joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d530
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0x668d40
call fcn.0047e9d0
mov eax, dword [0x668d6c]
mov ebx, dword [ebp + 8]
push 0x668d40
mov esi, dword [eax + ebx*4]
call fcn.0047e9e0
add esp, 8
test byte [esi + 0x58], 1
je 0x48d683
mov eax, dword [0x668d58]
test eax, eax
je 0x48d57f
push 4
lea ecx, [ebp + 0xc]
push ecx
push 1
push 6
push ebx
call eax
add esp, 0x14
jmp 0x48d63c
cmp dword [0x668d74], 0
push edi
mov edi, dword fs:[0x2c]
je 0x48d5ca
mov eax, dword [edi]
cmp dword [eax + 0x21cc], 0
jne 0x48d5ca
push 0x668d40
call fcn.0047e9d0
mov eax, dword [0x668d6c]
push 0x668d40
mov esi, dword [eax + ebx*4]
call fcn.0047e9e0
add esp, 8
test dword [esi + 0x58], 0x10000000
jne 0x48d5ca
mov esi, 1
jmp 0x48d5cc
xor esi, esi
push 0x668d40
call fcn.0047e9d0
mov eax, dword [0x668d6c]
add esp, 4
test esi, esi
mov esi, dword [eax + ebx*4]
push 0x668d40
call fcn.0047e9e0
add esp, 4
cmp dword [esi + 0x3c], 0
je 0x48d61f
cmp dword [esi + 0xc], 2
jne 0x48d61f
cmp word [esi + 0x5c], 0
je 0x48d61f
mov eax, dword [edi]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x48d614
call fcn.00596e90
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x48d63b
push 4
lea eax, [ebp + 0xc]
push eax
push 1
push 6
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_setsockopt]
push eax
call fcn.00590b90
add esp, 4
pop edi
test eax, eax
je 0x48d683
mov eax, dword [0x668d74]
xor ecx, ecx
test eax, eax
setne cl
lea ecx, [ecx*4 + 3]
test eax, eax
jne 0x48d67c
cmp ecx, 5
jbe 0x48d664
cmp dword [0x6690f8], ecx
jl 0x48d67c
or ecx, 0x360000
push str.failed_setsockopt_TCP_NODELAY_:__m
push ecx
call fcn.00479a10
add esp, 8
pop esi
pop ebx
pop ebp
ret
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x48d690
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x668d40
mov dword [ebp + 0xc], edi
call fcn.0047e9d0
mov eax, dword [ebp + 8]
push 0x668d40
lea esi, [eax*4]
mov eax, dword [0x668d6c]
mov ebx, dword [esi + eax]
call fcn.0047e9e0
mov eax, dword [ebx + 0x58]
add esp, 8
test al, 1
je 0x48d75c
test edi, edi
jne 0x48d707
test al, al
jns 0x48d707
push edi
push edi
push dword [ebx + 0x60]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
push eax
call fcn.00590b90
add esp, 4
test eax, eax
je 0x48d707
push str.WSAEventSelect:__m
push 0x360003
call fcn.00479a10
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x668d40
call fcn.0047e9d0
mov eax, dword [0x668d6c]
push 0x668d40
mov esi, dword [esi + eax]
call fcn.0047e9e0
add esp, 8
lea eax, [ebp + 0xc]
push eax
push 0x8004667e
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push eax
call fcn.00590b90
add esp, 4
test eax, eax
je 0x48d75c
push str.failed_ioctl_FIOBIO_:__m
push 0x360003
call fcn.00479a10
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebx + 0x58]
neg edi
sbb edi, edi
and eax, 0xffffff7f
and edi, 0x80
or edi, eax
xor eax, eax
mov dword [ebx + 0x58], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x48eb00
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
push eax
call fcn.00590b90
add esp, 4
test eax, eax
je 0x48eb32
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
mov ax, word [ebp - 0x12]
mov word [ecx + 0x78], ax
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0x7c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x48f270
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
or ebx, 0xffffffff
mov eax, dword [esi + 0x58]
test eax, 0x4000000
je 0x48f2ae
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x48f29f
call fcn.00596e90
pop esi
mov dword [eax], 0x2746
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
cmp word [esi + 0x5c], 0
push edi
je 0x48f353
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [esi + 0x6c]
call fcn.0049d6e0
mov ecx, dword [ebp + 8]
add esp, 0x10
cmp dword [ebp + 0x10], ecx
cmovb ecx, dword [ebp + 0x10]
push dword [ebp + 0x14]
push ecx
push dword [ebp - 4]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_recv]
push eax
call fcn.00590b90
mov edi, eax
add esp, 4
test edi, edi
jns 0x48f45e
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x48f315
call fcn.00596e90
cmp dword [eax], 0x2738
jne 0x48f45e
push edi
push dword [esi + 0x6c]
call fcn.0049d720
add esp, 8
cmp dword [ebp + 0x18], 0
jne 0x48f34a
push edi
push dword [ebp + 0xc]
push dword [esi + 0x6c]
call fcn.0048bbd0
push dword [esi + 0x6c]
call fcn.0049d780
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, 0x4080
jne 0x48f3b5
test eax, 0x400
jne 0x48f395
push esi
call fcn.0048be80
add esp, 4
test eax, eax
je 0x48f395
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x48f385
call fcn.00596e90
pop edi
pop esi
mov dword [eax], 0x2746
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x58]
test eax, 0x400
je 0x48f3b5
mov edi, dword [sym.imp.KERNEL32.dll_SleepEx]
push 1
push 0xffffffffffffffff
call edi
mov eax, dword [esi + 0x58]
test eax, 0x400
jne 0x48f3a5
test eax, 0x4000
je 0x48f424
push dword [esi + 0x6c]
call fcn.0049d920
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x48f3ff
cmp dword [ebp + 0x18], 0
mov ebx, ecx
jne 0x48f3ff
mov eax, dword [ebp + 0x10]
cmp ecx, eax
cmovb eax, ecx
push eax
push dword [ebp + 0xc]
push dword [esi + 0x6c]
call fcn.0048bbd0
add esp, 0xc
mov ebx, eax
test byte [esi + 0x58], 0x20
jne 0x48f405
push dword [esi + 0x6c]
call fcn.0049d780
add esp, 4
test byte [esi + 0x58], 0x20
je 0x48f414
push dword [esi + 0x6c]
call fcn.0049d920
add esp, 4
test eax, eax
jne 0x48f41b
and dword [esi + 0x58], 0xffffbfff
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
test al, al
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
jns 0x48f44f
test eax, eax
jne 0x48f43f
call fcn.00596e90
pop edi
pop esi
mov dword [eax], 0x2733
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x48f458
call fcn.00596e90
mov dword [eax], 0x2714
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f840
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0049d660
mov ecx, dword [ebp + 0x18]
mov edi, eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0x10
mov eax, dword [ecx + 4]
mov dword [ebp + 0x18], eax
movzx eax, word [ecx + 2]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x80]
mov dword [ebp + 8], eax
movzx eax, word [esi + 0x78]
test ax, ax
je 0x48f883
mov ebx, eax
jmp 0x48f90d
mov ebx, dword [esi + 0x74]
xorps xmm0, xmm0
movups xmmword [ebp - 0x20], xmm0
mov eax, 2
mov dword [ebp - 8], 0x10
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x20]
push 0x10
push eax
push ebx
mov dword [ebp - 0x1c], 0
call dword [sym.imp.WS2_32.dll_bind]
push eax
call fcn.00590b90
add esp, 4
test eax, eax
je 0x48f8d4
push str.bind_failed__m
push 0x360003
call fcn.00479a10
add esp, 8
xor eax, eax
jmp 0x48f90a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_getsockname]
push eax
call fcn.00590b90
add esp, 4
test eax, eax
je 0x48f906
push str.getsockname_failed__m
push 0x360003
call fcn.00479a10
add esp, 8
xor eax, eax
jmp 0x48f90a
movzx eax, word [ebp - 0x1e]
movzx ebx, ax
push dword [ebp + 0x10]
mov word [esi + 0x78], bx
push dword [ebp + 0xc]
push edi
call fcn.0049d570
push dword [ebp + 0x18]
push dword [ebp + 8]
push dword [ebp - 0xc]
push ebx
push edi
call fcn.0049e070
push 0x11
push dword [ebp + 0x18]
push dword [ebp + 8]
push edi
call fcn.0049dfc0
add esp, 0x30
cmp word [esi + 0x5c], 0
je 0x48f961
mov eax, dword [esi + 0x58]
and eax, 0x200000
shl eax, 4
push eax
push edi
call fcn.0049d600
add esp, 8
mov ebx, 0x20
jmp 0x48f966
mov ebx, 0x1c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.0049d6a0
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp - 0x10]
push esi
call fcn.0048f530
mov esi, eax
add esp, 0x1c
test esi, esi
jle 0x48f98e
sub esi, ebx
push edi
call fcn.0049d540
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f9a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x668d40
call fcn.0047e9d0
mov eax, dword [ebp + 8]
push 0x668d40
lea edi, [eax*4]
mov eax, dword [0x668d6c]
mov esi, dword [edi + eax]
call fcn.0047e9e0
add esp, 8
cmp dword [esi + 0x3c], 0
je 0x48fa3b
cmp dword [esi + 0xc], 2
jne 0x48fa3b
cmp word [esi + 0x5c], 0
je 0x48fa3b
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x10
jae 0x48fa0d
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x48fa00
call fcn.00596e90
pop edi
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
pop ebp
ret
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [eax], 0x10
mov eax, 2
pop edi
movups xmmword [ecx], xmm0
mov word [ecx], ax
mov eax, dword [esi + 0x80]
mov dword [ecx + 4], eax
mov ax, word [esi + 0x78]
mov word [ecx + 2], ax
xor eax, eax
pop esi
pop ebp
ret
push 0x668d40
call fcn.0047e9d0
mov eax, dword [0x668d6c]
push 0x668d40
mov esi, dword [edi + eax]
call fcn.0047e9e0
add esp, 8
cmp dword [esi + 0x3c], 0
jne 0x48fa7c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_getsockname]
push eax
call fcn.00590b90
add esp, 4
pop edi
pop esi
pop ebp
ret
or eax, 0xffffffff
push eax
call fcn.00590b90
add esp, 4
pop edi
pop esi
pop ebp
ret

Function at 0x48fad0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x668d40
call fcn.0047e9d0
mov ecx, dword [ebp + 8]
mov eax, dword [0x668d6c]
push 0x668d40
mov esi, dword [eax + ecx*4]
call fcn.0047e9e0
mov eax, dword [esi + 0x58]
add esp, 8
test al, 0x40
je 0x48fbae
test al, 1
je 0x48fb3c
cmp dword [esi + 0x3c], 0
je 0x48fb18
cmp dword [esi + 0xc], 2
jne 0x48fb18
cmp word [esi + 0x5c], 0
jne 0x48fb3c
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_recvfrom]
push eax
call fcn.00590b90
add esp, 4
pop esi
pop ebp
ret
test eax, reloc.WS2_32.dll_connect
jne 0x48fb76
cmp dword [esi + 0x3c], 0
je 0x48fb56
cmp dword [esi + 0xc], 2
jne 0x48fb56
cmp word [esi + 0x5c], 0
jne 0x48fb76
push eax
push str.invalid_type:__d
push 0x76d
push str.vsock_recvfrom
push 0x360202
call fcn.00479d80
add esp, 0x14
pop esi
pop ebp
ret
cmp dword [esi + 0xc], 0
jne 0x48fb93
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0048f270
add esp, 0x14
pop esi
pop ebp
ret
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0048f470
add esp, 0x18
pop esi
pop ebp
ret
push str.recvfrom_from_non_packet_socket
push 0x360000
call fcn.00479f70
int3
Function at 0x48fbd0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x668d40
call fcn.0047e9d0
mov ecx, dword [ebp + 8]
mov eax, dword [0x668d6c]
push 0x668d40
mov esi, dword [eax + ecx*4]
call fcn.0047e9e0
mov eax, dword [esi + 0x58]
add esp, 8
test al, 0x40
jne 0x48fc1d
push eax
push str.invalid_type:__d
push 0x72e
push str.vsock_send
push 0x360202
call fcn.00479d80
mov eax, dword [esi + 0x58]
add esp, 0x14
mov ecx, dword [esi + 0x3c]
test eax, reloc.WS2_32.dll_connect
jne 0x48fc7a
test ecx, ecx
je 0x48fc38
cmp dword [esi + 0xc], 2
jne 0x48fc38
cmp word [esi + 0x5c], 0
jne 0x48fc7a
test al, 1
je 0x48fc5a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_send]
push eax
call fcn.00590b90
add esp, 4
pop esi
pop ebp
ret
push eax
push str.invalid_type:__d
push 0x733
push str.vsock_send
push 0x360202
call fcn.00479d80
add esp, 0x14
pop esi
pop ebp
ret
test ecx, ecx
je 0x48fcc1
cmp dword [esi + 0xc], 2
jne 0x48fcc1
cmp word [esi + 0x5c], 0
je 0x48fcc1
test eax, 0x1000000
je 0x48fcd6
cmp dword [esi + 0x14], 0x11
lea eax, [esi + 0x94]
push 0x10
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
jne 0x48fcb6
call fcn.0048f840
add esp, 0x18
pop esi
pop ebp
ret
call fcn.0048f790
add esp, 0x18
pop esi
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0048f530
add esp, 0x10
pop esi
pop ebp
ret
push str.cannot_use_send_when_socket_not_connected
push 0x360000
call fcn.00479f70
int3
Function at 0x48fcf0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x668d40
call fcn.0047e9d0
mov ecx, dword [ebp + 8]
mov eax, dword [0x668d6c]
push 0x668d40
mov esi, dword [eax + ecx*4]
call fcn.0047e9e0
mov eax, dword [esi + 0x58]
add esp, 8
test al, 0x40
je 0x48fdfc
test eax, reloc.WS2_32.dll_connect
jne 0x48fd83
cmp dword [esi + 0x3c], 0
je 0x48fd3b
cmp dword [esi + 0xc], 2
jne 0x48fd3b
cmp word [esi + 0x5c], 0
jne 0x48fd83
test al, 1
je 0x48fd63
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_sendto]
push eax
call fcn.00590b90
add esp, 4
pop esi
pop ebp
ret
push eax
push str.invalid_type:__d
push 0x783
push str.vsock_sendto
push 0x360202
call fcn.00479d80
add esp, 0x14
pop esi
pop ebp
ret
push edi
mov edi, dword [ebp + 0x18]
test edi, edi
jne 0x48fda2
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi]
call fcn.0048fbd0
add esp, 0x10
pop edi
pop esi
pop ebp
ret
cmp dword [esi + 0xc], 2
jne 0x48fe0b
cmp dword [esi + 0x14], 0x11
jne 0x48fddc
push esi
call fcn.004901c0
add esp, 4
test eax, eax
je 0x48fdc2
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [ebp + 0x1c]
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0048f840
add esp, 0x18
pop edi
pop esi
pop ebp
ret
cmp dword [esi + 0x10], 3
jne 0x48fe0b
push dword [ebp + 0x1c]
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0048f790
add esp, 0x18
pop edi
pop esi
pop ebp
ret
push str.sendto_to_non_packet_socket
push 0x360000
call fcn.00479f70
push str.invalid_socket_address
push 0x360000
call fcn.00479f70
int3
Function at 0x48fe20
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x668d40
call fcn.0047e9d0
mov ecx, dword [ebp + 8]
mov eax, dword [0x668d6c]
push 0x668d40
mov esi, dword [eax + ecx*4]
call fcn.0047e9e0
mov ebx, dword [ebp + 0xc]
add esp, 8
mov edi, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
cmp ebx, 0xffff
jne 0x48fe85
cmp edx, 0x20
jne 0x48fea4
cmp edi, 4
jne 0x48ff31
mov ecx, dword [ebp + 0x14]
mov eax, dword [esi + 0x58]
mov ecx, dword [ecx]
neg ecx
sbb ecx, ecx
and eax, 0xffdfffff
and ecx, 0x200000
or ecx, eax
mov dword [esi + 0x58], ecx
jmp 0x48fecf
test ebx, ebx
jne 0x48fea4
cmp edx, 0xc
jne 0x48fea4
cmp edi, 8
jne 0x48ff40
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
mov dword [esi + 0x8c], eax
jmp 0x48fed2
cmp edx, 0x19
jne 0x48fecf
mov ecx, dword [esi + 0x58]
mov eax, ecx
and eax, reloc.WS2_32.dll_listen
cmp eax, 1
jne 0x48fecf
test cl, 0x40
je 0x48fecf
cmp dword [esi + 0xc], 2
jne 0x48fecf
cmp dword [esi + 0x14], 0x11
je 0x48ff07
cmp dword [esi + 0x10], 3
je 0x48ff07
mov ecx, dword [ebp + 0x14]
cmp dword [esi + 0x3c], 0
je 0x48ff16
cmp dword [esi + 0xc], 2
jne 0x48ff16
cmp word [esi + 0x5c], 0
je 0x48ff16
cmp edx, 4
je 0x48ff0f
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x48ff01
call fcn.00596e90
mov dword [eax], 0x16
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push edi
push ecx
push edx
push ebx
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_setsockopt]
push eax
call fcn.00590b90
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
push str.incorrect_SO_BROADCAST_parameters
push 0x360000
call fcn.00479f70
push str.incorrect_IP_ADD_MEMBERSHIP_parameters
push 0x360000
call fcn.00479f70
int3
Function at 0x4900c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push 0x668d40
call fcn.0047e9d0
mov ecx, dword [ebp + 8]
mov eax, dword [0x668d6c]
push 0x668d40
mov edi, dword [eax + ecx*4]
call fcn.0047e9e0
add esp, 8
mov dword [ebp - 4], 0x10
test dword [edi + 0x58], 0x800000
lea esi, [edi + 0xec]
jne 0x490190
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x60]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x490122
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
movzx eax, word [ebp - 0x12]
mov dword [esi + 8], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0x10
push eax
push dword [edi + 0x60]
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x490119
cmp dword [edi + 0x48], eax
je 0x490158
movups xmm0, xmmword [edi + 0x44]
movups xmmword [ebp - 0x14], xmm0
mov eax, dword [ebp - 0x10]
mov dword [esi + 0xc], eax
mov ecx, dword [ebp - 0x14]
shr ecx, 0x10
cmp dword [ebp + 0xc], 0
mov dword [esi + 0x10], ecx
je 0x490176
mov eax, dword [esi + 8]
mov dword [esi + 8], ecx
mov dword [esi + 0x10], eax
push esi
mov dword [esi], 5
call fcn.0048e2a0
add esp, 4
test eax, eax
jne 0x490119
or dword [edi + 0x58], 0x800000
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4989c0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.004766b0
add esp, 8
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push eax
call fcn.00590bc0
xor ecx, ecx
add esp, 4
cmp eax, 0xffffffff
cmove eax, ecx
pop ebp
ret
Function at 0x498c10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x4c
push 0
push esi
call fcn.00594c60
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
push 0
push eax
push esi
mov dword [esi], eax
mov dword [esi + 4], ecx
call fcn.00498ef0
push esi
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
call fcn.00498da0
add esp, 0x1c
test eax, eax
jne 0x498cbb
mov edi, dword [esi + 8]
lea eax, [ebp + 8]
push eax
push 0x40
push 0x32
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x498cbb
test edi, edi
je 0x498cbb
push dword [ebp + 0x10]
push dword [esi + 8]
push dword [esi + 0x18]
push edi
push esi
call fcn.00499040
movq xmm0, qword [edi]
lea edx, [ebp + 0x10]
mov ecx, dword [ebp + 8]
add esp, 0x14
movq qword [esi + 0x24], xmm0
movzx eax, word [edi + 8]
mov word [esi + 0x2c], ax
mov eax, dword [esi + 4]
push edx
push ecx
push 0x32
movq xmm0, qword [eax]
movq qword [esi + 0x42], xmm0
movzx eax, word [eax + 8]
push edi
mov word [esi + 0x4a], ax
mov dword [ebp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
xor eax, eax
pop esi
pop ebp
ret
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x498cd7
push 0x8000
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esi + 0x10], 0
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret

Function at 0x498ce0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
je 0x498d95
push edi
mov edi, dword [esi + 8]
lea eax, [ebp + 8]
push eax
push 0x40
push 0x32
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x498d72
test edi, edi
je 0x498d72
push dword [esi + 0x18]
push dword [esi + 0x10]
push edi
call fcn.00594dc0
lea eax, [ebp - 4]
push eax
push 0xf
lea eax, [ebp - 0xc34]
push eax
push dword [esi + 0x20]
push 0x32
push dword [esi + 0xc]
push 0
push dword [esi + 8]
call fcn.00407290
add esp, 0x2c
cmp eax, 3
je 0x498d5e
lea eax, [ebp - 0xc34]
push eax
push dword [esi + 0x10]
push dword [esi + 0x18]
push edi
push dword [esi + 8]
call fcn.00498f70
add esp, 0x14
mov eax, dword [ebp + 8]
lea ecx, [ebp + 8]
push ecx
push eax
push 0x32
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [ebp + 0xc], 0
pop edi
je 0x498d95
mov eax, dword [esi + 0x10]
test eax, eax
je 0x498d95
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esi + 0x10], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x498da0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
lea eax, [ebp - 4]
push ebx
mov ebx, dword [ebp + 8]
push edi
push eax
push 0xf
lea eax, [ebp - 0xc34]
xor edi, edi
push eax
push dword [ebx + 0x20]
push 0x32
push dword [ebx + 0xc]
push edi
push dword [ebx + 8]
call fcn.00407290
add esp, 0x20
cmp eax, 3
je 0x498ee7
push 0x40
push 0x1000
push 0x1e
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp + 8], eax
test eax, eax
je 0x498ee7
cmp dword [ebx + 0x14], edi
jne 0x498dfd
mov dword [ebx + 0x14], eax
mov ecx, dword [ebx + 8]
mov eax, ecx
push esi
mov esi, dword [ebx + 4]
sub eax, esi
mov edx, esi
sub edx, ecx
cmp ecx, esi
mov esi, dword [ebp - 4]
cmovbe eax, edx
cmp eax, 0x80000000
sbb edx, edx
xor ecx, ecx
and edx, 0xfffffffb
add edx, 0xa
test esi, esi
je 0x498e40
lea eax, [ebp - 0xb74]
nop dword [eax]
cmp edi, edx
jge 0x498e40
add edi, dword [eax]
inc ecx
add eax, 0xd0
cmp ecx, esi
jb 0x498e30
push edi
push dword [ebx + 0xc]
push dword [ebp + 8]
call fcn.00594dc0
mov esi, dword [ebx + 8]
mov ecx, esi
mov edx, dword [ebx + 0x14]
sub ecx, edx
lea eax, [esi + edi]
push eax
lea eax, [edx + edi]
push eax
mov eax, edx
sub eax, esi
cmp edx, esi
mov esi, dword [ebp + 8]
cmovbe eax, ecx
cmp eax, 0x80000000
sbb eax, eax
and eax, 0xfffffffb
add eax, 0xa
push eax
lea eax, [esi + edi]
push eax
push ebx
call fcn.00499040
lea eax, [ebp - 0xc34]
push eax
push dword [ebx + 8]
push edi
push esi
push esi
call fcn.00498f70
add esp, 0x34
test eax, eax
jne 0x498ecf
mov ecx, dword [ebx + 0x14]
mov eax, ecx
mov dword [ebx + 0x10], esi
mov esi, dword [ebx + 8]
mov edx, esi
sub eax, esi
mov dword [ebx + 0x18], edi
sub edx, ecx
cmp ecx, esi
pop esi
cmovbe eax, edx
cmp eax, 0x80000000
sbb eax, eax
and eax, 0xfffffffb
add eax, 0xa
add eax, edi
mov dword [ebx + 0x1c], eax
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop esi
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret