joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4653a0
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
sub esp, 0x4c
push esi
push edi
mov edi, dword [esp + 0x58]
mov eax, dword [edi + 0x18]
test eax, eax
je 0x4653bb
push eax
push 0
call fcn.0046eb30
add esp, 8
test byte [edi + 0x1c], 4
je 0x4653c9
or esi, 0xffffffff
jmp 0x46550c
push ebx
mov ebx, dword [esp + 0x60]
lea eax, [esp + 0xc]
push eax
push 0x4004667f
push ebx
mov dword [esp + 0x18], 0x1000
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jl 0x4653fa
mov eax, dword [esp + 0xc]
test eax, eax
jle 0x4653fa
cmp eax, 0x1000
jle 0x4653ff
mov eax, 0x1000
mov esi, dword [esp + 0x64]
test esi, esi
jl 0x46540b
cmp esi, eax
jle 0x46540d
mov esi, eax
push 4
push esi
push edi
call fcn.00464ee0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x465425
or esi, eax
jmp 0x46550b
push 1
lea ecx, [esp + 0x18]
push ecx
push 2
lea edx, [esp + 0x24]
push edx
push esi
push edi
call fcn.00462af0
mov esi, eax
add esp, 0x18
xor eax, eax
test esi, esi
jle 0x465465
jmp 0x465450
mov ecx, dword [esp + eax*8 + 0x18]
mov edx, dword [esp + eax*8 + 0x1c]
mov dword [esp + eax*8 + 0x3c], ecx
mov dword [esp + eax*8 + 0x38], edx
inc eax
cmp eax, esi
jl 0x465450
push 0
push 0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push esi
lea edx, [esp + 0x4c]
push edx
push ebx
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x46549e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2745
je 0x4654af
or esi, 0xffffffff
jmp 0x46550b
mov ebx, dword [esp + 0x10]
cmp ebx, 0xffffffff
jne 0x4654ab
or esi, ebx
jmp 0x46550b
test ebx, ebx
jne 0x4654b3
xor esi, esi
jmp 0x46550b
xor edi, edi
push ebp
mov ebp, ebx
test esi, esi
jle 0x4654f1
mov edx, dword [esp + 0x18]
mov ecx, dword [edx]
test byte [ecx + 0x10], 8
je 0x4654cc
xor eax, eax
jmp 0x4654e1
mov eax, dword [ecx + 4]
sub eax, dword [ecx + 0xc]
sub eax, dword [ecx + 8]
cmp eax, 0x7fffffff
jbe 0x4654e1
mov eax, closesocket
cmp eax, ebp
jge 0x465526
add dword [ecx + 0xc], eax
mov edx, dword [edx]
inc edi
sub ebp, eax
cmp edi, esi
jl 0x4654c0
mov eax, dword [esp + 0x60]
add dword [eax + 0xc], ebx
add dword [eax + 0x10], ebx
push eax
call fcn.00461b60
mov edi, dword [esp + 0x64]
add esp, 4
mov esi, ebx
pop ebp
pop ebx
mov eax, dword [edi + 0x18]
test eax, eax
je 0x46551e
push eax
push 0
call fcn.0046eb40
add esp, 8
pop edi
mov eax, esi
pop esi
add esp, 0x4c
ret
mov eax, ecx
add dword [eax + 0xc], ebp
mov eax, dword [esp + 0x60]
mov dword [eax + 8], edx
jmp 0x4654f5

Function at 0x468150
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x10], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x468189
push esi
push str.fcntl__d__F_GETFL_
push esi
call fcn.004666e0
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x468190
Capabilities:
Set socket configuration

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x8004667e
push esi
mov dword [esp + 0xc], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x4681c2
push esi
push str.fcntl__d__F_GETFL_
push esi
call fcn.004666e0
add esp, 0xc
or eax, 0xffffffff
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x4682a0
Capabilities:
Connect socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
cmp dword [esi], edi
jge 0x4682d6
movzx eax, word [ebx]
push edi
push 1
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
test eax, eax
jl 0x468333
push eax
mov edi, 1
call fcn.00468150
add esp, 4
test eax, eax
jl 0x468324
mov ecx, dword [esp + 0x18]
mov edx, dword [esi]
push ecx
push ebx
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jge 0x468340
mov eax, dword [esi]
push eax
call fcn.00468240
add esp, 4
cmp eax, 0x2733
je 0x46833a
cmp eax, 0x2714
je 0x46833a
cmp eax, 0x2734
je 0x46833a
cmp eax, 0x2726
je 0x46833a
cmp eax, 0x274d
jne 0x468320
pop edi
pop esi
mov eax, 2
pop ebx
ret
test edi, edi
je 0x468333
mov ecx, dword [esi]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], 0xffffffff
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x468680
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x2c
push ebx
xor eax, eax
push ebp
push esi
mov esi, dword [sym.imp.WS2_32.dll_getaddrinfo]
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
xor ebx, ebx
push 0x4ae28c
push 0x4ae290
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 0xc
call esi
lea edx, [esp + 0x10]
push edx
mov edi, eax
lea eax, [esp + 0x20]
push eax
push ebx
push 0x4ae298
call esi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x4ae2a0
mov ebp, 1
push str.1.2.3.4
mov dword [esp + 0x34], ebp
call esi
test eax, eax
jne 0x468720
cmp edi, ebx
je 0x468720
mov dword [0x4b6ccc], ebp
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, ecx
cmp ecx, ebx
je 0x468750
mov edi, edi
cmp dword [eax + 0xc], ebx
jne 0x46873e
mov eax, dword [eax + 0x1c]
cmp eax, ebx
jne 0x468730
jmp 0x468750
mov eax, edx
cmp edx, ebx
je 0x468750
cmp dword [eax + 0xc], ebx
jne 0x468756
mov eax, dword [eax + 0x1c]
cmp eax, ebx
jne 0x468744
mov dword [0x4b6cd0], ebp
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp eax, ebx
je 0x46876f
push eax
call esi
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
cmp ecx, ebx
je 0x46877a
push ecx
call esi
mov edx, dword [esp + 0x10]
cmp edx, ebx
je 0x468781
push edx
call esi
pop edi
pop esi
mov dword [0x4b6cd4], ebp
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x468b20
Capabilities:
Hash data using murmur3

Disassembly:
push edi
mov edi, dword [ebx]
test edi, edi
jne 0x468b2b
xor eax, eax
pop edi
ret
mov eax, dword [esp + 8]
push esi
mov esi, dword [eax + 4]
mov eax, esi
shr eax, 0x10
xor eax, esi
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
xor edx, edx
div dword [ebx + 4]
mov ecx, dword [edi + edx*4]
lea eax, [edi + edx*4]
test ecx, ecx
je 0x468b70
cmp dword [ecx + 4], esi
je 0x468b70
mov eax, ecx
mov ecx, dword [eax]
test ecx, ecx
jne 0x468b63
pop esi
pop edi
ret
Function at 0x4697e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x4a3070]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
mov ebx, dword [esp + 0x110]
push esi
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4698b9
mov ecx, ebx
lea esi, [ecx + 1]
lea ebx, [ebx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x469820
sub ecx, esi
lea ecx, [ecx + eax + 2]
cmp ecx, 0x104
jae 0x4698b9
mov eax, 0x4ae6cc
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x469840
push edi
lea edi, [esp + 0xc]
sub eax, edx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x469850
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x469870
lea edi, [esp + 0xc]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x469880
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0xc]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0044302b
add esp, 0x108
ret
mov ecx, dword [esp + 0x10c]
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0044302b
add esp, 0x108
ret

Function at 0x4698e0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x10]
push eax
mov ecx, edi
and ecx, 0x7bffffff
push ecx
push edx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
jl 0x469941
test edi, 0x4000000
je 0x469947
lea eax, [esp + 0x10]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x1c], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x469947
push esi
push str.fcntl__d__F_GETFL_
push esi
call fcn.004666e0
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
or eax, 0xffffffff
pop esi
ret
pop edi
mov eax, esi
pop esi
ret
Function at 0x469e20
Capabilities:
Hash data using murmur3

Disassembly:
cmp dword [esi], 0
je 0x469e2d
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jb 0x469e3b
mov ecx, dword [esi + 8]
inc ecx
push ecx
push esi
call fcn.00468c30
add esp, 8
inc dword [esi + 8]
mov ecx, dword [edi + 4]
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
xor edx, edx
div dword [esi + 4]
mov eax, dword [esi]
mov ecx, dword [eax + edx*4]
mov dword [edi], ecx
mov dword [eax + edx*4], edi
lea eax, [eax + edx*4]
ret

Function at 0x46b180
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3c]
xor ebx, ebx
push edi
mov dword [esp + 0x10], 0xffffffff
cmp esi, ebx
je 0x46b1a6
mov ecx, 8
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
jmp 0x46b1cc
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], ebx
mov edi, dword [esp + 0x44]
mov esi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
lea eax, [esp + 0x40]
push eax
push edi
lea ecx, [esp + 0x1c]
push ecx
push esi
push ebp
call fcn.0046abc0
add esp, 0x14
cmp eax, ebx
je 0x46b2ea
cmp eax, 8
je 0x46b2ea
cmp eax, 0x2af9
je 0x46b2ea
cmp dword [0x4b6cd4], ebx
jne 0x46b216
call fcn.00468680
cmp dword [0x4b6ccc], ebx
je 0x46b25d
cmp esi, ebx
je 0x46b25d
cmp dword [esp + 0x1c], ebx
jne 0x46b25d
call fcn.00468540
cmp eax, ebx
mov dword [esp + 0x10], eax
jl 0x46b25d
mov ebx, 1
test ebp, ebp
jne 0x46b25b
lea edx, [esp + 0x10]
push edx
push edi
lea eax, [esp + 0x1c]
push eax
push esi
push ebp
call fcn.0046abc0
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
xor esi, esi
cmp dword [0x4b6cd4], 0
jne 0x46b26b
call fcn.00468680
cmp dword [0x4b6cd0], 0
je 0x46b27d
lea eax, [esp + 0x14]
call fcn.00468610
and dword [esp + 0x14], 0x7fffffff
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
push ebp
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test ebx, ebx
je 0x46b2a8
mov edx, dword [esp + 0x10]
push edx
mov eax, edi
call fcn.004687d0
add esp, 4
cmp dword [0x4b6cd4], 0
jne 0x46b2b6
call fcn.00468680
cmp dword [0x4b6cd0], 0
je 0x46b2e8
mov eax, dword [edi]
call fcn.00468840
test eax, eax
jge 0x46b2e8
mov eax, dword [edi]
push eax
call fcn.00468900
add esp, 4
mov dword [edi], 0
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
add esp, 0x24
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x46b450
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push esi
push 0
push 1
push 2
call fcn.004699b0
add esp, 0x10
test eax, eax
jne 0x46b4de
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_ioctlsocket]
push edi
mov edi, dword [esi]
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push edi
mov dword [esp + 0x18], 1
call ebx
cmp eax, 0xffffffff
jne 0x46b4ba
push edi
push str.fcntl__d__F_GETFL_
push edi
call fcn.004666e0
mov edx, dword [esi]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
add esp, 0xc
push edx
call edi
mov eax, dword [esi + 4]
push eax
call edi
pop edi
or eax, 0xffffffff
pop ebx
mov dword [esi + 4], eax
mov dword [esi], eax
pop esi
pop ecx
ret
mov edi, dword [esi + 4]
lea ecx, [esp + 0xc]
push ecx
push 0x8004667e
push edi
mov dword [esp + 0x18], 1
call ebx
cmp eax, 0xffffffff
je 0x46b48d
pop edi
pop ebx
xor eax, eax
pop esi
pop ecx
ret
or eax, 0xffffffff
mov dword [esi + 4], eax
mov dword [esi], eax
pop esi
pop ecx
ret

Function at 0x46ca90
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
push edi
call fcn.0046f1b0
mov ebx, eax
movzx eax, byte [esi + 0x51]
push 0
push 1
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
mov eax, dword [esi + 0x4c]
test byte [eax + 0x20], 1
jne 0x46cac2
pop edi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
cmp edi, 0xffffffff
jne 0x46cad3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x46cb6e
push 4
add eax, 0x24
push eax
push 0x700b
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [esi + 0x4c]
test byte [ecx + 0x14], 1
jne 0x46cafc
push edi
call fcn.00468150
add esp, 4
mov edx, dword [esi + 0x4c]
mov eax, dword [edx + 0x2c]
push 1
push edi
push eax
call fcn.0046efa0
add esp, 0xc
test eax, eax
jge 0x46cb21
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop ebp
pop edi
or eax, 0xffffffff
pop ebx
pop ecx
ret
movzx eax, byte [esi + 0x50]
lea ebp, [esi + 0x18]
push ebp
shr eax, 1
lea ecx, [esp + 0x10]
push ecx
push eax
push eax
mov eax, dword [esi + 0x4c]
push 0
lea edx, [esi + 0x58]
push edx
mov dword [esi + 0x30], edi
mov ecx, dword [eax + 0x24]
mov edx, dword [ebx]
push edi
push ecx
call edx
test eax, eax
je 0x46cb61
push 1
push 0
push 1
push ebp
call fcn.0046c890
add esp, 0x10
pop ebp
pop edi
xor eax, eax
pop ebx
pop ecx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x46cb84
mov ecx, dword [esi + 0x4c]
mov dword [esi + 0x34], eax
mov edx, dword [ecx + 0x28]
lea eax, [esi + 0x38]
push eax
push edx
call fcn.0045dc40
add esp, 8
pop ebp
pop edi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x46ceb0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x88
mov eax, dword [0x4a3070]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
mov ebx, dword [esp + 0x90]
push ebp
mov ebp, dword [esp + 0xa0]
push esi
or ebp, 0x10
push edi
mov dword [esp + 0x10], 0x80
test ebx, ebx
je 0x46cf5d
push ebx
call fcn.0046f3f0
add esp, 4
test eax, eax
je 0x46cf5d
mov eax, dword [esp + 0xac]
mov esi, dword [esp + 0xb0]
test eax, eax
jle 0x46cf07
push eax
jmp 0x46cf0e
jge 0x46cf19
push 0x80
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jl 0x46cf5d
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x46cf3e
push str.getsockname
push esi
call fcn.004666e0
add esp, 8
jmp 0x46cf5d
push 0x3c
push 1
call fcn.0045bf20
mov edi, eax
add esp, 8
test edi, edi
jne 0x46cf78
push 0x4aeb74
call fcn.00466650
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044302b
add esp, 0x88
ret
mov edx, dword [esp + 0xa0]
mov eax, dword [esp + 0xa4]
mov dword [edi + 0x14], ebp
mov ebp, 1
or dword [edi + 0x20], ebp
mov ecx, ebp
push ebx
mov dword [edi], 0x48dd54
mov dword [edi + 8], edx
mov dword [edi + 0x10], eax
mov word [edi + 0x18], cx
call fcn.0046f3f0
push ebp
push esi
push eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x24], esi
mov dword [edi + 0x28], ebx
call fcn.0046efa0
add esp, 0x10
test eax, eax
jl 0x46d0a2
push ebp
call fcn.0046eaf0
mov edx, 4
push edx
push edx
mov dword [edi + 4], eax
mov word [edi + 0x30], dx
call fcn.0045bf20
add esp, 0xc
mov dword [edi + 0x38], eax
test eax, eax
jne 0x46cff7
push str.calloc
call fcn.00466650
jmp 0x46d08e
xor eax, eax
xor ebx, ebx
cmp ax, word [edi + 0x30]
jge 0x46d043
movzx ecx, word [esp + 0x14]
push ecx
call fcn.0046ce10
mov edx, dword [edi + 0x38]
mov dword [edx + ebx*4], eax
mov eax, dword [edi + 0x38]
lea eax, [eax + ebx*4]
add esp, 4
cmp dword [eax], 0
je 0x46d051
cmp dword [esp + 0xa0], 0
je 0x46d035
mov esi, dword [eax]
call fcn.0046ca90
test eax, eax
jl 0x46d060
add word [edi + 0x18], bp
movsx ecx, word [edi + 0x30]
add ebx, ebp
cmp ebx, ecx
jl 0x46d001
mov ecx, edi
call fcn.0046c800
mov eax, edi
jmp 0x46cf5f
push str.Couldnt_create_accepting_socket
call fcn.00466760
add esp, 4
jmp 0x46d085
push str.Couldnt_start_accepting_on_socket
call fcn.00466760
mov edx, dword [edi + 0x38]
mov eax, dword [edx + ebx*4]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 0x38]
mov esi, dword [ecx + ebx*4]
call fcn.0046c840
mov edx, dword [edi + 0x38]
push edx
call fcn.0045c010
mov eax, dword [edi + 4]
add esp, 4
test eax, eax
je 0x46d0a2
push ebp
push eax
call fcn.0046eb20
add esp, 8
push edi
call fcn.0045c010
jmp 0x46cf5a
Function at 0x46f010
Capabilities:
Create tcp socket

Disassembly:
sub esp, 0x3c
mov eax, dword [0x4a3070]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
mov esi, 0xddf3
mov word [esp + 0x24], si
xor ebx, ebx
mov esi, 0x4660
mov word [esp + 0x26], si
mov eax, 0xcbac
mov ecx, 0x11cf
push ebx
mov esi, 0xcbac
mov word [esp + 0x18], ax
mov word [esp + 0x1a], cx
mov dl, 0x48
mov cl, 0xa1
mov al, 0x92
mov word [esp + 0x38], si
push 1
mov esi, 0x11cf
push 2
mov dword [esp + 0x1c], 0xb5367df1
mov byte [esp + 0x24], 0x95
mov byte [esp + 0x25], 0xca
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], 0x80
mov byte [esp + 0x28], 0x5f
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2b], al
mov dword [esp + 0x2c], 0x25a207b9
mov byte [esp + 0x34], 0x8e
mov byte [esp + 0x35], 0xe9
mov byte [esp + 0x36], 0x76
mov byte [esp + 0x37], 0xe5
mov byte [esp + 0x38], 0x8c
mov byte [esp + 0x39], 0x74
mov byte [esp + 0x3a], 6
mov byte [esp + 0x3b], 0x3e
mov dword [esp + 0x3c], 0xb5367df2
mov word [esp + 0x42], si
mov byte [esp + 0x44], 0x95
mov byte [esp + 0x45], 0xca
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], 0x80
mov byte [esp + 0x48], 0x5f
mov byte [esp + 0x49], dl
mov byte [esp + 0x4a], cl
mov byte [esp + 0x4b], al
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x46f19e
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_WSAIoctl]
push ebx
push ebx
lea edx, [esp + 0x18]
push edx
push 4
lea eax, [esp + 0x1c]
push eax
push 0x10
lea ecx, [esp + 0x2c]
push ecx
push 0xc8000006
push esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call ebp
mov edx, dword [esp + 0xc]
push ebx
push ebx
lea eax, [esp + 0x18]
push eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push 0x10
mov dword [edi], edx
lea edx, [esp + 0x3c]
push edx
push 0xc8000006
push esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call ebp
mov eax, dword [esp + 0xc]
push ebx
push ebx
lea ecx, [esp + 0x18]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push 0x10
mov dword [edi + 4], eax
lea eax, [esp + 0x4c]
push eax
push 0xc8000006
push esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call ebp
mov ecx, dword [esp + 0xc]
push esi
mov dword [edi + 8], ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x4b6d5c], 1
pop ebp
mov ecx, dword [esp + 0x40]
pop esi
pop ebx
xor ecx, esp
call fcn.0044302b
add esp, 0x3c
ret
Function at 0x46f1c0
Capabilities:
Create thread

Disassembly:
cmp dword [0x4b6d5c], 0
push esi
push edi
jne 0x46f1d5
mov edi, 0x4b6d50
call fcn.0046f010
push 0x30
push 1
call fcn.0045bf20
mov esi, eax
add esp, 8
test esi, esi
jne 0x46f1ea
pop edi
pop esi
ret
mov edi, dword [esp + 0xc]
test edi, edi
jg 0x46f1f7
mov edi, 2
lea eax, [edi + edi]
mov word [esi + 0x1c], ax
push ebp
cwde
push 4
push eax
call fcn.0045bf20
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
mov dword [esi + 0x24], eax
test eax, eax
je 0x46f28e
push edi
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [esi], eax
mov dword [esi + 0x20], 0xffffffff
test eax, eax
je 0x46f297
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi + 0x2c], eax
test eax, eax
je 0x46f28e
xor ecx, ecx
xor edi, edi
cmp cx, word [esi + 0x1c]
jge 0x46f279
push esi
push 0
push 0x46ee80
call fcn.004797dc
add esp, 0xc
cmp eax, 0xffffffff
je 0x46f28e
mov edx, dword [esi + 0x24]
mov dword [edx + edi*4], eax
inc word [esi + 0x28]
movsx eax, word [esi + 0x1c]
inc edi
cmp edi, eax
jl 0x46f251
push 0x3e8
lea ecx, [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
pop ebp
pop edi
mov eax, esi
pop esi
ret
mov eax, dword [esi]
test eax, eax
je 0x46f297
push eax
call ebp
mov eax, dword [esi + 0x24]
test eax, eax
je 0x46f2a7
push eax
call fcn.0045c010
add esp, 4
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x46f2b1
push eax
call ebp
push esi
call fcn.0045c010
add esp, 4
pop ebp
pop edi
xor eax, eax
pop esi
ret
Function at 0x475020
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
xor ebp, ebp
cmp esi, ebp
je 0x47503a
test byte [esi + 0x1c], 0x10
je 0x47503a
mov ebx, esi
jmp 0x47503c
xor ebx, ebx
or eax, 0xffffffff
mov dword [esp + 0xc], eax
cmp esi, ebp
je 0x4751c9
mov eax, dword [esi + 0x18]
cmp eax, ebp
je 0x47505c
push eax
push ebp
call fcn.0046eb30
add esp, 8
test byte [ebx + 0x4c], 1
je 0x4750b7
push 0x4b311c
push 0x4b3134
push 0xba
push 0x4b3150
push 0x4b3160
push 0xdeaddead
call fcn.00466710
add esp, 0x18
push str.evbuffer_launch_write_
push str._buf_o__read_in_progress
push 0xba
push 0x4b31b8
push 0x4b31c8
call fcn.004768a8
add eax, 0x40
push eax
call fcn.00476b83
add esp, 0x18
call fcn.00445392
test byte [esi + 0x1c], 2
jne 0x4751b3
test byte [ebx + 0x4c], 2
jne 0x4751b3
mov eax, dword [esi + 0xc]
cmp eax, ebp
jne 0x4750db
mov dword [esp + 0xc], ebp
jmp 0x4751b3
mov ecx, dword [esp + 0x1c]
cmp ecx, ebp
jl 0x4750e7
cmp ecx, eax
jbe 0x4750eb
mov dword [esp + 0x1c], eax
push edi
push 1
push esi
call fcn.00463790
push 0x80
lea edi, [ebx + 0x58]
push ebp
push edi
mov dword [ebx + 0x50], ebp
mov dword [ebx + 0x54], ebp
call fcn.00444cd0
mov esi, dword [esi]
add esp, 0x14
mov dword [ebx + 0x50], esi
test esi, esi
je 0x47514d
mov eax, dword [esi + 0x18]
add eax, dword [esi + 8]
push 0x20
push esi
mov dword [edi + 4], eax
call fcn.00461810
mov eax, dword [esp + 0x28]
add esp, 8
inc ebp
cmp eax, dword [esi + 0xc]
jbe 0x47514b
mov ecx, dword [esi + 0xc]
mov dword [edi], ecx
sub eax, dword [esi + 0xc]
mov esi, dword [esi]
add edi, 8
cmp ebp, 0x10
mov dword [esp + 0x20], eax
jl 0x475111
jmp 0x47514d
mov dword [edi], eax
mov esi, dword [esp + 0x1c]
push esi
mov dword [ebx + 0x54], ebp
call fcn.00461940
mov edx, dword [esp + 0x28]
mov ecx, dword [ebx + 0x48]
add esp, 4
push 0
push edx
push 0
lea eax, [esp + 0x20]
push eax
push ebp
lea eax, [ebx + 0x58]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSASend]
pop edi
test eax, eax
je 0x4751a7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x4751a7
push 0x20
push ebx
call fcn.00474cc0
push 1
push esi
call fcn.004637d0
push esi
call fcn.00461da0
add esp, 0x14
jmp 0x4751b3
or dword [ebx + 0x4c], 2
mov dword [esp + 0xc], 0
mov esi, dword [esi + 0x18]
test esi, esi
je 0x4751c5
push esi
push 0
call fcn.0046eb40
add esp, 8
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
add esp, 8
ret