joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459b14
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov byte [ebx], 0
cmp dword [ebp + 8], 0
jle 0x459b4b
call fcn.00459db8
inc eax
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
cmp edx, dword [ebp - 4]
je 0x459b4b
mov ecx, dword [ebp + 8]
dec ecx
push ecx
call fcn.00459d68
pop ecx
call fcn.0041ac90
mov edi, dword [ebp + 0x10]
mov eax, edi
add eax, eax
push eax
call fcn.0043b368
pop ecx
mov esi, eax
mov word [esi], 0
push 0
push esi
push edi
call sub.KERNEL32.DLL_GetCurrentDirectoryW
test eax, eax
setne al
and eax, 1
push eax
call fcn.0045a8c8
mov word [esi + edi*2 - 2], 0
add esp, 8
mov edx, dword [ebp + 0x10]
dec edx
push edx
push ebx
push esi
call fcn.00449920
add esp, 0xc
push esi
call fcn.0043b450
pop ecx
call fcn.0041ad00
call fcn.0045a88c
mov edi, eax
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
je 0x459bc2
mov edx, dword [ebp - 4]
dec edx
push edx
call fcn.00459d68
pop ecx
push edi
call fcn.0045a8b4
pop ecx
mov ecx, dword [ebp + 0x10]
mov byte [ebx + ecx - 1], 0
test edi, edi
jne 0x459c47
cmp byte [ebx], 0
je 0x459c47
push ebx
call fcn.004ab86c
pop ecx
mov dword [ebp - 8], ebx
mov esi, eax
mov eax, dword [ebp - 8]
cmp byte [eax + 1], 0x3a
jne 0x459bef
add dword [ebp - 8], 2
sub esi, 2
mov edx, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [edx]
push ecx
push 0x5427cc
call fcn.004ab818
add esp, 8
test eax, eax
je 0x459c0c
inc dword [ebp - 8]
dec esi
test esi, esi
je 0x459c2c
mov eax, dword [ebp - 8]
xor edx, edx
mov dl, byte [eax + esi - 1]
push edx
push 0x5427cc
call fcn.004ab818
add esp, 8
test eax, eax
je 0x459c2c
dec esi
test esi, esi
je 0x459c43
cmp ebx, dword [ebp - 8]
je 0x459c43
push esi
mov ecx, dword [ebp - 8]
push ecx
push ebx
call fcn.004ab6ec
add esp, 0xc
mov byte [ebx + esi], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x459c50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov byte [esi], 0
call fcn.0041ac90
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add edx, edx
push edx
call fcn.0043b368
pop ecx
mov ebx, eax
mov word [ebx], 0
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetCurrentDirectoryW
test eax, eax
setne dl
and edx, 1
mov edi, edx
push 0
push edi
call fcn.0045a8c8
add esp, 8
mov eax, dword [ebp - 4]
mov word [ebx + eax*2 - 2], 0
mov edx, dword [ebp + 0xc]
dec edx
push edx
push esi
push ebx
call fcn.00449920
add esp, 0xc
push ebx
call fcn.0043b450
pop ecx
call fcn.0041ad00
mov ecx, dword [ebp + 0xc]
mov byte [esi + ecx - 1], 0
test edi, edi
je 0x459d02
cmp byte [esi], 0
je 0x459d02
push esi
call fcn.004ab86c
pop ecx
mov ebx, eax
lea eax, [ebx + 1]
cmp eax, dword [ebp + 0xc]
jae 0x459d02
xor edx, edx
mov dl, byte [esi + ebx - 1]
push edx
push 0x5427cc
call fcn.004ab818
add esp, 8
test eax, eax
jne 0x459d02
mov byte [esi + ebx], 0x5c
inc ebx
mov byte [esi + ebx], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x459d0c
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.0045a45c
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0041ac90
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov edi, eax
push ebx
call sub.KERNEL32.DLL_SetCurrentDirectoryW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.0045a8c8
add esp, 8
push edi
call sub.KERNEL32.DLL_SetErrorMode
call fcn.0041ad00
test esi, esi
je 0x459d5f
push esi
call fcn.0043b450
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x45aa40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov byte [eax], 0
call fcn.0041ac90
xor esi, esi
xor edi, edi
test ebx, ebx
je 0x45aa6d
push ebx
call fcn.0045a45c
pop ecx
mov esi, eax
jmp 0x45aa6f
xor eax, eax
cmp dword [ebp + 0xc], 0
mov ebx, eax
je 0x45aa90
mov edx, dword [ebp + 0xc]
cmp byte [edx], 0
je 0x45aa90
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0045a45c
pop ecx
mov edi, eax
mov dword [ebp - 4], eax
jmp 0x45aac7
lea edx, [ebp - 0x424]
push edx
push 0x108
call sub.KERNEL32.DLL_GetTempPathW
test eax, eax
jne 0x45aab5
push 0
push 0
call fcn.0045a8c8
add esp, 8
xor eax, eax
jmp 0x45ab29
mov word [ebp - 0x216], 0
lea edx, [ebp - 0x424]
mov dword [ebp - 4], edx
lea ecx, [ebp - 0x214]
push ecx
push 0
test ebx, ebx
jne 0x45aad9
mov ebx, 0x5427d0
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetTempFileNameW
mov ebx, eax
test ebx, ebx
je 0x45ab01
push 0x107
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x214]
push ecx
call fcn.00449920
add esp, 0xc
test esi, esi
je 0x45ab0c
push esi
call fcn.0043b450
pop ecx
test edi, edi
je 0x45ab17
push edi
call fcn.0043b450
pop ecx
push 0
push ebx
call fcn.0045a8c8
add esp, 8
call fcn.0041ad00
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45ab78
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
mov ebx, dword [ebp + 8]
or esi, 0xffffffff
mov byte [ebx], 0
lea eax, [ebp - 0x210]
push eax
push 0x108
call sub.KERNEL32.DLL_GetTempPathW
test eax, eax
je 0x45abbe
mov word [ebp - 2], 0
push 0x107
push ebx
lea eax, [ebp - 0x210]
xor esi, esi
push eax
call fcn.00449920
add esp, 0xc
test esi, esi
jne 0x45abe7
cmp byte [ebx], 0
je 0x45abe7
push ebx
call fcn.004ab86c
cmp byte [ebx + eax - 1], 0x5c
pop ecx
je 0x45abf2
cmp eax, 0x107
jge 0x45abf2
mov byte [ebx + eax], 0x5c
mov byte [ebx + eax + 1], 0
jmp 0x45abf2
mov byte [ebx], 0x2e
mov byte [ebx + 1], 0x5c
mov byte [ebx + 2], 0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c0f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x45c1e1
call sub.USER32.DLL_EmptyClipboard
cmp dword [ebp + 8], 0xd
jne 0x45c129
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.00440c74
add esp, 0x10
mov esi, eax
jmp 0x45c141
push 0
push 0
call fcn.00449484
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00440ba0
add esp, 0x10
mov esi, eax
test esi, esi
je 0x45c1d7
cmp dword [ebp + 8], 0xd
lea eax, [esi + 1]
jne 0x45c159
mov edx, 2
jmp 0x45c15e
mov edx, 1
imul edx
push eax
push 2
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test ebx, ebx
je 0x45c1dc
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45c1cb
cmp dword [ebp + 8], 0xd
jne 0x45c199
inc esi
push esi
mov eax, dword [ebp - 4]
push eax
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.00440c74
add esp, 0x10
jmp 0x45c1b1
inc esi
push esi
mov eax, dword [ebp - 4]
push eax
call fcn.00449484
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.00440ba0
add esp, 0x10
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
mov ecx, dword [ebp + 8]
push ecx
call sub.USER32.DLL_SetClipboardData
test eax, eax
setne al
and eax, 1
mov edi, eax
test edi, edi
jne 0x45c1dc
push ebx
call sub.KERNEL32.DLL_GlobalFree
jmp 0x45c1dc
mov edi, 1
call sub.USER32.DLL_CloseClipboard
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x45c1ec
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
call sub.USER32.DLL_IsClipboardFormatAvailable
test eax, eax
je 0x45c2b3
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x45c2b3
push edi
call sub.USER32.DLL_GetClipboardData
mov esi, eax
test esi, esi
je 0x45c2ae
push esi
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45c2ae
push esi
call sub.KERNEL32.DLL_GlobalSize
mov ebx, eax
mov eax, edi
dec eax
je 0x45c275
sub eax, 6
je 0x45c275
sub eax, 6
jne 0x45c284
shr ebx, 1
push ebx
mov edx, dword [ebp - 4]
push edx
call fcn.004406c0
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x45c2a8
push ebx
mov ecx, dword [ebp - 4]
push ecx
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.00440da0
add esp, 0x10
jmp 0x45c2a8
push ebx
mov edx, dword [ebp - 4]
push edx
call fcn.004a8830
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x45c2a8
push ebx
cmp edi, 1
mov ecx, dword [ebp - 4]
push ecx
jne 0x45c299
call fcn.00449484
jmp 0x45c29b
xor eax, eax
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.00440ce4
add esp, 0x10
push esi
call sub.KERNEL32.DLL_GlobalUnlock
call sub.USER32.DLL_CloseClipboard
test ebx, ebx
jne 0x45c2c5
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0043dc4c
add esp, 8
test ebx, ebx
setne al
and eax, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45c69c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
xor ebx, ebx
push esp
call sub.USER32.DLL_GetKeyboardState
test byte [esp + 0x10], 0x80
je 0x45c6b5
or ebx, 1
test byte [esp + 0x11], 0x80
je 0x45c6bf
or ebx, 2
test byte [esp + 0x12], 0x80
je 0x45c6c9
or ebx, 4
test byte [esp + 0x5b], 0x80
je 0x45c6d3
or ebx, 8
test byte [esp + 0x5c], 0x80
je 0x45c6dd
or ebx, 0x10
test byte [esp + 0x5d], 0x80
je 0x45c6e7
or ebx, 0x20
test byte [esp + 0x91], 1
je 0x45c6f7
or ebx, 0x100
test byte [esp + 0x90], 1
je 0x45c707
or ebx, 0x200
test byte [esp + 0x14], 1
je 0x45c714
or ebx, 0x400
test byte [esp + 0x2d], 1
je 0x45c721
or ebx, 0x80
test byte [esp + 0xa0], 0x80
je 0x45c731
or ebx, 0x10000
test byte [esp + 0xa1], 0x80
je 0x45c741
or ebx, 0x20000
test byte [esp + 0xa2], 0x80
je 0x45c751
or ebx, 0x40000
test byte [esp + 0xa3], 0x80
je 0x45c761
or ebx, 0x80000
test byte [esp + 0xa4], 0x80
je 0x45c771
or ebx, 0x100000
test byte [esp + 0xa5], 0x80
je 0x45c781
or ebx, 0x200000
mov eax, ebx
add esp, 0x100
pop ebx
ret

Function at 0x45c78c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call sub.USER32.DLL_GetKeyboardState
test bl, 1
je 0x45c7ae
mov dl, 0x80
jmp 0x45c7b0
xor edx, edx
test bl, 2
mov byte [ebp - 0xf0], dl
je 0x45c7bf
mov al, 0x80
jmp 0x45c7c1
xor eax, eax
test bl, 4
mov byte [ebp - 0xef], al
je 0x45c7d0
mov dl, 0x80
jmp 0x45c7d2
xor edx, edx
test bl, 8
mov byte [ebp - 0xee], dl
je 0x45c7e1
mov al, 0x80
jmp 0x45c7e3
xor eax, eax
test bl, 0x10
mov byte [ebp - 0xa5], al
je 0x45c7f2
mov dl, 0x80
jmp 0x45c7f4
xor edx, edx
test bl, 0x20
mov byte [ebp - 0xa4], dl
je 0x45c803
mov al, 0x80
jmp 0x45c805
xor eax, eax
test bh, 1
mov byte [ebp - 0xa3], al
je 0x45c814
mov dl, 1
jmp 0x45c816
xor edx, edx
test bh, 2
mov byte [ebp - 0x6f], dl
je 0x45c822
mov al, 1
jmp 0x45c824
xor eax, eax
test bh, 4
mov byte [ebp - 0x70], al
je 0x45c830
mov dl, 1
jmp 0x45c832
xor edx, edx
test bl, 0x80
mov byte [ebp - 0xec], dl
je 0x45c841
mov al, 1
jmp 0x45c843
xor eax, eax
test ebx, 0x10000
mov byte [ebp - 0xd3], al
je 0x45c855
mov dl, 0x80
jmp 0x45c857
xor edx, edx
test ebx, 0x20000
mov byte [ebp - 0x60], dl
je 0x45c866
mov al, 0x80
jmp 0x45c868
xor eax, eax
test ebx, 0x40000
mov byte [ebp - 0x5f], al
je 0x45c877
mov dl, 0x80
jmp 0x45c879
xor edx, edx
test ebx, 0x80000
mov byte [ebp - 0x5e], dl
je 0x45c888
mov al, 0x80
jmp 0x45c88a
xor eax, eax
test ebx, 0x100000
mov byte [ebp - 0x5d], al
je 0x45c899
mov dl, 0x80
jmp 0x45c89b
xor edx, edx
test ebx, 0x200000
mov byte [ebp - 0x5c], dl
je 0x45c8aa
mov al, 0x80
jmp 0x45c8ac
xor eax, eax
mov byte [ebp - 0x5b], al
lea edx, [ebp - 0x100]
push edx
call sub.USER32.DLL_SetKeyboardState
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45d010
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor eax, 0xffffffff
test edx, edx
mov ecx, dword [ebp + 0x10]
je 0x45d046
test ecx, ecx
je 0x45d046
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x5427f8]
xor ebx, eax
dec ecx
mov eax, ebx
jne 0x45d028
xor eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x45d04c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor ax, 0xffff
test edx, edx
mov ecx, dword [ebp + 0x10]
je 0x45d08b
test ecx, ecx
je 0x45d08b
movzx ebx, ax
movzx edi, byte [edx]
mov esi, ebx
inc edx
xor esi, edi
and esi, 0xff
sar ebx, 8
mov si, word [esi*2 + 0x542bf8]
xor si, bx
dec ecx
mov eax, esi
jne 0x45d067
xor ax, 0xffff
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x465c1c
Capabilities:
Initialize winsock library

Disassembly:
push ebx
add esp, 0xfffffe70
xor ebx, ebx
push 0x543374
call fcn.00449c3c
pop ecx
inc dword [0x555ee8]
mov eax, dword [0x555ee8]
dec eax
jne 0x465c4b
push esp
push 0x101
call sub.WS2_32.DLL_WSAStartup
mov ebx, eax
push 0x543374
call fcn.00449c5c
pop ecx
mov eax, ebx
add esp, 0x190
pop ebx
ret
Function at 0x466130
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 8]
jne 0x46614d
cmp dword [ebp + 0xc], 0
ja 0x466155
jmp 0x46614f
jg 0x466155
xor eax, eax
xor edx, edx
jmp 0x46615a
call fcn.004a4adc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
xor ecx, ecx
mov dword [ebp - 0x11c], ecx
xor eax, eax
lea edx, [ebp - 0x118]
jmp 0x46617a
cmp ebx, dword [edx]
je 0x466182
inc eax
add edx, 4
cmp eax, dword [ebp - 0x11c]
jb 0x466172
mov edx, dword [ebp - 0x11c]
cmp eax, edx
jne 0x46619e
cmp edx, 0x40
jae 0x46619e
mov dword [ebp + eax*4 - 0x118], ebx
inc dword [ebp - 0x11c]
cmp dword [ebp + 0x10], 0
jne 0x4661ac
cmp dword [ebp + 0xc], 0
jb 0x4661eb
jmp 0x4661ae
jl 0x4661eb
push 0
push 0x3e8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call fcn.004af4bf
mov dword [ebp - 8], eax
push 0
push 0x3e8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call fcn.004af580
mov edx, eax
lea eax, [ebp - 8]
shl edx, 3
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
mov dword [ebp - 4], edx
jmp 0x4661ed
xor eax, eax
push eax
push 0
push 0
lea edx, [ebp - 0x11c]
push edx
lea ecx, [ebx + 1]
push ecx
call sub.WS2_32.DLL_select
mov esi, eax
test esi, esi
jl 0x46620c
xor edi, edi
jmp 0x466213
call sub.WS2_32.DLL_WSAGetLastError
mov edi, eax
push edi
call fcn.00465c84
pop ecx
cmp esi, 0xffffffff
jne 0x4662a6
cmp dword [ebp + 0x10], 0
jne 0x466231
cmp dword [ebp + 0xc], 0
jbe 0x4662a6
jmp 0x466233
jle 0x4662a6
cmp edi, 0x2714
jne 0x4662a6
call fcn.0042557c
test ax, ax
jne 0x4662a6
call fcn.004a4adc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0xc]
jne 0x46625e
cmp eax, dword [ebp - 0x10]
jbe 0x4662a6
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push edx
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
sbb edx, dword [ebp - 0xc]
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0x10], 0
jne 0x4662a0
cmp dword [ebp + 0xc], 0
jbe 0x4662a6
jmp 0x466160
jg 0x466160
test esi, esi
jge 0x4662af
or eax, 0xffffffff
jmp 0x4662cd
test esi, esi
jle 0x4662cb
lea edx, [ebp - 0x11c]
push edx
push ebx
call sub.WS2_32.DLL___WSAFDIsSet
test eax, eax
je 0x4662cb
mov eax, 1
jmp 0x4662cd
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4662d4
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 8]
jne 0x4662f1
cmp dword [ebp + 0xc], 0
ja 0x4662f9
jmp 0x4662f3
jg 0x4662f9
xor eax, eax
xor edx, edx
jmp 0x4662fe
call fcn.004a4adc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
xor ecx, ecx
mov dword [ebp - 0x11c], ecx
xor eax, eax
lea edx, [ebp - 0x118]
jmp 0x46631e
cmp ebx, dword [edx]
je 0x466326
inc eax
add edx, 4
cmp eax, dword [ebp - 0x11c]
jb 0x466316
mov edx, dword [ebp - 0x11c]
cmp eax, edx
jne 0x466342
cmp edx, 0x40
jae 0x466342
mov dword [ebp + eax*4 - 0x118], ebx
inc dword [ebp - 0x11c]
cmp dword [ebp + 0x10], 0
jne 0x466350
cmp dword [ebp + 0xc], 0
jb 0x46638f
jmp 0x466352
jl 0x46638f
push 0
push 0x3e8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call fcn.004af4bf
mov dword [ebp - 8], eax
push 0
push 0x3e8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call fcn.004af580
mov edx, eax
lea eax, [ebp - 8]
shl edx, 3
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
mov dword [ebp - 4], edx
jmp 0x466391
xor eax, eax
push eax
lea edx, [ebp - 0x11c]
push 0
push edx
lea ecx, [ebx + 1]
push 0
push ecx
call sub.WS2_32.DLL_select
mov esi, eax
test esi, esi
jl 0x4663b0
xor edi, edi
jmp 0x4663b7
call sub.WS2_32.DLL_WSAGetLastError
mov edi, eax
push edi
call fcn.00465c84
pop ecx
cmp esi, 0xffffffff
jne 0x46644a
cmp dword [ebp + 0x10], 0
jne 0x4663d5
cmp dword [ebp + 0xc], 0
jbe 0x46644a
jmp 0x4663d7
jle 0x46644a
cmp edi, 0x2714
jne 0x46644a
call fcn.0042557c
test ax, ax
jne 0x46644a
call fcn.004a4adc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0xc]
jne 0x466402
cmp eax, dword [ebp - 0x10]
jbe 0x46644a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push edx
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
sbb edx, dword [ebp - 0xc]
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0x10], 0
jne 0x466444
cmp dword [ebp + 0xc], 0
jbe 0x46644a
jmp 0x466304
jg 0x466304
test esi, esi
jge 0x466453
or eax, 0xffffffff
jmp 0x466471
test esi, esi
jle 0x46646f
lea edx, [ebp - 0x11c]
push edx
push ebx
call sub.WS2_32.DLL___WSAFDIsSet
test eax, eax
je 0x46646f
mov eax, 1
jmp 0x466471
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466d9c
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
call fcn.0041ac90
cmp dword [ebp + 0x18], 0
jne 0x466dbb
cmp dword [ebp + 0x14], 0
jae 0x466dc1
jmp 0x466dbd
jge 0x466dc1
xor eax, eax
jmp 0x466dcc
push 0
push edi
call fcn.00467128
add esp, 8
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push edi
call sub.WS2_32.DLL_connect
mov ebx, eax
test ebx, ebx
jne 0x466de7
xor esi, esi
jmp 0x466dee
call sub.WS2_32.DLL_WSAGetLastError
mov esi, eax
push esi
call fcn.00465c84
pop ecx
test ebx, ebx
je 0x466e39
cmp dword [ebp + 0x18], 0
jne 0x466e07
cmp dword [ebp + 0x14], 0
jb 0x466e39
jmp 0x466e09
jl 0x466e39
cmp esi, 0x2733
jne 0x466e39
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
call fcn.00466478
add esp, 0xc
mov ebx, eax
test ebx, ebx
jle 0x466e2a
xor ebx, ebx
jmp 0x466e39
test ebx, ebx
jne 0x466e39
push 2
call fcn.00465c04
pop ecx
or ebx, 0xffffffff
cmp dword [ebp - 4], 0
jle 0x466e78
call fcn.00465bd8
mov esi, eax
test esi, esi
je 0x466e4e
xor eax, eax
jmp 0x466e53
call fcn.00465bcc
mov dword [ebp - 8], eax
push 1
push edi
call fcn.00467128
add esp, 8
test esi, esi
je 0x466e6e
push esi
call fcn.00465c84
pop ecx
jmp 0x466e78
mov edx, dword [ebp - 8]
push edx
call fcn.00465c04
pop ecx
call fcn.0041ad00
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x466e88
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov edi, dword [ebp + 8]
call fcn.0041ac90
cmp dword [ebp + 0x1c], 0
jne 0x466ea6
cmp dword [ebp + 0x18], 0
jb 0x466ec8
jmp 0x466ea8
jl 0x466ec8
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push edi
call fcn.004662d4
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x466ec8
push 2
call fcn.00465c04
pop ecx
or ebx, 0xffffffff
test ebx, ebx
jl 0x466f05
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push edi
call sub.WS2_32.DLL_send
mov ebx, eax
call sub.WS2_32.DLL_WSAGetLastError
mov esi, eax
push esi
call fcn.00465c84
pop ecx
cmp ebx, 0xffffffff
jne 0x466f05
cmp esi, 0x2714
jne 0x466f05
call fcn.0042557c
test ax, ax
je 0x466ecc
call fcn.0041ad00
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x466f14
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov edi, dword [ebp + 8]
call fcn.0041ac90
cmp dword [ebp + 0x24], 0
jne 0x466f32
cmp dword [ebp + 0x20], 0
jb 0x466f54
jmp 0x466f34
jl 0x466f54
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push edi
call fcn.004662d4
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x466f54
push 2
call fcn.00465c04
pop ecx
or ebx, 0xffffffff
test ebx, ebx
jl 0x466f99
mov eax, dword [ebp + 0x1c]
push eax
mov edx, dword [ebp + 0x18]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
push edi
call sub.WS2_32.DLL_sendto
mov ebx, eax
call sub.WS2_32.DLL_WSAGetLastError
mov esi, eax
push esi
call fcn.00465c84
pop ecx
cmp ebx, 0xffffffff
jne 0x466f99
cmp esi, 0x2714
jne 0x466f99
call fcn.0042557c
test ax, ax
je 0x466f58
call fcn.0041ad00
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x466fa8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov edi, dword [ebp + 8]
call fcn.0041ac90
cmp dword [ebp + 0x1c], 0
jne 0x466fc6
cmp dword [ebp + 0x18], 0
jb 0x466fe8
jmp 0x466fc8
jl 0x466fe8
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push edi
call fcn.00466130
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x466fe8
push 2
call fcn.00465c04
pop ecx
or ebx, 0xffffffff
test ebx, ebx
jl 0x467025
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push edi
call sub.WS2_32.DLL_recv
mov ebx, eax
call sub.WS2_32.DLL_WSAGetLastError
mov esi, eax
push esi
call fcn.00465c84
pop ecx
cmp ebx, 0xffffffff
jne 0x467025
cmp esi, 0x2714
jne 0x467025
call fcn.0042557c
test ax, ax
je 0x466fec
call fcn.0041ad00
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret