joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp int.00401219
Function at 0x401470
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4068aa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call sub.MFC42.DLL_CSocket::CSocket
lea ecx, [esi + 0x20]
mov dword [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x24]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString
lea edi, [esi + 0x30]
mov byte [esp + 0x14], 2
mov ecx, edi
call sub.MFC42.DLL_CString::CString
push 0xa
lea ecx, [esi + 0x3c]
mov byte [esp + 0x18], 3
call sub.MFC42.DLL_CStringList::CStringList
lea ecx, [esi + 0x58]
mov byte [esp + 0x14], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x5c]
mov byte [esp + 0x14], 5
call sub.MFC42.DLL_CString::CString
push 0x40b978
mov ecx, edi
mov byte [esp + 0x18], 6
mov dword [esi], 0x408564
mov dword [esi + 0x38], 1
mov dword [esi + 0x34], 0
call fcn.0040615e
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x28], 0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x405910
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x407008
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
push eax
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString_1
push 1
push 0x5c
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::Find_1
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40598b
lea ecx, [esp + 8]
push esi
push ecx
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
push 0
push eax
call edi
lea ecx, [esp + 8]
call fcn.004060da
inc esi
lea ecx, [esp + 0x1c]
push esi
push 0x5c
call sub.MFC42.DLL_CString::Find_1
mov esi, eax
cmp esi, 0xffffffff
jne 0x405958
mov edx, dword [esp + 0x1c]
push 0
push edx
call edi
lea ecx, [esp + 0x1c]
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
call fcn.004060da
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4059c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4059d3
xor eax, eax
ret
and eax, 0x10
cmp al, 0x10
jne 0x4059e6
mov ecx, dword [esp + 8]
xor eax, eax
test ecx, ecx
setne al
ret
mov ecx, dword [esp + 8]
xor eax, eax
test ecx, ecx
sete al
ret
Function at 0x405a00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40704f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x18]
mov ebx, 1
push eax
mov dword [esp + 0x28], ebx
call sub.MFC42.DLL_CTime::GetTickCount
mov ecx, dword [eax]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
push eax
mov edx, dword [ecx]
call dword [edx + 0x28]
push ecx
mov ecx, dword [esp + 0x10]
mov eax, esp
mov dword [esp + 0x34], esp
lea edx, [esp + 0x34]
mov dword [eax], ecx
lea eax, [esp + 0x1c]
push edx
push eax
call sub.MFC42.DLL_CTime::GetTickCount
mov ecx, eax
call fcn.00405c10
mov ecx, dword [eax]
mov eax, 0xc22e4507
imul ecx
add edx, ecx
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
cmp edx, 0x164
jle 0x405abf
lea edx, [esp + 0x30]
push str.__b__d__Y
push edx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CTime::Format
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 2
call fcn.004061a6
mov byte [esp + 0x24], bl
lea ecx, [esp + 0x30]
jmp 0x405b12
push 0
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CTime::GetLocalTm
mov esi, dword [eax + 4]
push 0
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CTime::GetLocalTm
mov edi, dword [eax + 8]
lea eax, [esp + 0x30]
push str._b__d
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CTime::Format
mov ecx, dword [eax]
push esi
push edi
push ecx
lea edx, [esp + 0x1c]
push str.__s__02d:_02d
push edx
mov byte [esp + 0x38], 3
call sub.MFC42.DLL_CString::Format
add esp, 0x14
mov byte [esp + 0x24], bl
lea ecx, [esp + 0x30]
call fcn.004060da
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 0
call fcn.004060da
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret

Function at 0x405ba0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x100
lea eax, [esp]
push 0x100
push eax
call sub.WSOCK32.dll_gethostname
test eax, eax
je 0x405bc3
or eax, 0xffffffff
add esp, 0x100
ret
lea ecx, [esp]
push ecx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x405bde
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x100
ret
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call sub.WSOCK32.dll_inet_ntoa
mov ecx, dword [esp + 0x104]
push eax
call fcn.0040615e
xor eax, eax
add esp, 0x100
ret
Function at 0x404540
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x4045a1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x404584
cmp edi, 2
jb 0x404584
cmp byte [esi], cl
jne 0x404584
cmp byte [esi + 1], cl
jne 0x404584
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4d6440]
jmp 0x404555
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4d6440]
test edi, edi
jne 0x404555
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x4045d0
cmp cl, 0x23
jne 0x4045b7
cmp byte [esi], cl
jne 0x4045b7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4d6440]
test cl, cl
jne 0x4045a8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x4046e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x4046f3
mov dword [ebx], 0
mov edx, 0x4da6e8
call fcn.004045e0
mov esi, eax
test esi, esi
je 0x4047d0
push esi
call fcn.0049e4db
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x4047c7
push 2
push 0
push esi
call fcn.0049f02f
add esp, 0xc
test eax, eax
jne 0x4047c7
push esi
call fcn.0049e4db
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x4047c7
push 0
push dword [ebp + 8]
push esi
call fcn.0049f02f
add esp, 0xc
test eax, eax
jne 0x4047c7
mov eax, dword [0x4f4b14]
test eax, eax
je 0x404766
inc dword [eax + 0xb0]
push edi
call fcn.004a7660
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x4047c7
push esi
push edi
push 1
push eax
call fcn.004a2a79
add esp, 0x10
push esi
cmp eax, edi
je 0x4047b1
call fcn.0049ecd4
mov eax, dword [0x4f4b14]
add esp, 4
test eax, eax
je 0x40479f
dec dword [eax + 0xb0]
push dword [ebp + 8]
call fcn.004a28a0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.0049ecd4
add esp, 4
test ebx, ebx
je 0x4047bf
mov dword [ebx], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.0049ecd4
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x412570
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4f01c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
lea edx, [ebp - 8]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [0x4f4b14]
push esi
push edi
mov esi, 4
mov edi, dword [eax + 0x3f04]
mov eax, dword [edi + 0xfc]
mov ebx, dword [edi + 0x104]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x4d6440]
sub esi, 1
jne 0x4125b0
mov eax, dword [0x4f4b14]
not ebx
cmp dword [eax + 0x3f28], ebx
jne 0x4125ea
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 0xc]
mov ecx, ebx
call fcn.00423a00
add esp, 8
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea ecx, [edi + 0xfc]
call fcn.00423c00
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047eeda
mov esp, ebp
pop ebp
ret

Function at 0x412610
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4f01c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
lea edx, [ebp - 8]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [0x4f4b14]
push esi
push edi
mov esi, 4
mov edi, dword [eax + 0x3f04]
mov eax, dword [edi + 0xfc]
mov ebx, dword [edi + 0x104]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x4d6440]
sub esi, 1
jne 0x412650
mov eax, dword [0x4f4b14]
not ebx
cmp dword [eax + 0x3f28], ebx
jne 0x41268a
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.00423a00
add esp, 8
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea ecx, [edi + 0xfc]
call fcn.00423c00
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047eeda
mov esp, ebp
pop ebp
ret
Function at 0x418980
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
mov dword [ebp - 4], ecx
push esi
lea esi, [ecx + 1]
push edi
test bl, bl
je 0x4189c8
or edi, 0xffffffff
nop dword [eax]
cmp bl, 0x23
jne 0x4189af
cmp byte [esi], bl
jne 0x4189af
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x4d6440]
test bl, bl
jne 0x4189a0
mov ebx, dword [0x4f4b14]
not eax
mov edi, dword [ebx + 0x5390]
mov esi, edi
neg esi
sbb esi, esi
lea ecx, [edi + 4]
and esi, ecx
je 0x418a02
cmp dword [esi], eax
je 0x418a11
mov edx, dword [esi - 4]
mov ecx, dword [ebx + 0x5388]
add edx, esi
add ecx, 4
xor esi, esi
add ecx, edi
cmp edx, ecx
cmovne esi, edx
test esi, esi
jne 0x4189e3
mov ecx, dword [ebp - 4]
call fcn.004188a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x418a02
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x418a20
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x4f4b14]
test bl, bl
je 0x418a66
or edi, 0xffffffff
cmp bl, 0x23
jne 0x418a47
cmp byte [esi], bl
jne 0x418a47
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x4d6440]
test bl, bl
jne 0x418a38
mov edi, dword [0x4f4b14]
mov esi, dword [edi + 0x537c]
xor ecx, ecx
not eax
test esi, esi
jle 0x418a8c
mov edi, dword [edi + 0x5384]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x418a92
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x418a80
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x42cc60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x42cc96
mov eax, dword [0x4f4b14]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x42cc86
dec dword [eax + 0xb0]
push ecx
call fcn.004a28a0
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x42ccca
mov eax, dword [0x4f4b14]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x42ccba
dec dword [eax + 0xb0]
push ecx
call fcn.004a28a0
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x42ccfe
mov eax, dword [0x4f4b14]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x42ccee
dec dword [eax + 0xb0]
push ecx
call fcn.004a28a0
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x42cd4e
mov eax, dword [0x4f4b14]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x42cd3e
dec dword [eax + 0xb0]
push ecx
call fcn.004a28a0
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x42cd82
mov eax, dword [0x4f4b14]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x42cd72
dec dword [eax + 0xb0]
push ecx
call fcn.004a28a0
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x42cdb6
mov eax, dword [0x4f4b14]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x42cda6
dec dword [eax + 0xb0]
push ecx
call fcn.004a28a0
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.0042f5a0
Function at 0x44b0e0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c40c0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4f01c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
cmp dword [esi + 0x60], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], vtable.boost::asio::detail::win_iocp_io_context.0
je 0x44b1a5
call fcn.0044b740
mov ebx, dword [esi + 0x60]
push 0xffffffffffffffff
push 0
mov eax, dword [ebx + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [ebx + 8]
call edi
xor eax, eax
mov ecx, 0x4f4c2c
lock xadd dword [ecx], eax
mov ecx, dword [ebx + 4]
test eax, eax
push 0
setne al
push ecx
test al, al
je 0x44b171
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x44b187
push method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_56
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [esi + 0x60]
test ebx, ebx
je 0x44b19e
push dword [ebx + 4]
call edi
push 0xc
push ebx
call fcn.0047f303
add esp, 8
mov dword [esi + 0x60], 0
lea ecx, [esi + 0x54]
call fcn.00455200
lea eax, [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [esi + 0x30]
test eax, eax
je 0x44b1c1
push eax
call edi
mov ebx, dword [esi + 0x2c]
test ebx, ebx
je 0x44b1d8
push dword [ebx + 4]
call edi
push 0xc
push ebx
call fcn.0047f303
add esp, 8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x44b1e2
push eax
call edi
test byte [ebp + 8], 1
mov dword [esi], vtable.boost::asio::execution_context::service.0
je 0x44b1f9
push 0x64
push esi
call fcn.0047f303
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047eeda
mov esp, ebp
pop ebp
ret 4
Function at 0x44bef0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4f01c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x18], esi
cmp ebx, 0xffffffff
je 0x44c0c6
cmp byte [ebp + 8], 0
je 0x44bf52
mov al, byte [edx]
test al, 8
je 0x44bf52
or al, 8
xor ecx, ecx
push 4
mov byte [edx], al
lea eax, [ebp - 8]
push eax
push 0x80
push 0xffff
push ebx
mov dword [ebp - 8], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea ecx, [ebp - 0x14]
setne dl
call fcn.0044be60
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
mov ecx, esi
test ebx, ebx
setne dl
call fcn.0044be60
test ebx, ebx
je 0x44c0b4
mov esi, dword [0x4f15cc]
push edi
mov edi, dword [0x4f15c8]
cmp edi, 0x257edfd1
jne 0x44bf8c
cmp esi, 0xb2ab117a
je 0x44bf9c
cmp edi, 0x257edfd0
jne 0x44bfa0
cmp esi, 0xb2ab117a
jne 0x44bfa0
mov al, 1
jmp 0x44bfc0
mov eax, dword [0x4f15c0]
mov ecx, 0x4f15c0
push 0x2733
mov eax, dword [eax + 0x18]
call eax
mov esi, dword [0x4f15cc]
mov edi, dword [0x4f15c8]
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
movzx eax, al
mov dword [ebp - 0x14], 0x2733
add eax, 2
mov dword [ebp - 0x10], 0x4f15c0
movq xmm0, qword [ebp - 0x14]
movq qword [ebp - 0x14], xmm0
mov dword [ebp - 0xc], eax
call fcn.00449690
test al, al
jne 0x44c06b
cmp edi, 0x257edfd1
jne 0x44c000
cmp esi, 0xb2ab117a
je 0x44c010
cmp edi, 0x257edfd0
jne 0x44c014
cmp esi, 0xb2ab117a
jne 0x44c014
mov al, 1
jmp 0x44c028
mov eax, dword [0x4f15c0]
mov ecx, 0x4f15c0
push 0x4d5
mov eax, dword [eax + 0x18]
call eax
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
movzx eax, al
mov dword [ebp - 0x14], 0x4d5
add eax, 2
mov dword [ebp - 0x10], 0x4f15c0
movq xmm0, qword [ebp - 0x14]
movq qword [ebp - 0x14], xmm0
mov dword [ebp - 0xc], eax
call fcn.00449690
test al, al
jne 0x44c06b
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047eeda
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 8]
push eax
push 0x8004667e
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp - 0x20]
push esi
and byte [eax], 0xfc
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
setne dl
call fcn.0044be60
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047eeda
mov esp, ebp
pop ebp
ret
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047eeda
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0047eeda
mov esp, ebp
pop ebp
ret
Function at 0x44c420
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4f01c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push edi
push 0
push 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 8]
mov dword [ebp - 0xc], 0
push edx
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [0x4f15c8]
mov edi, eax
mov ecx, dword [0x4f15cc]
cmp edx, 0x257edfd1
jne 0x44c481
cmp ecx, 0xb2ab117a
je 0x44c491
cmp edx, 0x257edfd0
jne 0x44c498
cmp ecx, 0xb2ab117a
jne 0x44c498
test edi, edi
setne al
jmp 0x44c4a8
mov eax, dword [0x4f15c0]
mov ecx, 0x4f15c0
push edi
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
add eax, 2
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x4f15c0
mov edi, eax
movq xmm0, qword [ebp - 0x1c]
movq qword [esi], xmm0
mov dword [esi + 8], eax
mov dword [ebp - 0x10], 0x1ffff7
cmp edi, 1
je 0x44c4d8
mov eax, dword [esi]
mov ecx, eax
jmp 0x44c4ea
mov eax, dword [esi + 4]
xor edx, edx
div dword [ebp - 0x10]
mov ecx, dword [esi]
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x40
jne 0x44c543
mov ecx, dword [0x4f15c8]
mov eax, dword [0x4f15cc]
cmp ecx, 0x257edfd1
jne 0x44c509
cmp eax, 0xb2ab117a
je 0x44c518
cmp ecx, 0x257edfd0
jne 0x44c526
cmp eax, 0xb2ab117a
jne 0x44c526
mov al, 1
mov dword [ebp - 0x1c], 0x2746
jmp 0x44c5ab
mov eax, dword [0x4f15c0]
mov ecx, 0x4f15c0
push 0x2746
mov eax, dword [eax + 0x18]
call eax
mov dword [ebp - 0x1c], 0x2746
jmp 0x44c5ab
cmp edi, 1
je 0x44c54c
mov eax, ecx
jmp 0x44c55c
mov eax, dword [esi + 4]
xor edx, edx
div dword [ebp - 0x10]
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x4d2
jne 0x44c5c6
mov ecx, dword [0x4f15c8]
mov eax, dword [0x4f15cc]
cmp ecx, 0x257edfd1
jne 0x44c57d
cmp eax, 0xb2ab117a
je 0x44c58c
cmp ecx, 0x257edfd0
jne 0x44c590
cmp eax, 0xb2ab117a
jne 0x44c590
mov al, 1
jmp 0x44c5a4
mov eax, dword [0x4f15c0]
mov ecx, 0x4f15c0
push 0x274d
mov eax, dword [eax + 0x18]
call eax
mov dword [ebp - 0x1c], 0x274d
movzx eax, al
mov dword [ebp - 0x18], 0x4f15c0
add eax, 2
movq xmm0, qword [ebp - 0x1c]
movq qword [esi], xmm0
mov dword [esi + 8], eax
jmp 0x44c607
cmp edi, 1
je 0x44c5cf
mov eax, ecx
jmp 0x44c5df
mov eax, dword [esi + 4]
xor edx, edx
div dword [ebp - 0x10]
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x2738
je 0x44c61f
cmp edi, 1
jne 0x44c5ff
mov eax, dword [esi + 4]
xor edx, edx
mov edi, 0x1ffff7
div edi
imul eax, edx, 0x3e8
add ecx, eax
cmp ecx, 0xea
je 0x44c61f
test ebx, ebx
je 0x44c61f
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047eeda
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xorps xmm0, xmm0
mov eax, dword [ebp - 8]
xor ecx, ebp
movq qword [esi], xmm0
pop edi
mov dword [esi + 8], 0
pop esi
pop ebx
call fcn.0047eeda
mov esp, ebp
pop ebp
ret
Function at 0x44c9a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4f01c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 8]
push edi
push 0
push 0
push 0
push eax
push 1
push edx
push ecx
mov dword [ebp - 8], 0
call dword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [0x4f15c8]
mov edi, eax
mov ecx, dword [0x4f15cc]
cmp edx, 0x257edfd1
jne 0x44c9f7
cmp ecx, 0xb2ab117a
je 0x44ca07
cmp edx, 0x257edfd0
jne 0x44ca0e
cmp ecx, 0xb2ab117a
jne 0x44ca0e
test edi, edi
setne al
jmp 0x44ca1e
mov eax, dword [0x4f15c0]
mov ecx, 0x4f15c0
push edi
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
add eax, 2
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0x4f15c0
mov edi, eax
movq xmm0, qword [ebp - 0x14]
movq qword [esi], xmm0
mov dword [esi + 8], eax
mov dword [ebp - 0x18], 0x1ffff7
cmp edi, 1
je 0x44ca4e
mov eax, dword [esi]
mov ecx, eax
jmp 0x44ca60
mov eax, dword [esi + 4]
xor edx, edx
div dword [ebp - 0x18]
mov ecx, dword [esi]
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x40
jne 0x44cab9
mov ecx, dword [0x4f15c8]
mov eax, dword [0x4f15cc]
cmp ecx, 0x257edfd1
jne 0x44ca7f
cmp eax, 0xb2ab117a
je 0x44ca8e
cmp ecx, 0x257edfd0
jne 0x44ca9c
cmp eax, 0xb2ab117a
jne 0x44ca9c
mov al, 1
mov dword [ebp - 0x14], 0x2746
jmp 0x44cb22
mov eax, dword [0x4f15c0]
mov ecx, 0x4f15c0
push 0x2746
mov eax, dword [eax + 0x18]
call eax
mov dword [ebp - 0x14], 0x2746
jmp 0x44cb22
cmp edi, 1
jne 0x44cad2
mov eax, dword [esi + 4]
xor edx, edx
mov edi, 0x1ffff7
div edi
imul eax, edx, 0x3e8
add ecx, eax
cmp ecx, 0x4d2
jne 0x44cb3b
mov ecx, dword [0x4f15c8]
mov eax, dword [0x4f15cc]
cmp ecx, 0x257edfd1
jne 0x44caf4
cmp eax, 0xb2ab117a
je 0x44cb03
cmp ecx, 0x257edfd0
jne 0x44cb07
cmp eax, 0xb2ab117a
jne 0x44cb07
mov al, 1
jmp 0x44cb1b
mov eax, dword [0x4f15c0]
mov ecx, 0x4f15c0
push 0x274d
mov eax, dword [eax + 0x18]
call eax
mov dword [ebp - 0x14], 0x274d
mov dword [ebp - 0x10], 0x4f15c0
movq xmm0, qword [ebp - 0x14]
movzx eax, al
add eax, 2
movq qword [esi], xmm0
mov dword [esi + 8], eax
test ebx, ebx
je 0x44cb53
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047eeda
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xorps xmm0, xmm0
mov eax, dword [ebp - 8]
xor ecx, ebp
movq qword [esi], xmm0
pop edi
mov dword [esi + 8], 0
pop esi
pop ebx
call fcn.0047eeda
mov esp, ebp
pop ebp
ret