dll__errno]
mov esi, dword [eax]
mov dword [esp], ebx
call fcn.004559d0
cmp esi, 0xb
je 0x46f6a0
jle 0x46f6b0
cmp esi, 0xd
je 0x46f690
cmp esi, 0x16
jne 0x46f6b4
mov esi, 0xfffff019
add esp, 0x24
mov eax, esi
pop ebx
pop esi
ret
mov edx, dword [esp + 0x30]
xor esi, esi
mov dword [edx], eax
mov dword [ebx + 8], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 4
add esp, 0x24
mov eax, esi
pop ebx
pop esi
ret
mov esi, 0xfffff004
add esp, 0x24
mov eax, esi
pop ebx
pop esi
ret
mov esi, 0xfffff008
add esp, 0x24
mov eax, esi
pop ebx
pop esi
ret
test esi, esi
je 0x46f687
mov esi, 0xfffff01a
add esp, 0x24
mov eax, esi
pop ebx
pop esi
ret
mov esi, 0xfffff027
jmp 0x46f687

Function at 0x470230
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x470255
add esp, 0x1c
ret
call sub.msvcrt.dll_abort
lea esi, [esi]
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
mov ebx, dword [eax]
mov esi, dword [eax + 4]
mov edi, dword [eax + 8]
mov dword [esp], eax
call fcn.004559d0
cmp byte [0x57682c], 0
jne 0x470292
mov edx, 0x46f5a0
mov eax, 0x57682c
call fcn.0046f3c0
mov dword [esp + 4], edi
mov dword [esp], 0x576834
call fcn.00470230
mov dword [esp], esi
call ebx
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret 4
Function at 0x471bc0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, eax
movzx eax, cl
sub esp, 0x4c
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x1c], edx
movzx edi, byte [esp + 0x64]
lea ebx, [esp + 0x2a]
mov dword [esp + 0x18], eax
jmp 0x471c20
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 4], edi
mov dword [esp], eax
mov eax, ebx
call fcn.00471960
mov dword [esp + 4], eax
mov eax, dword [esi + 0x90]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
sub esp, 8
test eax, eax
jne 0x471c50
call ebp
cmp eax, 0x57
jne 0x471c60
mov eax, dword [esi + 0x90]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
sub esp, 8
test eax, eax
jne 0x471be5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x68]
mov dword [edx], eax
jmp 0x471be5
add esp, 0x4c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call ebp
mov ecx, dword [esp + 0x68]
mov dword [ecx], eax
add esp, 0x4c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x476260
Capabilities:
Set socket configuration

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
cmp dword [edx + 0x38], 0xffffffff
mov dword [esp + 0x1c], 1
jne 0x4762c1
mov edi, eax
lea eax, [esp + 0x1c]
mov esi, ecx
mov ebx, edx
mov dword [esp + 4], 0x8004667e
mov dword [esp], ecx
mov dword [esp + 8], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x4762b4
mov eax, dword [esp + 0x30]
mov ecx, esi
mov edx, ebx
mov dword [esp], eax
mov eax, edi
call fcn.004760f0
add esp, 0x20
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov eax, 0xfffff00e
jmp 0x4762ad
Function at 0x478090
Capabilities:
Enumerate processes

Disassembly:
push edi
push esi
push ebx
sub esp, 0x140
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0
mov dword [esp], 2
mov edi, eax
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov ebx, eax
lea esi, [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], esi
call sub.KERNEL32.dll_Process32First
sub esp, 8
test eax, eax
jne 0x4780f3
jmp 0x478115
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_Process32Next
sub esp, 8
test eax, eax
je 0x478115
cmp dword [esp + 0x20], edi
jne 0x4780e0
mov esi, dword [esp + 0x30]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, esi
add esp, 0x140
pop ebx
pop esi
pop edi
ret
mov esi, 0xffffffff
jmp 0x4780fd
Function at 0x4797a0
Capabilities:
Get common file path
Get session user name

Disassembly:
push edi
push esi
push ebx
sub esp, 0x440
mov ebx, dword [esp + 0x450]
test ebx, ebx
je 0x479910
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0x2c]
mov dword [esp + 4], 0x20008
mov dword [esp], eax
mov dword [esp + 8], edx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
sub esp, 0xc
test eax, eax
je 0x479895
mov eax, dword [esp + 0x2c]
lea esi, [esp + 0x30]
lea edi, [esp + 0x238]
mov dword [esp + 0x30], 0x104
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
sub esp, 0xc
test eax, eax
jne 0x479844
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
cmp ebx, 0x7a
je 0x479938
mov dword [esp], ebx
call fcn.004588d0
add esp, 0x440
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [esp + 4], esi
lea esi, [esp + 0x36]
mov dword [esp + 0x30], 0x101
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
sub esp, 8
test eax, eax
jne 0x4798b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x479938
mov dword [esp], eax
call fcn.004588d0
add esp, 0x440
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
call fcn.004588d0
add esp, 0x440
pop ebx
pop esi
pop edi
ret
lea eax, [ebx + 0x10]
mov dword [ebx + 0x10], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.00479070
test eax, eax
jne 0x47983a
mov dword [ebx], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call fcn.00479070
test eax, eax
jne 0x479920
mov dword [ebx + 0xc], 0
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 8], 0xffffffff
jmp 0x47983a
mov eax, 0xfffff019
jmp 0x47983a
mov edx, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp], edx
call fcn.004559d0
mov eax, dword [esp + 0x1c]
jmp 0x47983a
mov eax, 0xfffff027
jmp 0x47983a
Function at 0x47a2c0
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push esi
push ebx
sub esp, 0x434
lea eax, [esp + 0x2c]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
test eax, eax
jne 0x47a50b
mov dword [esp + 8], 0x577a20
mov dword [esp + 4], 0
mov dword [esp], str.0.0.0.0
call fcn.00456a50
test eax, eax
jne 0x47a4da
mov dword [esp + 8], 0x577a34
mov dword [esp + 4], 0
mov dword [esp], 0x54887b
call fcn.00456ac0
test eax, eax
jne 0x47a4da
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
mov esi, dword [sym.imp.WS2_32.dll_socket]
call esi
sub esp, 0xc
cmp eax, 0xffffffff
mov ebx, eax
je 0x47a470
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x274
mov dword [esp + 8], 0x2005
mov dword [esp + 4], 0xffff
mov dword [esp], ebx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1bc]
mov dword [esp + 0xc], eax
call dword [sym.imp.WS2_32.dll_getsockopt]
sub esp, 0x14
cmp eax, 0xffffffff
je 0x47a4df
test byte [esp + 0x1be], 2
je 0x47a450
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
cmp eax, 0xffffffff
je 0x47a4f5
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0x17
call esi
sub esp, 0xc
cmp eax, 0xffffffff
mov ebx, eax
je 0x47a4b0
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x274
mov dword [esp + 8], 0x2005
mov dword [esp + 4], 0xffff
mov dword [esp], ebx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1bc]
mov dword [esp + 0xc], eax
call dword [sym.imp.WS2_32.dll_getsockopt]
sub esp, 0x14
cmp eax, 0xffffffff
je 0x47a4df
test byte [esp + 0x1be], 2
je 0x47a460
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
cmp eax, 0xffffffff
je 0x47a4f5
add esp, 0x434
pop ebx
pop esi
ret
mov dword [0x577a30], 1
jmp 0x47a3ab
mov dword [0x577a1c], 1
jmp 0x47a431
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
lea edx, [eax - 0x273b]
cmp edx, 1
jbe 0x47a3c0
sub eax, 0x273e
cmp eax, 1
jbe 0x47a3c0
call ebx
mov dword [esp + 4], str.socket
mov dword [esp], eax
call fcn.00458810
mov esi, esi
lea edi, [edi]
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
lea edx, [eax - 0x273b]
cmp edx, 1
jbe 0x47a446
sub eax, 0x273e
cmp eax, 1
ja 0x47a495
add esp, 0x434
pop ebx
pop esi
ret
call sub.msvcrt.dll_abort
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 4], str.getsockopt
mov dword [esp], eax
call fcn.00458810
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 4], str.closesocket
mov dword [esp], eax
call fcn.00458810
mov dword [esp + 4], str.WSAStartup
mov dword [esp], eax
call fcn.00458810
nop
lea esi, [esi]
Function at 0x47f0b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
xor eax, eax
sub esp, 0x14
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x47f0ce
mov esi, dword [esp + 0x28]
test esi, esi
je 0x47f0ce
mov ecx, dword [ebx + 0x1c]
test ecx, ecx
je 0x47f0d4
add esp, 0x14
pop ebx
pop esi
ret
mov edx, dword [ebx + 0xa4]
cmp edx, 4
je 0x47f0e4
cmp edx, 9
jne 0x47f0ce
mov esi, dword [ebx + 0x10]
movzx eax, byte [esi + 0xc4]
test al, al
jne 0x47f1c2
cmp byte [ebx + 0xd4], 0
je 0x47f1d0
mov eax, dword [esp + 0x28]
mov edx, dword [eax + 0x14]
test edx, edx
je 0x47f140
test byte [esi + 0xdd], 0x80
je 0x47f240
cmp dword [esp + 0x24], 0x65
je 0x47f203
mov dword [esp + 4], str.Application_used_invalid_status_code_for_upgrade_response__n
mov dword [esp], esi
call fcn.00488450
xor eax, eax
jmp 0x47f0ce
mov dword [esp], eax
call fcn.0048af90
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x1c], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 0xac], eax
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x47f178
mov dword [esp + 4], str.HEAD
mov dword [esp], eax
call fcn.00488ca0
test eax, eax
jne 0x47f227
cmp dword [esp + 0x24], 0xc7
setbe dl
cmp dword [esp + 0x24], 0xcc
sete al
or dl, al
jne 0x47f227
cmp dword [esp + 0x24], 0x130
je 0x47f227
cmp dword [ebx + 0xa4], 4
je 0x47f257
cmp byte [ebx + 0x9f], 0
jne 0x47f1c2
mov dword [esp], ebx
call fcn.0047f2b0
mov eax, 1
jmp 0x47f0ce
test byte [esi + 0xdc], 8
je 0x47f103
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [ebx + 0x54]
je 0x47f103
mov dword [esp + 4], str.Attempted_to_queue_response_on_wrong_thread__n
mov dword [esp], esi
call fcn.00488450
xor eax, eax
jmp 0x47f0ce
mov dword [esp], eax
call fcn.0048af90
mov eax, dword [esp + 0x28]
mov dword [ebx + 0xac], 0x65
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx + 0x2c]
test eax, eax
jne 0x47f160
mov eax, dword [esp + 0x28]
mov edx, dword [eax + 0x3c]
mov eax, dword [eax + 0x38]
mov dword [ebx + 0x7c], edx
mov dword [ebx + 0x78], eax
jmp 0x47f1a4
mov dword [esp + 4], str.Attempted_upgrade_connection_on_daemon_without_MHD_ALLOW_UPGRADE_option__n
mov dword [esp], esi
call fcn.00488450
xor eax, eax
jmp 0x47f0ce
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x47f1b1
mov dword [esp + 4], str.POST
mov dword [esp], eax
call fcn.00488ca0
test eax, eax
je 0x47f28c
mov byte [ebx + 0x9d], 1
mov dword [ebx + 0xa4], 9
jmp 0x47f1b1
mov dword [esp + 4], 0x548f8c
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call fcn.00488ca0
test eax, eax
jne 0x47f276
jmp 0x47f1b1
Function at 0x482720
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push edi
push esi
push ebx
sub esp, 0x40
jmp 0x482732
mov eax, ebx
mov ebx, dword [eax + 0x60]
test ebx, ebx
jne 0x482730
mov esi, dword [eax + 0xd8]
test esi, esi
jne 0x482750
add esp, 0x40
pop ebx
pop esi
pop edi
ret
xor esi, esi
mov dword [esp + ebx + 0x28], esi
add ebx, 4
cmp ebx, 0x18
jb 0x482752
cmp ecx, 0x10
je 0x48280e
cmp ecx, 0x1c
jne 0x482743
lea ecx, [edx + 8]
mov edx, dword [edx + 8]
mov dword [esp + 0x28], 0x17
mov dword [esp + 0x2c], edx
mov edx, dword [ecx + 4]
mov dword [esp + 0x30], edx
mov edx, dword [ecx + 8]
mov dword [esp + 0x34], edx
mov edx, dword [ecx + 0xc]
mov dword [esp + 0x38], edx
lea edi, [eax + 0x84]
mov dword [esp + 0x1c], eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], 0x482440
lea ebx, [eax + 0x68]
lea eax, [esp + 0x28]
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0049c510
test eax, eax
je 0x482848
mov esi, dword [eax]
mov eax, dword [esi + 0x14]
test eax, eax
je 0x482822
sub eax, 1
test eax, eax
mov dword [esi + 0x14], eax
jne 0x4827fb
mov dword [esp + 8], 0x482440
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.0049c440
mov dword [esp], esi
call sub.msvcrt.dll_free
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x40
pop ebx
pop esi
pop edi
ret
mov edx, dword [edx + 4]
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], edx
jmp 0x482793
mov eax, dword [0x5769c0]
mov dword [esp + 0xc], str.Previously_added_IP_address_had_counter_of_zero_n
mov dword [esp + 8], 0x1cd
mov dword [esp + 4], str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov dword [esp], eax
call dword [0x5769c4]
mov eax, dword [0x5769c0]
mov dword [esp + 0xc], str.Failed_to_find_previously_added_IP_address_n
mov dword [esp + 8], 0x1c7
mov dword [esp + 4], str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov dword [esp], eax
call dword [0x5769c4]
nop
Function at 0x483150
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
push ebp
push edi
lea edi, [eax + 0x9c]
push esi
push ebx
mov esi, eax
sub esp, 0x1c
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp], edi
call ebp
mov ebx, dword [esi + 0x1c]
sub esp, 4
test ebx, ebx
jne 0x483283
jmp 0x4832e0
mov dword [eax], edx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
test eax, eax
je 0x4832a0
mov dword [eax + 4], edx
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
test byte [esi + 0xdc], 4
je 0x4831c1
cmp byte [ebx + 0x9e], 0
je 0x4832b0
mov eax, dword [ebx + 0xd0]
test eax, eax
je 0x4831dd
mov dword [ebx + 0xd0], 0
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x20]
mov dword [esp], eax
call fcn.00488930
mov eax, dword [esi + 0x40]
test eax, eax
je 0x48320a
lea edx, [ebx + 0x28]
mov dword [esp + 0xc], 1
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov edx, dword [esi + 0x44]
mov dword [esp], edx
call eax
mov ecx, dword [ebx + 0x84]
mov edx, dword [ebx + 0x4c]
mov eax, esi
call fcn.00482720
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x483230
mov dword [esp], eax
call sym.xmrig.exe_MHD_destroy_response
mov dword [ebx + 0x1c], 0
mov eax, dword [ebx + 0x98]
cmp eax, 0xffffffff
je 0x48324f
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
test eax, eax
jne 0x4832f4
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x48325e
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov dword [esp], edi
call ebp
mov ebx, dword [esi + 0x1c]
sub esp, 4
sub dword [esi + 0xcc], 1
mov byte [esi + 0xc6], 0
test ebx, ebx
je 0x4832e0
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
test eax, eax
jne 0x483180
mov dword [esi + 0x18], edx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
test eax, eax
jne 0x48318f
mov dword [esi + 0x1c], edx
jmp 0x483192
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebx + 0x50]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
jne 0x48331a
mov eax, dword [ebx + 0x50]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x4831c1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x5769c0]
mov dword [esp + 0xc], str.Close_socket_failed._n
mov dword [esp + 8], 0xc14
mov dword [esp + 4], str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov dword [esp], eax
call dword [0x5769c4]
mov eax, dword [0x5769c0]
mov dword [esp + 0xc], str.Failed_to_join_a_thread_n
mov dword [esp + 8], 0xbdf
mov dword [esp + 4], str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov dword [esp], eax
call dword [0x5769c4]
Function at 0x484f20
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x20]
mov esi, dword [ebx + 0x10]
test byte [esi + 0xdd], 0x20
je 0x485095
mov edx, dword [ebx + 0xd0]
test edx, edx
je 0x484f60
mov dword [esp + 4], str.Error:_connection_scheduled_for__upgrade__cannot_be_suspended
mov dword [esp], esi
call fcn.00488450
add esp, 0x10
pop ebx
pop esi
pop edi
ret
lea edi, [esi + 0x9c]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
cmp byte [ebx + 0xdc], 0
jne 0x485025
test byte [esi + 0xdc], 4
jne 0x484fca
mov ecx, dword [esi + 0xd4]
cmp dword [ebx + 0x8c], ecx
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
je 0x485050
test eax, eax
je 0x485080
mov dword [eax + 8], edx
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
test eax, eax
je 0x485070
mov dword [eax + 0xc], edx
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
test eax, eax
je 0x485020
mov dword [eax], edx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
test eax, eax
je 0x485045
mov dword [eax + 4], edx
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov eax, dword [esi + 0x10]
mov dword [ebx], eax
mov eax, dword [esi + 0x14]
test eax, eax
je 0x485040
mov eax, dword [esi + 0x10]
mov dword [eax + 4], ebx
mov dword [esi + 0x10], ebx
mov byte [ebx + 0xd4], 1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esi + 8], edx
jmp 0x484fd5
mov byte [ebx + 0xdc], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x484f54
mov dword [esi + 0x14], ebx
jmp 0x485000
mov dword [esi + 0xc], edx
jmp 0x484fe1
test eax, eax
je 0x485090
mov dword [eax + 8], edx
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
test eax, eax
jne 0x484fb9
mov dword [esi + 0x24], edx
jmp 0x484fbc
mov dword [esi + 0x2c], edx
jmp 0x484fbc
mov dword [esi + 0x28], edx
jmp 0x484fab
mov dword [esi + 0x20], edx
jmp 0x485057
mov eax, dword [0x5769c0]
mov dword [esp + 0xc], str.Cannot_suspend_connections_without_enabling_MHD_ALLOW_SUSPEND_RESUME__n
mov dword [esp + 8], 0xa5d
mov dword [esp + 4], str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov dword [esp], eax
call dword [0x5769c4]
nop
lea esi, [esi]
Function at 0x4850c0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x20]
mov ebx, dword [esi + 0x10]
test byte [ebx + 0xdd], 0x20
je 0x485163
lea edi, [ebx + 0x9c]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
mov byte [esi + 0xdc], 1
mov byte [ebx + 0xc7], 1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
cmp dword [ebx + 0xbc], 0xffffffff
je 0x48513d
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x54a362
mov eax, dword [ebx + 0xc0]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
test eax, eax
jle 0x485144
add esp, 0x10
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x48513d
mov dword [esp + 4], str.Failed_to_signal_resume_via_inter_thread_communication_channel.
mov dword [esp], ebx
call fcn.00488450
jmp 0x48513d
mov eax, dword [0x5769c0]
mov dword [esp + 0xc], str.Cannot_resume_connections_without_enabling_MHD_ALLOW_SUSPEND_RESUME__n
mov dword [esp + 8], 0xa7b
mov dword [esp + 4], str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov dword [esp], eax
call dword [0x5769c4]
lea esi, [esi]