joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4abed0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0
ja 0x4abf88
cmp dword [esi + 0x10], 0
ja 0x4abf88
cmp dword [esi + 0x2c], 0
jne 0x4abf88
movsd xmm0, qword [0x545b68]
xor edi, edi
ucomisd xmm0, qword [0x535468]
lahf
test ah, 0x44
jp 0x4abf30
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
jmp 0x4ac0aa
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x4abf5b
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
jmp 0x4ac0aa
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
call fcn.0051a980
mulsd xmm0, qword [0x545b68]
mulsd xmm0, qword [0x5354a8]
call fcn.0051a820
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
jmp 0x4ac0aa
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, 1
xorps xmm1, xmm1
cmp dword [esi + 0x18], 0
jne 0x4ac0b0
movsd xmm0, qword [0x545b68]
ucomisd xmm0, xmm1
lahf
test ah, 0x44
jp 0x4abfc5
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
jmp 0x4ac005
lea eax, [esp + 0x18]
push eax
call ebx
test eax, eax
jne 0x4abfe3
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
jmp 0x4ac005
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
call fcn.0051a980
mulsd xmm0, qword [0x545b68]
mulsd xmm0, qword [0x5354a8]
call fcn.0051a820
mov ecx, esi
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
call fcn.004afd40
mov ecx, esi
call fcn.004ab0e0
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x48], eax
test eax, eax
je 0x4ac03b
mov ecx, dword [esi + 0x48]
push ecx
mov eax, dword [ecx + 0x34]
mov dword [esi + 0x48], eax
mov eax, dword [ecx + 0x38]
call eax
add esp, 4
cmp dword [esi + 0x48], 0
jne 0x4ac023
mov eax, dword [esi + 0x34]
mov dword [esi + 0x40], eax
test eax, eax
je 0x4ac05d
mov ecx, dword [esi + 0x40]
push ecx
mov eax, dword [ecx + 0x34]
mov dword [esi + 0x40], eax
mov eax, dword [ecx + 0x38]
call eax
add esp, 4
cmp dword [esi + 0x40], 0
jne 0x4ac045
mov ecx, esi
call fcn.004abc10
mov edx, eax
mov ecx, esi
call fcn.004abc90
mov eax, dword [esi + 0x38]
mov dword [esi + 0x44], eax
test eax, eax
je 0x4ac08f
mov ecx, dword [esi + 0x44]
push ecx
mov eax, dword [ecx + 0x34]
mov dword [esi + 0x44], eax
mov eax, dword [ecx + 0x38]
call eax
add esp, 4
cmp dword [esi + 0x44], 0
jne 0x4ac077
mov ecx, esi
call fcn.004aaeb0
mov ecx, esi
call fcn.004abeb0
mov edi, eax
xorps xmm1, xmm1
test edi, edi
jne 0x4abf96
cmp dword [esi + 0x18], 0
je 0x4ac0b7
mov dword [esi + 0x18], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ad720
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
sub esp, 0x34
mov eax, dword [0x53c074]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x2c]
and ecx, 0xffffefff
add dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x2c], ecx
mov eax, ecx
jne 0x4ad763
test cl, 1
jne 0x4ad763
test cl, 4
je 0x4ad763
and eax, 0xfffffffb
mov dword [esi + 0x2c], eax
test al, 8
je 0x4ad763
mov eax, dword [esi + 4]
dec dword [eax + 4]
mov eax, dword [esi + 0x2c]
test eax, 0x10000
je 0x4ad8cc
test eax, 0x2000000
je 0x4ad7bc
lea eax, [esp + 8]
mov dword [esp + 0x34], 0
push eax
push 1
lea eax, [esp + 0x2c]
xorps xmm0, xmm0
push eax
push dword [esi + 0x90]
movups xmmword [esp + 0x34], xmm0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x4ad8cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004c3717
add esp, 0x34
ret
test eax, 0x200000
jne 0x4ad8cc
push 0xffffffffffffffff
push dword [0x545b4c]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4ad8df
mov eax, 2
mov ecx, 0x545b2c
xchg dword [ecx], eax
cmp eax, 1
je 0x4ad80c
push ebx
push 1
push dword [0x545b4c]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x4ad8df
jmp 0x4ad8c5
push ebp
push edi
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push str.conout_
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov ebp, 1
cmp edi, 0xffffffff
je 0x4ad84f
push 0x545b30
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x4ad84f
mov eax, 0x545b48
lock or dword [eax], ebp
mov word [esp + 0x18], bp
mov dword [esp + 0x1c], ebp
mov ebp, 0xd
push 0
push ebp
mov dword [esp + 0x28], 0xd0001
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [esp + 0x24], ax
lea eax, [esp + 0x14]
push eax
push 1
lea eax, [esp + 0x20]
mov word [esp + 0x2e], bp
push eax
push dword [esi + 0x90]
mov dword [esp + 0x38], ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x4ad8a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp edi, 0xffffffff
je 0x4ad8ac
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
test ebx, ebx
je 0x4ad8c5
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004c3717
add esp, 0x34
ret
or dword [esi + 0x2c], 0x200000
mov ecx, dword [esp + 0x38]
xor eax, eax
pop esi
pop ebx
xor ecx, esp
call fcn.004c3717
add esp, 0x34
ret
call fcn.004cebb9
int3
Function at 0x4ada60
Capabilities:
Manipulate console buffer

Disassembly:
sub esp, 0x2c
mov eax, dword [0x53c074]
xor eax, esp
mov dword [esp + 0x28], eax
push ebp
push esi
mov esi, dword [esp + 0x44]
mov ebp, edx
mov eax, ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], esi
cmp dword [esi], 0
je 0x4ada9d
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004c3717
add esp, 0x2c
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
lea ecx, [esp + 0x20]
push ecx
push dword [eax + 0x90]
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x4adabe
call ebx
mov dword [esi], eax
movsx eax, word [esp + 0x2c]
mov edx, ebp
movsx esi, word [esp + 0x30]
movsx ebp, word [esp + 0x20]
sub esi, eax
mov eax, dword [0x53d64c]
inc esi
movsx edi, word [esp + 0x26]
mov dword [0x53d65c], ebp
mov dword [0x53d650], esi
cmp eax, 0xffffffff
jne 0x4adaf1
mov eax, edi
jmp 0x4adafb
mov ecx, edi
sub ecx, esi
inc ecx
cmp eax, ecx
cmovl eax, ecx
movsx ebx, word [esp + 0x22]
lea ecx, [esi + eax]
cmp ecx, ebx
jle 0x4adb0b
mov eax, ebx
sub eax, esi
xor ecx, ecx
test eax, eax
cmovs eax, ecx
cmp byte [esp + 0x48], cl
mov ecx, dword [esp + 0x44]
mov dword [0x53d64c], eax
je 0x4adb25
add ecx, edi
jmp 0x4adb27
add ecx, eax
cmp ecx, eax
jge 0x4adb2f
mov ecx, eax
jmp 0x4adb38
add eax, esi
cmp ecx, eax
jl 0x4adb38
lea ecx, [eax - 1]
cmp byte [esp + 0x40], 0
je 0x4adb48
movsx edx, word [esp + 0x24]
add edx, dword [esp + 0x18]
test edx, edx
jns 0x4adb50
xor edx, edx
jmp 0x4adb57
cmp edx, ebp
jl 0x4adb57
lea edx, [ebp - 1]
mov eax, dword [esp + 0x14]
mov word [esp + 0x10], dx
mov word [esp + 0x12], cx
push dword [esp + 0x10]
push dword [eax + 0x90]
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x4adbb2
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov esi, dword [esp + 0x1c]
cmp eax, 0x57
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
je 0x4adaa5
call ebx
pop edi
mov ecx, esi
pop ebx
pop esi
pop ebp
mov dword [ecx], eax
or eax, 0xffffffff
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004c3717
add esp, 0x2c
ret
mov ecx, dword [esp + 0x38]
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
xor ecx, esp
call fcn.004c3717
add esp, 0x2c
ret
Function at 0x4afe50
Capabilities:
Get common file path

Disassembly:
push ebx
push ebp
mov ebp, ecx
mov ebx, edx
test ebp, ebp
jne 0x4afe6f
test ebx, ebx
je 0x4afe60
mov dword [ebx], ecx
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
mov dword [eax], 0
xor eax, eax
ret
push edi
mov edi, ebp
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4afe75
sub edi, ecx
sar edi, 1
push esi
mov esi, edi
test esi, esi
je 0x4afe9f
movzx eax, word [ebp + esi*2 - 2]
dec esi
cmp eax, 0x5c
je 0x4afe9b
cmp eax, 0x2f
jne 0x4afe87
test esi, esi
jne 0x4afef6
test ebx, ebx
je 0x4afee0
push 0x20a
call dword [0x53d638]
add esp, 4
mov dword [ebx], eax
test eax, eax
je 0x4aff72
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x4afee0
mov ecx, dword [ebx]
call fcn.004aa760
pop esi
pop edi
pop ebp
mov dword [ebx], 0
or eax, 0xffffffff
pop ebx
ret
push ebp
call fcn.004d1cf3
mov ecx, dword [esp + 0x18]
add esp, 4
pop esi
pop edi
pop ebp
mov dword [ecx], eax
xor eax, eax
pop ebx
ret
test ebx, ebx
je 0x4aff2d
lea eax, [esi*2 + 4]
push eax
call dword [0x53d638]
add esp, 4
mov dword [ebx], eax
test eax, eax
je 0x4aff72
lea ecx, [esi + 1]
push ecx
push ebp
push eax
call fcn.004cf12a
mov eax, dword [ebx]
add esp, 0xc
xor ecx, ecx
lea ebx, [esi + esi]
mov word [eax + ebx + 2], cx
jmp 0x4aff30
lea ebx, [esi + esi]
sub edi, esi
lea esi, [edi + edi]
push esi
call dword [0x53d638]
mov ecx, eax
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
test ecx, ecx
je 0x4aff72
lea eax, [edi - 1]
push eax
lea eax, [ebp + 2]
add eax, ebx
push eax
push ecx
call fcn.004cf12a
mov eax, dword [esp + 0x20]
add esp, 0xc
xor ecx, ecx
mov eax, dword [eax]
mov word [esi + eax - 2], cx
xor eax, eax
pop esi
pop edi
pop ebp
pop ebx
ret
mov edx, str.uv__malloc
mov ecx, 0xe
call fcn.004b88e0
int3
Function at 0x4b1d50
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov eax, dword [ecx + 0x2c]
push esi
mov esi, edx
test al, 1
je 0x4b1d63
mov eax, 0xfffff00d
pop esi
pop ecx
ret
test eax, 0x8000
jne 0x4b1d72
mov eax, 0xfffff031
pop esi
pop ecx
ret
mov eax, dword [ecx + 8]
sub eax, 7
je 0x4b1df9
sub eax, 5
je 0x4b1db9
sub eax, 2
je 0x4b1d8c
mov eax, 0xfffff02a
pop esi
pop ecx
ret
cmp dword [ecx + 0x88], 0
ja 0x4b1df9
lea eax, [esp + 4]
push eax
push ecx
call fcn.004ae2a0
add esp, 8
test eax, eax
je 0x4b1db4
mov ecx, dword [esp + 4]
pop esi
add esp, 4
jmp fcn.004b8970
mov eax, dword [esi]
pop esi
pop ecx
ret
cmp dword [ecx + 0x88], 0
ja 0x4b1df9
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 1
push esi
push dword [ecx + 0x90]
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x4b1df2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
pop esi
add esp, 4
jmp fcn.004b8970
mov eax, dword [esp + 4]
pop esi
pop ecx
ret
mov eax, 0xfffff008
pop esi
pop ecx
ret
Function at 0x4b24b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x114]
mov ebp, dword [esi + 0x110]
mov dword [esp + 0x14], eax
cmp ecx, 0xffffffff
jne 0x4b24ed
mov dword [esi + 0x48], 0xfffff00d
mov dword [esi + 0xf0], 6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
xorps xmm0, xmm0
mov dword [esp + 0x1c], 0
push ecx
movlpd qword [esp + 0x2c], xmm0
call fcn.004cefb4
mov ecx, eax
add esp, 4
mov dword [esp + 0x20], ecx
cmp ecx, 0xffffffff
jne 0x4b2531
mov ecx, 6
mov dword [esi + 0xf0], 6
call fcn.004b8970
mov dword [esi + 0x48], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
mov edx, dword [esp + 0x14]
mov eax, ebp
and eax, edx
cmp eax, 0xffffffff
je 0x4b257e
lea eax, [esp + 0x3c]
mov dword [esp + 0x4c], 0
push 1
mov dword [esp + 0x1c], eax
xorps xmm0, xmm0
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x34]
movups xmmword [esp + 0x48], xmm0
push dword [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov edx, dword [esp + 0x14]
test eax, eax
je 0x4b2586
mov dword [esp + 0x1c], 1
jmp 0x4b2586
mov dword [esp + 0x18], 0
xor ebx, ebx
xor edi, edi
nop word [eax + eax]
mov eax, ebp
and eax, edx
cmp eax, 0xffffffff
je 0x4b25a9
mov eax, edi
xor ecx, ecx
add eax, ebp
mov dword [esp + 0x44], eax
adc ecx, edx
mov dword [esp + 0x48], ecx
push dword [esp + 0x18]
mov eax, dword [esi + 0x10c]
lea ecx, [esp + 0x28]
push ecx
push dword [eax + ebx*8]
push dword [eax + ebx*8 + 4]
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
add edi, dword [esp + 0x24]
inc ebx
mov dword [esp + 0x28], eax
test eax, eax
je 0x4b25e2
mov edx, dword [esp + 0x14]
cmp ebx, dword [esi + 0x108]
jb 0x4b2590
cmp dword [esp + 0x1c], 0
je 0x4b2603
push 0
push 0
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x4b262e
test edi, edi
jne 0x4b262e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x4b262e
mov ecx, eax
mov dword [esi + 0xf0], eax
call fcn.004b8970
mov dword [esi + 0x48], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
mov dword [esi + 0x48], edi
cmp edi, 0xffffffff
jne 0x4b264b
call fcn.004ceb49
mov ecx, dword [eax]
mov dword [esi + 0xf0], ecx
call fcn.004b8970
mov dword [esi + 0x48], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x4b4480
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
push edi
push 0xc
mov ebx, edx
mov esi, ecx
call dword [0x53d638]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4b44a1
pop edi
pop esi
mov eax, 0xfffff027
pop ebx
ret
mov eax, dword [esp + 0x10]
push 0
push 4
push edi
push 0x4b4410
push 0
push 0
mov dword [edi], ebx
mov dword [edi + 4], eax
call fcn.004d0efb
add esp, 0x18
test eax, eax
jne 0x4b44f1
call fcn.004ceb5c
mov ebx, dword [eax]
call fcn.004ceb5c
push edi
mov esi, dword [eax]
call dword [0x53d644]
add esp, 4
call fcn.004ceb5c
mov dword [eax], esi
cmp ebx, 0x16
jbe 0x4b44ff
pop edi
pop esi
mov eax, 0xfffff01a
pop ebx
ret
mov dword [esi], eax
xor ebx, ebx
push eax
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
movzx eax, byte [ebx + 0x4b4544]
jmp dword [eax*4 + 0x4b4530]

Function at 0x4b48a0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, edx
mov dword [esp + 0xc], 1
mov ebx, ecx
cmp dword [esi + 0x90], 0xffffffff
je 0x4b48c5
pop esi
mov eax, 0xfffff00e
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push 0x8004667e
push edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x4b48ed
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
pop esi
pop ebx
add esp, 8
ret
push 0
push 1
push edi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x4b493c
push 0
push edi
push dword [ebx + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test eax, eax
je 0x4b493c
mov ebx, dword [esp + 0x1c]
cmp ebx, 0x17
mov ecx, dword [0x545d80]
cmove ecx, dword [0x545d7c]
mov eax, dword [esi + 0x2c]
test eax, 0x80000
jne 0x4b4953
test ecx, ecx
jne 0x4b4953
push 3
push edi
call dword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
test eax, eax
jne 0x4b4949
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
add esp, 8
ret
or dword [esi + 0x2c], 0x20000
mov eax, dword [esi + 0x2c]
test eax, 0x1000000
je 0x4b4969
push ecx
mov edx, edi
call fcn.004b4840
add esp, 4
test eax, eax
jne 0x4b49bf
test dword [esi + 0x2c], 0x2000000
je 0x4b49ab
push 4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x4b499c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x4b49a7
lea edx, [esp + 0xc]
mov ecx, edi
call fcn.004b4870
test eax, eax
jne 0x4b49bf
mov dword [esi + 0x90], edi
cmp ebx, 0x17
jne 0x4b49bd
or dword [esi + 0x2c], 0x400000
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4b4bf0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, edx
cmp dword [esi + 0x90], 0xffffffff
jne 0x4b4c4c
movzx eax, word [edi]
push 0
push 1
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4b4c24
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp dword [sym.imp.WS2_32.dll_WSAGetLastError]
movzx eax, word [edi]
mov edx, esi
push ecx
mov ecx, dword [esi + 4]
push eax
push ebx
call fcn.004b48a0
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x4b4c4c
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
cmp word [edi], 0x17
jne 0x4b4c71
push 4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0x1b
push 0x29
push dword [esi + 0x90]
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [esp + 0x18]
push edi
push dword [esi + 0x90]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x4b4c9a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2740
jne 0x4b4ca3
mov dword [esi + 0x94], eax
or dword [esi + 0x2c], 0x2000
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4b4f30
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, edx
mov dword [esp + 0x1c], 0x545b46
mov ebx, ecx
mov dword [esp + 0x18], 0
xorps xmm0, xmm0
lea esi, [edi + 0x44]
lea ecx, [esi + 0x20]
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
or dword [edi + 0x2c], 0x40000
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
test dword [edi + 0x2c], 0x80000
je 0x4b4f81
mov eax, dword [esi + 0x3c]
or eax, 1
mov dword [esi + 0x30], eax
push 0
push ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x20]
push eax
push 1
lea eax, [esp + 0x2c]
push eax
push dword [edi + 0x90]
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4b5006
mov eax, dword [edi + 0x2c]
test eax, 0x20000
je 0x4b5065
or eax, 0x10000
mov dword [edi + 0x2c], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x24], eax
inc dword [edi + 0x3c]
mov dword [esi + 0x38], 0
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x4b4ff8
mov eax, dword [eax + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [ebx + 0x28]
mov dword [eax + 0x38], esi
mov dword [ebx + 0x28], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov dword [esi + 0x38], esi
mov dword [ebx + 0x28], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
call ebp
cmp eax, 0x3e5
je 0x4b5065
mov ebp, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebp
test eax, eax
jg 0x4b501f
call ebp
jmp 0x4b5029
call ebp
movzx eax, ax
or eax, 0x80070000
mov dword [esi + 0x20], eax
mov dword [esi + 0x38], 0
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x4b5054
mov eax, dword [eax + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [ebx + 0x28]
mov dword [eax + 0x38], esi
mov dword [ebx + 0x28], esi
inc dword [edi + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov dword [esi + 0x38], esi
mov dword [ebx + 0x28], esi
inc dword [edi + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
or dword [edi + 0x2c], 0x10000
inc dword [edi + 0x3c]
test dword [edi + 0x2c], 0x80000
je 0x4b50cb
cmp dword [esi + 0x40], 0xffffffff
lea eax, [esi + 0x40]
jne 0x4b50cb
push 4
push 0xffffffffffffffff
push esi
push 0x4b4cb0
push dword [esi + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x4b50cb
call ebp
test eax, eax
jg 0x4b50b5
call ebp
mov edx, esi
mov dword [esi + 0x20], eax
mov ecx, ebx
call fcn.004b4810
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
call ebp
movzx eax, ax
mov edx, esi
or eax, 0x80070000
mov ecx, ebx
mov dword [esi + 0x20], eax
call fcn.004b4810
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4b5ea0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0xa0
mov eax, dword [0x53c074]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
mov esi, edx
mov dword [esp + 0x18], ecx
push edi
mov edi, dword [esi + 0x2c]
mov eax, edi
and eax, 0xfffeffff
mov dword [esi + 0x2c], eax
mov ebx, dword [ebp + 0x20]
test ebx, ebx
jns 0x4b5f52
mov ecx, ebx
call fcn.004b83b0
mov edx, eax
cmp edx, 0x2738
je 0x4b5f52
cmp edx, 0x2746
je 0x4b5f46
cmp edx, 0x2744
je 0x4b5f46
test edi, 0x1000
je 0x4b608f
mov ecx, esi
call fcn.004aac70
test dword [esi + 0x2c], 0x40000
je 0x4b5f1c
xor ecx, ecx
xor eax, eax
jmp 0x4b5f28
mov eax, dword [esi + 0x80]
mov ecx, dword [esi + 0x84]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
push 0
lea eax, [esp + 0x14]
mov ecx, edx
push 0
push eax
call fcn.004b8970
push eax
jmp 0x4b6083
test edi, 0x40000
je 0x4b608f
test edi, 0x40000
jne 0x4b5f77
sar ebx, 0x1f
lea eax, [esi + 0x88]
and ebx, 2
push ebx
push eax
lea eax, [esi + 0x80]
push eax
push dword [ebp + 0x24]
jmp 0x4b6083
test edi, 0x1000
je 0x4b608f
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov eax, dword [esi + 0x110]
push 0x10000
push esi
mov dword [esp + 0x20], 0
call eax
add esp, 0xc
cmp dword [esp + 0x14], 0
je 0x4b6075
cmp dword [esp + 0x10], 0
je 0x4b6075
push 0x80
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.004c6150
add esp, 0xc
mov dword [esp + 0x20], 0x80
lea eax, [esp + 0x20]
mov dword [esp + 0x24], 0
push 0
push 0
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x2c]
push eax
push 1
lea eax, [esp + 0x2c]
push eax
push dword [esi + 0x38]
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
je 0x4b6022
push 0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x24]
jmp 0x4b6083
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
cmp edx, 0x2738
jne 0x4b6044
push 2
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x24]
jmp 0x4b6083
cmp edx, 0x2733
jne 0x4b6059
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0
jmp 0x4b6083
cmp edx, 0x2746
je 0x4b604c
cmp edx, 0x2744
je 0x4b604c
mov ecx, esi
call fcn.004aac70
jmp 0x4b5f30
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0xfffff024
mov eax, dword [esi + 0x10c]
push esi
call eax
add esp, 0x14
mov ecx, dword [esi + 0x2c]
mov eax, ecx
mov ebx, dword [esp + 0x1c]
and eax, 0x11000
cmp eax, 0x1000
jne 0x4b60b0
mov edx, esi
mov ecx, ebx
call fcn.004b5d70
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x3c]
dec eax
mov dword [esi + 0x3c], eax
test cl, 1
je 0x4b60d4
test eax, eax
jne 0x4b60d4
test cl, 0x20
jne 0x4b60d4
or ecx, 0x20
mov dword [esi + 0x2c], ecx
mov eax, dword [ebx + 0x2c]
mov dword [esi + 0x28], eax
mov dword [ebx + 0x2c], esi
mov ecx, dword [esp + 0xac]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c3717
add esp, 0xa0
ret
Function at 0x4b6e10
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebx
push ebp
push esi
push edi
push 0
push 0
push 0x10000
push 0x10000
push 0xff
mov edi, edx
mov ebx, ecx
push 0
push 0x40040003
push dword [edi + 0x98]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, dword [esp + 0x14]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
jne 0x4b6e61
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
test eax, eax
jg 0x4b6edb
call ebp
jmp 0x4b6ee5
push 0
push ecx
push eax
mov edx, edi
mov ecx, ebx
call fcn.004b6760
add esp, 0xc
test eax, eax
je 0x4b6e87
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x3c], 0xffffffff
jmp 0x4b6e4a
lea eax, [esi + 0x20]
xorps xmm0, xmm0
movups xmmword [eax], xmm0
push eax
mov dword [eax + 0x10], 0
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x4b6f13
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x3e5
je 0x4b6f13
call ebp
cmp eax, 0x217
jne 0x4b6ec1
xor eax, eax
jmp 0x4b6ee5
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x3c], 0xffffffff
call ebp
test eax, eax
jg 0x4b6edb
call ebp
jmp 0x4b6ee5
call ebp
movzx eax, ax
or eax, 0x80070000
mov dword [esi + 0x20], eax
mov dword [esi + 0x38], 0
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x4b6f0d
mov eax, dword [eax + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [ebx + 0x28]
mov dword [eax + 0x38], esi
mov dword [ebx + 0x28], esi
inc dword [edi + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x38], esi
mov dword [ebx + 0x28], esi
inc dword [edi + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
ret