joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4093b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
mov eax, dword [0x4371c0]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
lea ecx, [ecx]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00409290
test eax, eax
je 0x409454
mov eax, dword [0x43f520]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push 0x43d3e8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 2
push 0
mov esi, eax
push 0
push esi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x4330bc
call ebx
add eax, eax
push eax
push 0x4330bc
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x43f520]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x43f068]
test eax, eax
je 0x40947d
push 0
push 0x43f06c
push 0x43f070
mov dword [0x43f06c], 0x3c
mov ecx, dword [eax]
mov edx, dword [ecx + 0x28]
push 0x14
push eax
call edx
cmp dword [0x43f06c], 0
mov dword [esp + 0x10], 0
jle 0x4093d0
xor esi, esi
mov dword [esp + 0x14], esi
lea eax, [esp + 0x20]
push eax
call ebx
push eax
lea ecx, [esp + 0x24]
push 0
push ecx
call fcn.00419e30
add esp, 0xc
mov edi, str._esc_
mov edx, dword [esi + 0x43f070]
dec edx
cmp edx, dword [edi + 0x28]
jne 0x40955d
test byte [esi + 0x43f074], 0x80
je 0x40955d
push edi
lea eax, [esp + 0x24]
push 0x4330c8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [0x43f520]
add esp, 0xc
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push 0x43d3e8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 2
push 0
mov esi, eax
push 0
push esi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x28]
push eax
call ebx
add eax, eax
push eax
lea ecx, [esp + 0x2c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x43f520]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, dword [esp + 0x14]
add edi, 0x2c
cmp edi, str.xiugaishiyong
jl 0x4094b4
mov eax, dword [esp + 0x10]
inc eax
add esi, 0x14
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
cmp eax, dword [0x43f06c]
jl 0x409498
jmp 0x4093d0

Function at 0x40ed70
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040eb00
Function at 0x411c70
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
test eax, eax
jne 0x411cc2
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 8]
push eax
push 0xfffffffffffffffb
push 0xffff
push edi
call ebx
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0xffff
push edi
mov esi, eax
call ebx
pop edi
or eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x411cfb
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea edx, [ebp - 4]
push edx
push 0xfffffffffffffffb
push 0xffff
push edi
call ebx
push 4
mov esi, eax
lea eax, [ebp - 4]
push eax
push 4
push 0xffff
push edi
call ebx
pop edi
or eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x411d34
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea ecx, [ebp - 4]
push ecx
push 0xfffffffffffffffb
push 0xffff
push edi
call ebx
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0xffff
push edi
mov esi, eax
call ebx
pop edi
or eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x412080
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 8], eax
cmp edx, ecx
ja 0x4120b8
jb 0x4120ae
cmp eax, ebx
jae 0x4120b8
mov eax, ebx
mov edx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 0x18]
push 0
push eax
push edx
push ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
jne 0x4120de
call fcn.0040f940
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [ebp + 0x10]
test ebx, ebx
jne 0x4120ef
mov ecx, dword [ebp - 8]
sub ecx, edx
mov dword [esi + 4], ecx
jmp 0x4120f2
mov dword [esi + 4], ebx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x10], edx
mov edx, dword [ebp + 0x14]
push 0
mov dword [esi + 0x14], edx
mov edx, dword [esi + 4]
push edx
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push ecx
push eax
mov dword [esi + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [esi], eax
test eax, eax
jne 0x412140
call fcn.0040f940
mov edi, eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
mov dword [esi + 8], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4122e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x24]
mov word [ebp - 0x24], ax
mov eax, dword [ebp + 8]
push edx
push eax
mov dword [ebp - 8], 0x1c
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x41230f
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.004121c0
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x412330
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
test ecx, ecx
je 0x41235e
mov eax, dword [ebp + 8]
push eax
call fcn.00411f60
jmp 0x412368
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4123cd
call fcn.0040f940
test eax, eax
js 0x4123e0
mov eax, dword [edi]
lea edx, [ebp - 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x412397
call fcn.0040f940
test eax, eax
js 0x4123e0
mov eax, dword [ebp - 8]
push esi
mov esi, dword [ebp - 4]
test esi, esi
jne 0x4123a3
test eax, eax
je 0x4123d1
mov edx, dword [ebp + 0x14]
xor ecx, ecx
cmp esi, ecx
ja 0x4123d1
jb 0x4123b2
cmp eax, edx
ja 0x4123d1
mov eax, dword [edi]
mov ecx, dword [ebp + 0x10]
push 4
push 2
push 0
push 0
push 0
push eax
call fcn.00412080
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov dword [edi], eax
jmp 0x412376
or eax, esi
mov eax, 0x800703ee
je 0x4123df
mov eax, 0x800700df
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x412550
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, dword [ebp + 0x10]
mov dword [esi + 2], eax
mov dword [esi + 6], eax
mov dword [esi + 0xa], eax
mov dword [esi + 0xe], eax
mov dword [esi + 0x12], eax
push edi
mov dword [esi + 0x16], eax
mov dword [ebp - 0xa8], eax
mov word [esi + 0x1a], ax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
movzx eax, word [esi]
push 3
lea edx, [ebp - 0x84]
push ecx
lea ecx, [ebp - 0x88]
mov dword [ebp - 0xac], 0xc00
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x88], edx
call fcn.00412480
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0xac]
push ecx
push 0
push edx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, eax
mov eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x84]
cmp eax, ecx
je 0x412618
push eax
call fcn.00418b6e
add esp, 4
test edi, edi
je 0x412635
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041815f
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp - 0x8c]
xor edi, edi
mov eax, ebx
test ebx, ebx
je 0x412670
mov ecx, dword [eax + 4]
cmp ecx, 2
je 0x41265a
cmp ecx, 0x17
je 0x41265a
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x412644
jmp 0x412670
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x18]
push edx
push eax
push esi
call fcn.00419ac0
add esp, 0xc
mov edi, 1
push ebx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
pop ebx
test edi, edi
je 0x41269c
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 2], ax
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041815f
mov esp, ebp
pop ebp
ret
push 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0041815f
mov esp, ebp
pop ebp
ret
Function at 0x414450
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp dword [ebp + 0xc], ebx
je 0x4144bf
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
push 0x30
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x414535
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x1c]
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x4144b4
cmp eax, 0xffffffff
jne 0x4144ac
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4144b4
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x414535
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x414535
mov dword [esi + 0x50], 1
push 0
mov dword [esi + 0x54], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov edx, dword [eax + 0x90]
mov ecx, esi
call edx
cmp eax, 2
jne 0x4144b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41452e
mov eax, 0x4c7
push eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8

Function at 0x414820
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x190]
push edi
test eax, eax
jne 0x4148dc
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
lea esp, [esp]
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x60]
mov edx, dword [esi + 0x1c]
push 0
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jle 0x4148af
push 0
call ebx
mov eax, dword [esi + 0x60]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0xa0]
mov ecx, esi
call eax
cmp eax, 2
jne 0x4148b8
mov edx, dword [esi + 0x24]
push edx
push str._C_CNNID:__Iu__OnReceive___event_return_HR_ERROR__connection_will_be_closed___n
call fcn.0040fa90
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x414894
mov eax, 0x4c7
mov dword [esi + 0x10], 4
mov dword [esi + 0x14], eax
mov ecx, 1
mov dword [esi + 0x18], ecx
pop edi
mov dword [esi + 0xc], ecx
pop esi
xor eax, eax
pop ebx
ret
cmp edi, 0xffffffff
je 0x4148cf
test edi, edi
je 0x4148e5
mov ecx, dword [esi + 0x190]
test ecx, ecx
je 0x414840
pop edi
pop esi
mov eax, 1
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x414894
pop edi
pop esi
mov eax, 1
pop ebx
ret
mov dword [esi + 0x10], 5
mov dword [esi + 0x14], 0
mov ecx, 1
mov dword [esi + 0x18], ecx
pop edi
mov dword [esi + 0xc], ecx
pop esi
xor eax, eax
pop ebx
ret
Function at 0x414910
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x18]
push esi
mov esi, ecx
mov ecx, dword [ebx + 0x14]
sub eax, ecx
push edi
je 0x4149b6
lea esp, [esp]
mov edx, dword [esi + 0x2c]
cmp eax, edx
jl 0x414939
mov eax, edx
push 0
push eax
mov eax, dword [esi + 0x1c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jle 0x4149a3
lea ebx, [esi + 0x158]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [esi + 0x18c], edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x14]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0x98]
mov ecx, esi
call eax
cmp eax, 2
jne 0x414999
mov ecx, dword [esi + 0x24]
push ecx
push str._C_CNNID:__Iu__OnSend___event_should_not_return_HR_ERROR____n
call fcn.0040fa90
add esp, 8
push edi
mov ecx, ebx
call fcn.00414020
jmp 0x4149a8
cmp edi, 0xffffffff
je 0x4149c2
mov ecx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x18]
sub eax, ecx
jne 0x414930
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4149e4
mov edx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [edx], 1
mov eax, 1
pop ebx
pop ebp
ret 8
mov ecx, 1
pop edi
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 3
mov dword [esi + 0x18], ecx
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8

Function at 0x4158c0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x48]
push eax
push 0
push esi
push 0x4156d0
push 0
push 0
call fcn.00418eb2
xor ecx, ecx
add esp, 0x18
test eax, eax
setne cl
mov dword [esi + 0x44], eax
pop esi
mov eax, ecx
ret

Function at 0x415a80
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
push esi
push edi
mov esi, ecx
test eax, eax
jne 0x415aac
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x415ac9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, 1
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 2
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], eax
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
mov edi, 1
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov edx, dword [eax + 0x84]
mov ecx, esi
call edx
cmp eax, 2
je 0x415b25
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x415b1d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x415b1d
test eax, eax
je 0x415b1d
push 0x80004005
call fcn.0040f920
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x415b34
mov eax, 0x4c7
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 5
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], eax
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x415c90
Capabilities:
Connect socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [ebp + 0xc], edi
je 0x415cfe
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
push 0x30
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x415dce
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x1c]
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x415dc9
cmp eax, 0xffffffff
jne 0x415cf4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x415dc9
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x415dce
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x415dce
mov dword [esi + 0x4c], 1
push 0
mov dword [esi + 0x50], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov edx, dword [eax + 0x84]
mov ecx, esi
call edx
cmp eax, 2
jne 0x415d84
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x415d75
mov eax, 0x4c7
push eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi + 0x1c]
xor edi, edi
push edi
push edi
push edi
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x415daa
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x415daa
xor edi, edi
mov ecx, dword [esi + 0x24]
push ecx
push str._C_CNNID:__Iu__send_0_bytes__detect_package__n
call fcn.0040fa90
add esp, 8
test edi, edi
je 0x415dc9
push 0x80004005
call fcn.0040f920
mov edi, 1
mov eax, edi
pop edi
pop esi
pop ebp
ret 8

Function at 0x415de0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x190]
mov ecx, dword [esi + 0x38]
mov ebx, 1
add dword [esi + 0x190], ebx
cmp eax, ecx
jb 0x415e11
xor eax, eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], 5
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
pop esi
pop ebx
ret
mov edx, dword [esi + 0x1c]
push edi
xor edi, edi
push edi
push edi
push edi
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x415e38
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x415e38
xor edi, edi
mov eax, dword [esi + 0x24]
push eax
push str._C_CNNID:__Iu__send_0_bytes__detect_package__n
call fcn.0040fa90
add esp, 8
test edi, edi
je 0x415e63
mov dword [esi + 0x14], edi
pop edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x10], 5
pop esi
xor eax, eax
pop ebx
ret
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x415f60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x18c]
push edi
test eax, eax
jne 0x41604c
xor ebx, ebx
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x5c]
mov edx, dword [esi + 0x1c]
push ebx
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, ebx
jle 0x416001
mov eax, dword [esi + 0x5c]
push edi
push eax
mov dword [esi + 0x190], ebx
call fcn.00411dc0
add esp, 8
test eax, eax
jne 0x416055
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 0x5c]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0x94]
mov ecx, esi
call eax
cmp eax, 2
jne 0x41603e
mov eax, dword [esi + 0x24]
push eax
push str._C_CNNID:__Iu__OnReceive___event_return_HR_ERROR__connection_will_be_closed___n
call fcn.0040fa90
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x415fe6
mov eax, 0x4c7
mov ecx, 1
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], 4
pop edi
mov dword [esi + 0xc], ecx
pop esi
xor eax, eax
pop ebx
ret
cmp edi, 0xffffffff
jne 0x416023
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x41604c
cmp eax, 0x2744
je 0x41603e
cmp eax, 0x2746
jne 0x415fe6
jmp 0x41603e
cmp edi, ebx
jne 0x41603e
mov ecx, dword [esi + 0x24]
push ecx
push str._C_CNNID:__Iu__recv_0_bytes__detect_package__n
mov dword [esi + 0x190], ebx
call fcn.0040fa90
add esp, 8
mov edx, dword [esi + 0x18c]
test edx, edx
je 0x415f75
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0xc], 1
mov dword [esi + 0x10], 5
pop esi
xor eax, eax
pop ebx
ret
Function at 0x416580
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4299d8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4371c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x70]
mov dword [ebp - 0x14], eax
mov ecx, dword [esi + 0x188]
xor edi, edi
test ecx, ecx
jle 0x416614
lea ebx, [esi + 0x154]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esi + 0x170]
cmp edi, dword [esi + 0x174]
je 0x4165e9
mov eax, dword [edi + 4]
mov dword [esi + 0x170], eax
mov dword [eax + 8], 0
jmp 0x4165fb
test edi, edi
je 0x4165fb
xor eax, eax
mov dword [esi + 0x170], eax
mov dword [esi + 0x174], eax
xor eax, eax
cmp edi, eax
je 0x41660d
mov dword [edi + 4], eax
mov dword [edi + 8], eax
dec dword [esi + 0x16c]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x416715
mov eax, dword [edi + 0x18]
sub eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x14]
mov edx, dword [esi + 0x1c]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test ebx, ebx
jle 0x416694
lea eax, [esi + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [esi + 0x188], ebx
lea eax, [esi + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [edi + 0x14]
mov edx, dword [esi]
push ebx
push eax
mov eax, dword [edx + 0x8c]
mov ecx, esi
call eax
cmp eax, 2
jne 0x416699
mov ecx, dword [esi + 0x24]
push ecx
push str._C_CNNID:__Iu__OnSend___event_should_not_return_HR_ERROR____n
call fcn.0040fa90
add esp, 8
jmp 0x416699
cmp ebx, 0xffffffff
je 0x4166c2
mov ecx, dword [ebp - 0x14]
push edi
add ecx, 0x1c
mov dword [ebp - 4], 0xffffffff
call fcn.004111d0
test eax, eax
jne 0x4165b0
push edi
call fcn.004140f0
add esp, 4
jmp 0x4165b0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x41672c
lea ebx, [esi + 0x154]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x170]
xor ecx, ecx
cmp eax, ecx
je 0x4166f6
mov dword [eax + 8], edi
mov edx, dword [esi + 0x170]
mov dword [edi + 4], edx
jmp 0x416702
mov dword [edi + 8], ecx
mov dword [edi + 4], ecx
mov dword [esi + 0x174], edi
inc dword [esi + 0x16c]
push ebx
mov dword [esi + 0x170], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 1
mov dword [esi + 0xc], ecx
mov dword [esi + 0x18], ecx
mov ecx, dword [ebp - 0x14]
push edi
add ecx, 0x1c
mov dword [esi + 0x10], 3
mov dword [esi + 0x14], eax
mov dword [ebp - 4], 0xffffffff
call fcn.004111d0
test eax, eax
jne 0x416761
push edi
call fcn.004140f0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret