joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0xc]
shr ecx, 3
jecxz 0x437b6a
mov esi, dword [ebp + 8]
movq mm2, qword [str.11111111]
movq mm0, qword [esi]
pxor mm0, mm2
movq mm1, mm0
psllq mm0, 0x3d
psrlq mm1, 3
por mm0, mm1
movq qword [esi], mm0
add esi, 8
loop 0x437b4e
emms
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43bb50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d41db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 8], 0
jge 0x43bb7e
push 0
call fcn.005b9180
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
cmp dword [ebp + 8], 0
jle 0x43bc00
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
imul edx, edx, 0x2c
add edx, 4
push edx
call fcn.005b4560
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0
je 0x43bbe4
push fcn.0040dcc0
push fcn.00435a40
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov edx, dword [ebp - 0x14]
push edx
push 0x2c
mov eax, dword [ebp - 0x1c]
add eax, 4
push eax
call fcn.005b9070
mov ecx, dword [ebp - 0x1c]
add ecx, 4
mov dword [ebp - 0x20], ecx
jmp 0x43bbeb
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43bc70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
jl 0x43bc90
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
sub ecx, 1
cmp dword [ebp + 8], ecx
jle 0x43bc97
push 0
call fcn.005b9180
mov edx, dword [ebp + 8]
imul edx, edx, 0x2c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43bcb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d41fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 8], 0
jge 0x43bcde
push 0
call fcn.005b9180
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 4]
jne 0x43bcee
jmp 0x43be5c
cmp dword [ebp + 8], 0
jne 0x43bd3f
mov edx, dword [ebp - 0x10]
cmp dword [edx + 4], 0
jle 0x43bd3f
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0
je 0x43bd20
push 3
mov ecx, dword [ebp - 0x24]
call fcn.0040dc40
mov dword [ebp - 0x3c], eax
jmp 0x43bd27
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
jmp 0x43be5c
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x2c
add eax, 4
push eax
call fcn.005b4560
add esp, 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x30], 0
je 0x43bd96
push fcn.0040dcc0
push fcn.00435a40
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov eax, dword [ebp - 0x18]
push eax
push 0x2c
mov ecx, dword [ebp - 0x30]
add ecx, 4
push ecx
call fcn.005b9070
mov edx, dword [ebp - 0x30]
add edx, 4
mov dword [ebp - 0x40], edx
jmp 0x43bd9d
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x43bdbd
push 0
call fcn.005b9180
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 4]
jge 0x43bdd0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x44], ecx
jmp 0x43bdd9
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
je 0x43be4b
mov dword [ebp - 0x20], 0
jmp 0x43bdf9
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x1c]
jge 0x43be21
mov edx, dword [ebp - 0x20]
imul edx, edx, 0x2c
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
add ecx, edx
push ecx
mov edx, dword [ebp - 0x20]
imul edx, edx, 0x2c
mov ecx, dword [ebp - 0x14]
add ecx, edx
call fcn.004359c0
jmp 0x43bdf0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 0
je 0x43be44
push 3
mov ecx, dword [ebp - 0x34]
call fcn.0040dc40
mov dword [ebp - 0x48], eax
jmp 0x43be4b
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43be70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
jge 0x43be89
push 0
call fcn.005b9180
mov eax, dword [ebp - 4]
mov dword [eax], 0
cmp dword [ebp + 8], 0
jle 0x43beb2
mov ecx, dword [ebp + 8]
shl ecx, 3
push ecx
call fcn.005b4560
add esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43bf90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
jl 0x43bfb0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
sub ecx, 1
cmp dword [ebp + 8], ecx
jle 0x43bfb7
push 0
call fcn.005b9180
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
lea eax, [eax + ecx*8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43bfd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
jge 0x43bfe9
push 0
call fcn.005b9180
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 4]
jne 0x43bff9
jmp 0x43c0e0
cmp dword [ebp + 8], 0
jne 0x43c034
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
jle 0x43c034
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.005a1380
add esp, 4
mov eax, dword [ebp - 4]
mov dword [eax], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
jmp 0x43c0e0
mov edx, dword [ebp + 8]
shl edx, 3
push edx
call fcn.005b4560
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43c059
push 0
call fcn.005b9180
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 4]
jge 0x43c06c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
jmp 0x43c075
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
je 0x43c0cf
mov dword [ebp - 0x10], 0
jmp 0x43c095
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x43c0bb
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x10]
mov ecx, dword [edx + eax*8]
mov edx, dword [edx + eax*8 + 4]
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 8]
mov dword [esi + eax*8], ecx
mov dword [esi + eax*8 + 4], edx
jmp 0x43c08c
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.005a1380
add esp, 4
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43c0f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d421b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 8], 0
jge 0x43c11e
push 0
call fcn.005b9180
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
cmp dword [ebp + 8], 0
jle 0x43c1a0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
imul edx, edx, 0x18
add edx, 4
push edx
call fcn.005b4560
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0
je 0x43c184
push fcn.0040dda0
push fcn.00435c90
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov edx, dword [ebp - 0x14]
push edx
push 0x18
mov eax, dword [ebp - 0x1c]
add eax, 4
push eax
call fcn.005b9070
mov ecx, dword [ebp - 0x1c]
add ecx, 4
mov dword [ebp - 0x20], ecx
jmp 0x43c18b
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43c210
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
jl 0x43c230
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
sub ecx, 1
cmp dword [ebp + 8], ecx
jle 0x43c237
push 0
call fcn.005b9180
mov edx, dword [ebp + 8]
imul edx, edx, 0x18
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43c250
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d423b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 8], 0
jge 0x43c27e
push 0
call fcn.005b9180
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 4]
jne 0x43c28e
jmp 0x43c3fc
cmp dword [ebp + 8], 0
jne 0x43c2df
mov edx, dword [ebp - 0x10]
cmp dword [edx + 4], 0
jle 0x43c2df
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0
je 0x43c2c0
push 3
mov ecx, dword [ebp - 0x24]
call fcn.0040dd20
mov dword [ebp - 0x3c], eax
jmp 0x43c2c7
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
jmp 0x43c3fc
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x18
add eax, 4
push eax
call fcn.005b4560
add esp, 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x30], 0
je 0x43c336
push fcn.0040dda0
push fcn.00435c90
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov eax, dword [ebp - 0x18]
push eax
push 0x18
mov ecx, dword [ebp - 0x30]
add ecx, 4
push ecx
call fcn.005b9070
mov edx, dword [ebp - 0x30]
add edx, 4
mov dword [ebp - 0x40], edx
jmp 0x43c33d
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x43c35d
push 0
call fcn.005b9180
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 4]
jge 0x43c370
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x44], ecx
jmp 0x43c379
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
je 0x43c3eb
mov dword [ebp - 0x20], 0
jmp 0x43c399
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x1c]
jge 0x43c3c1
mov edx, dword [ebp - 0x20]
imul edx, edx, 0x18
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
add ecx, edx
push ecx
mov edx, dword [ebp - 0x20]
imul edx, edx, 0x18
mov ecx, dword [ebp - 0x14]
add ecx, edx
call fcn.00435cc0
jmp 0x43c390
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 0
je 0x43c3e4
push 3
mov ecx, dword [ebp - 0x34]
call fcn.0040dd20
mov dword [ebp - 0x48], eax
jmp 0x43c3eb
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x496050
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
and eax, 0xff
neg eax
sbb eax, eax
and eax, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0xc], 0
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], 0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0x496150
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x4960d5
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov byte [edx + 0xc], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x14], 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [0x6bc780], edx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x496230
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov ecx, 0xa
mov esi, str.CMain_network_thread::server_init_network
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0xffffffff
jne 0x496279
xor al, al
jmp 0x49632e
mov dword [ebp - 0x38], 1
push 4
lea eax, [ebp - 0x38]
push eax
push 4
push 0xffff
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x4962a6
xor al, al
jmp 0x49632e
push 4
lea eax, [ebp - 0x38]
push eax
push 1
push 6
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x4962c6
xor al, al
jmp 0x49632e
push 0x10
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.005b3bb0
add esp, 0xc
mov word [ebp - 0x48], 2
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x10]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x46], ax
mov dword [ebp - 0x44], 0
push 0x10
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x496311
xor al, al
jmp 0x49632e
push bind
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x49632c
xor al, al
jmp 0x49632e
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x496b00
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.004e97c0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x40], eax
jl 0x496b23
xor eax, eax
jmp 0x496ca1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0xc], eax
jmp 0x496b37
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
add eax, dword [ecx + 0x14]
cmp dword [ebp - 0xc], eax
jae 0x496c9f
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
cdq
idiv dword [ecx]
imul edx, edx, 0x206b0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
add ecx, edx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
call fcn.00496cb0
test eax, eax
jne 0x496c9a
mov edx, dword [ebp - 4]
add edx, 0x18
push edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 8]
call fcn.00481790
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x30
call fcn.0043a5a0
push eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 4]
add ecx, 0x30
call fcn.004970d0
mov ecx, eax
call fcn.0048c0d0
and eax, 0xff
test eax, eax
je 0x496c8d
push 0xc
call fcn.005b4560
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x496c7c
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov dl, byte [ecx + 4]
mov byte [eax + 8], dl
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov dl, byte [ecx + 5]
mov byte [eax + 9], dl
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov dl, byte [ecx + 6]
mov byte [eax + 0xa], dl
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov dl, byte [ecx + 7]
mov byte [eax + 0xb], dl
push 1
mov ecx, dword [ebp - 8]
call fcn.00496cf0
mov ecx, dword [ebp - 8]
call fcn.00481790
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00594880
push eax
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [ebp - 4]
add ecx, 0x30
call fcn.00497060
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
add ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], ecx
mov eax, dword [ebp - 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
jmp 0x496ca1
mov ecx, dword [ebp - 4]
add ecx, 0x18
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x496ca1
mov edx, dword [ebp - 4]
add edx, 0x18
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x496b2e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x496f90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
and eax, 0xff
neg eax
sbb eax, eax
and eax, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov ecx, dword [ebp - 4]
mov byte [ecx + 9], 0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0x496d30
push 0xa00000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x497003
mov ecx, dword [ebp - 4]
mov byte [ecx + 8], 1
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [0x6bc784], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x49b920
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d5a24
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.004a4d80
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004970b0
mov eax, dword [ebp - 0x10]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.004a4eb0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0049b900
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.0043dd60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a2a50
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
jmp 0x4a2a75
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp edx, dword [ecx]
jge 0x4a2bde
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x206b0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
add edx, eax
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call fcn.00496cb0
test eax, eax
je 0x4a2bd9
mov ecx, dword [ebp - 8]
call fcn.0047c8f0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x4a2adf
mov ecx, dword [ebp - 8]
call fcn.004a4860
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
call fcn.00482410
push 0
mov ecx, dword [ebp - 8]
call fcn.00496cf0
jmp 0x4a2a6c
cmp dword [ebp - 0xc], 3
jg 0x4a2af0
cmp dword [ebp - 0xc], 0x16
je 0x4a2af0
jmp 0x4a2a6c
mov dword [0x6e32c0], 0
mov dword [ebp - 0x14], 0
jmp 0x4a2b0c
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp edx, dword [0x6e32c0]
jae 0x4a2b2d
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [eax*4 + 0x6e32c4]
cmp edx, dword [ecx + 0x7c]
jne 0x4a2b2b
jmp 0x4a2b2d
jmp 0x4a2b03
mov eax, dword [ebp - 0x14]
cmp eax, dword [0x6e32c0]
jne 0x4a2b60
cmp dword [0x6e32c0], 0x40
jae 0x4a2b60
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x7c]
mov dword [ecx*4 + 0x6e32c4], eax
mov ecx, dword [0x6e32c0]
add ecx, 1
mov dword [0x6e32c0], ecx
xor edx, edx
test edx, edx
jne 0x4a2afa
push 0x6f8410
push 0
push 0
push 0x6e32c0
push 1
call dword [sym.imp.WS2_32.dll_select]
mov dword [0x6e32b8], eax
cmp dword [0x6e32b8], 0
jle 0x4a2b9f
cmp dword [ebp - 0xc], 0x2e
jl 0x4a2b9d
push 0x6e32c0
mov ecx, dword [ebp - 8]
call fcn.004a3a30
jmp 0x4a2bd9
cmp dword [0x6e32b8], 0xffffffff
jne 0x4a2bd9
cmp dword [ebp - 0xc], 0x2e
jl 0x4a2bd9
cmp dword [0x60f874], 0
jne 0x4a2bd9
mov dword [ebp - 0x1c], 0x1b
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 8]
call fcn.00482410
push 0x35
push 0x5d932c
call fcn.0051c190
add esp, 8
jmp 0x4a2a6c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret