joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414010
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push esi
push edi
push dword [0x4ba668]
mov edi, ecx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x414058
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x414058
mov eax, dword [ecx]
test eax, eax
je 0x414058
mov dword [ecx], 0
mov cl, byte [eax]
cmp cl, 0xd
jb 0x41404f
mov byte [eax + 0x34], cl
jmp 0x414066
push eax
call fcn.00451a43
add esp, 4
push 0x35
call fcn.00451ccf
add esp, 4
mov byte [eax + 0x34], 0xd
mov dword [ebp - 8], eax
test eax, eax
je 0x41407c
push ecx
push dword [ebp + 8]
mov ecx, eax
call fcn.00414700
mov esi, eax
jmp 0x41407e
xor esi, esi
mov eax, dword [edi]
mov edi, dword [eax + 8]
lea eax, [edi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push esi
push 0
push 0
mov dword [esi + 0x1c], 1
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x4140de
push ebx
lea ebx, [edi + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 0x14], 0
mov eax, dword [edi + 0x58]
test eax, eax
je 0x4140c4
mov dword [eax + 0x14], esi
jmp 0x4140c7
mov dword [edi + 0x54], esi
push 1
lea eax, [edi + 0x34]
mov dword [edi + 0x58], esi
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call fcn.00414520
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x414100
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48bc9d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx]
push dword [0x4ba668]
mov esi, dword [eax + 8]
lea eax, [esi + 0x14]
neg esi
sbb esi, esi
and esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x414152
cmp dword [eax], esi
je 0x41418f
mov eax, dword [eax + 8]
test eax, eax
jne 0x414147
mov eax, dword [ebp + 0xc]
push dword [0x4ba668]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4141f9
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x4141f9
mov eax, dword [ecx]
test eax, eax
je 0x4141f9
mov dword [ecx], 0
mov cl, byte [eax]
cmp cl, 0xd
jb 0x4141f0
mov byte [eax + 0x34], cl
jmp 0x414207
cmp dword [eax + 4], 0
je 0x414152
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 4]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ebp - 0x18], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x14], eax
mov al, byte [ecx + 0xc]
mov byte [ebp - 0x10], al
mov byte [ecx + 0xc], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 1
mov ecx, edx
call fcn.00414790
lea ecx, [ebp - 0x1c]
call fcn.00413b90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push eax
call fcn.00451a43
add esp, 4
push 0x35
call fcn.00451ccf
add esp, 4
mov byte [eax + 0x34], 0xd
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41421b
push ecx
push dword [ebp + 8]
mov ecx, eax
call fcn.00414700
jmp 0x41421d
xor eax, eax
push ecx
mov ecx, dword [ebx]
push eax
mov ecx, dword [ecx + 8]
call fcn.004107a0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
call fcn.00414520
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x414520
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x414538
push ecx
call fcn.00414580
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x41457c
push dword [0x4ba668]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41456c
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41456c
cmp dword [ecx], 0
jne 0x41456c
mov al, byte [esi + 0x34]
mov byte [esi], al
mov dword [ecx], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret
push esi
call fcn.00451a43
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
Function at 0x4153a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48bea0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
push dword [0x4ba66c]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x4ba66c]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 1
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x24], 0
mov ecx, dword [eax]
mov eax, dword [0x4ba648]
cmp eax, dword [ecx + 4]
jle 0x415446
push 0x4ba648
call fcn.00451fcb
add esp, 4
cmp dword [0x4ba648], 0xffffffff
jne 0x415446
call fcn.004097c0
push 0x4ba648
call fcn.00451f8c
add esp, 4
mov eax, dword [edi]
add eax, 0x10
mov dword [ebp - 0x20], 0x4ba638
mov esi, dword [eax]
test esi, esi
je 0x41548b
mov edx, dword [eax]
test edx, edx
je 0x41546f
mov ecx, dword [edx]
mov dword [eax], ecx
test ecx, ecx
jne 0x415469
mov dword [eax + 4], ecx
mov dword [edx], 0
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [esi + 4]
push esi
push dword [edi]
call eax
mov eax, dword [edi]
add esp, 0x10
add eax, 0x10
mov esi, dword [eax]
test esi, esi
jne 0x415458
lea ecx, [ebp - 0x10]
call fcn.004154e0
push dword [ebp - 0x14]
push dword [0x4ba66c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415600
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push dword [0x4ba668]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x415643
mov edx, dword [eax + 4]
test edx, edx
je 0x415643
mov eax, dword [edx]
test eax, eax
je 0x415643
mov dword [edx], 0
mov cl, byte [eax]
cmp cl, 0xd
jb 0x41563a
mov byte [eax + 0x34], cl
jmp 0x415651
push eax
call fcn.00451a43
add esp, 4
push 0x35
call fcn.00451ccf
add esp, 4
mov byte [eax + 0x34], 0xd
mov dword [ebp - 0xc], eax
test eax, eax
je 0x415667
push ecx
push dword [ebp + 8]
mov ecx, eax
call fcn.00415850
mov esi, eax
jmp 0x415669
xor esi, esi
mov eax, dword [edi]
mov edi, dword [eax + 8]
lea eax, [edi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push esi
push 0
push 0
mov dword [esi + 0x1c], 1
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x4156c7
lea ebx, [edi + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 0x14], 0
mov eax, dword [edi + 0x58]
test eax, eax
je 0x4156ae
mov dword [eax + 0x14], esi
jmp 0x4156b1
mov dword [edi + 0x54], esi
push 1
lea eax, [edi + 0x34]
mov dword [edi + 0x58], esi
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov dword [ebp - 0xc], 0
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x415b10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48bfae
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0x74]
mov dword [ebp - 4], 0
push dword [0x4ba668]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x415b80
mov eax, dword [eax + 4]
test eax, eax
je 0x415b80
mov esi, dword [eax + 8]
test esi, esi
je 0x415b80
mov dword [eax + 8], 0
mov al, byte [esi]
cmp al, 0x1d
jb 0x415b77
mov byte [esi + 0x74], al
jmp 0x415b90
push esi
call fcn.00451a43
add esp, 4
push 0x75
call fcn.00451ccf
mov esi, eax
add esp, 4
mov byte [esi + 0x74], 0x1d
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
test esi, esi
je 0x415be2
mov dword [esi], 0x415d20
lea ecx, [esi + 0x1c]
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
movq xmm0, qword [ebp + 0x14]
mov dword [ebp + 0xc], 0
mov dword [ebp + 0x10], 0
movq qword [esi + 0x10], xmm0
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x18], eax
lea eax, [ebp + 0x20]
push eax
call fcn.00415240
jmp 0x415be4
xor esi, esi
lea ecx, [ebp - 0x18]
mov dword [edi], esi
mov dword [ebp - 0x14], 0
call fcn.00415c60
lea ecx, [ebp + 0x20]
call fcn.00415110
mov dword [ebp - 4], 1
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x415c2c
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x415c2c
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x415c2c
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x70

Function at 0x415c60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48bc06
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x415ccc
lea ecx, [esi + 0x1c]
call fcn.00415110
mov dword [ebp - 4], 0
mov esi, dword [esi + 0xc]
test esi, esi
je 0x415cc5
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x415cc5
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x415cc5
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x415d0a
push dword [0x4ba668]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x415cfa
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x415cfa
cmp dword [ecx + 8], 0
jne 0x415cfa
mov al, byte [esi + 0x74]
mov byte [esi], al
mov dword [ecx + 8], esi
jmp 0x415d03
push esi
call fcn.00451a43
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416330
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c06e
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4b1070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x44], esi
cmp dword [0x4ba5c4], 0
mov dword [ebp - 0x48], 0
je 0x416393
push 0xffffffffffffffff
push 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push 0x4ba5b4
mov byte [esi], 0
call fcn.00401d80
jmp 0x416534
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 0
push eax
push 0
mov dword [ebp - 0x44], 0
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x416471
movzx eax, byte [0x199]
push eax
movzx eax, byte [0x198]
push eax
movzx eax, byte [0x197]
push eax
movzx eax, byte [0x196]
push eax
movzx eax, byte [0x195]
push eax
movzx eax, byte [0x194]
push eax
lea eax, [ebp - 0x40]
push str._02X_02X_02X_02X_02X_02X
push eax
call fcn.004465a0
add esp, 0x20
mov edi, eax
lea eax, [ebp - 0x28]
cmp eax, edi
je 0x416441
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x416426
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00402390
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00401eb0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x41645a
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00402390
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x28]
mov ecx, 0x4ba5b4
push eax
call fcn.00401d80
jmp 0x416514
cmp eax, 0x6f
jne 0x416514
push dword [ebp - 0x44]
call fcn.0046d796
add esp, 4
mov edi, eax
lea eax, [ebp - 0x44]
push eax
push edi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x416507
movzx ecx, byte [edi + 0x199]
movzx eax, byte [edi + 0x198]
push ecx
push eax
movzx eax, byte [edi + 0x197]
push eax
movzx eax, byte [edi + 0x196]
push eax
movzx eax, byte [edi + 0x195]
push eax
movzx eax, byte [edi + 0x194]
push eax
lea eax, [ebp - 0x40]
push str._02X_02X_02X_02X_02X_02X
push eax
call fcn.004465a0
add esp, 0x20
lea ecx, [ebp - 0x28]
push eax
call fcn.00406dc0
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x4164f5
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00402390
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x28]
mov ecx, 0x4ba5b4
push eax
call fcn.00401d80
test edi, edi
je 0x416514
push edi
call fcn.0046d567
add esp, 4
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.00401ab0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x416534
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00402390
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00451a48
mov esp, ebp
pop ebp
ret
Function at 0x41bce0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48bc66
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00451ccf
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004502ae
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41e320
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [ebp + 0x18], 0
push 0
je 0x41e353
mov ecx, dword [edi + 4]
push 0
push dword [ebp + 0x1c]
call fcn.00410970
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x41e375
mov ecx, dword [edi + 4]
push 0x2719
push dword [ebp + 0x1c]
call fcn.00410970
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov ebx, dword [ebp + 0x1c]
lea ecx, [ebp + 0x18]
push ebx
push dword [ebp + 0x14]
mov dword [ebp + 0x18], 0
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
je 0x41e3c9
cmp eax, 0x3e5
je 0x41e3c9
push dword [ebp + 0x18]
mov ecx, dword [edi + 4]
push eax
push ebx
call fcn.00410970
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov ecx, dword [edi + 4]
push ebx
call fcn.00410900
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
Function at 0x41e3e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [ebp + 0x18], 0
push 0
je 0x41e413
mov ecx, dword [esi + 4]
push 0
push dword [ebp + 0x1c]
call fcn.00410970
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x41e435
mov ecx, dword [esi + 4]
push 0x2719
push dword [ebp + 0x1c]
call fcn.00410970
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x1c]
push edi
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x41e46f
mov eax, 0x2746
jmp 0x41e47c
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x41e49c
cmp eax, 0x3e5
je 0x41e49c
push dword [ebp + 0x18]
mov ecx, dword [esi + 4]
push eax
push edi
call fcn.00410970
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov ecx, dword [esi + 4]
push edi
call fcn.00410900
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18

Function at 0x41e990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
je 0x41e9a4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
cmp edi, 4
jb 0x41ea2a
mov ecx, eax
sub ecx, ebx
mov dword [ebp - 4], ecx
nop dword [eax + eax]
movzx esi, byte [ecx + ebx + 2]
movzx ecx, byte [eax + 3]
movzx edx, byte [ebx + 3]
shl ecx, 8
or esi, ecx
shl edx, 8
movzx ecx, byte [eax]
shl esi, 0x10
or esi, ecx
movzx ecx, byte [eax + 1]
and ecx, 0xffdfdfdf
and esi, 0xdfdfdfdf
shl ecx, 8
or esi, ecx
movzx ecx, byte [ebx + 2]
or edx, ecx
movzx ecx, byte [ebx]
shl edx, 0x10
or edx, ecx
movzx ecx, byte [ebx + 1]
and ecx, 0xffdfdfdf
and edx, 0xdfdfdfdf
shl ecx, 8
or edx, ecx
cmp edx, esi
jne 0x41ea49
mov ecx, dword [ebp - 4]
sub edi, 4
add eax, 4
add ebx, 4
cmp edi, 4
jae 0x41e9c0
test edi, edi
je 0x41ea40
sub ebx, eax
mov cl, byte [ebx + eax]
xor cl, byte [eax]
test cl, 0xdf
jne 0x41ea49
inc eax
sub edi, 1
jne 0x41ea30
pop esi
pop ebx
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
pop esi
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x429d50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d16e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], 0
push dword [0x4ba668]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x429dc0
mov eax, dword [eax + 4]
test eax, eax
je 0x429dc0
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x429dc0
mov dword [eax + 8], 0
mov al, byte [ecx]
cmp al, 6
jb 0x429db7
mov byte [ecx + 0x18], al
jmp 0x429dd0
push ecx
call fcn.00451a43
add esp, 4
push 0x19
call fcn.00451ccf
mov ecx, eax
add esp, 4
mov byte [ecx + 0x18], 6
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
test ecx, ecx
je 0x429e10
mov dword [ecx], 0x42aa20
mov al, byte [ebp + 9]
mov byte [ecx + 5], al
mov eax, dword [ebp + 0xc]
mov byte [ebp + 9], 0
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x10], eax
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x14], 0
jmp 0x429e12
xor ecx, ecx
mov dword [edi], ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.0042a4b0
mov dword [ebp - 4], 1
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x429e52
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x429e52
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x429e52
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x42a4b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48bc06
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x42a514
mov dword [ebp - 4], 0
mov esi, dword [esi + 0x10]
test esi, esi
je 0x42a50d
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x42a50d
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x42a50d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x42a552
push dword [0x4ba668]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42a542
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x42a542
cmp dword [ecx + 8], 0
jne 0x42a542
mov al, byte [esi + 0x18]
mov byte [esi], al
mov dword [ecx + 8], esi
jmp 0x42a54b
push esi
call fcn.00451a43
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42df50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48bc66
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp + 8]
mov edx, edi
call fcn.0042e870
push eax
mov ecx, esi
call fcn.0042aaf0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x42df9e
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [edi + 4]
mov dword [esi + 8], 0x4a2178
push eax
lea ecx, [esi + 0xc]
call fcn.0042c270
mov eax, dword [edi + 0x2c]
mov ecx, edi
mov dword [esi + 0x34], eax
neg ecx
mov dword [edi + 0x2c], 0
mov al, byte [edi + 0x30]
sbb ecx, ecx
mov byte [esi + 0x38], al
lea eax, [edi + 0x34]
mov byte [edi + 0x30], 0
and ecx, eax
mov eax, dword [ecx]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], 0x4a2190
mov eax, dword [edi + 0x38]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x48], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42e880
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d678
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4b1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0x54]
mov dword [ebp - 4], 0
push dword [0x4ba668]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42e8ef
mov eax, dword [eax + 4]
test eax, eax
je 0x42e8ef
mov esi, dword [eax + 8]
test esi, esi
je 0x42e8ef
mov dword [eax + 8], 0
mov al, byte [esi]
cmp al, 0x15
jb 0x42e8e6
mov byte [esi + 0x54], al
jmp 0x42e8ff
push esi
call fcn.00451a43
add esp, 4
push 0x55
call fcn.00451ccf
mov esi, eax
add esp, 4
mov byte [esi + 0x54], 0x15
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
test esi, esi
je 0x42e921
lea eax, [ebp + 8]
mov dword [esi], 0x42f560
push eax
lea ecx, [esi + 4]
call fcn.0042e660
jmp 0x42e923
xor esi, esi
lea ecx, [ebp - 0x18]
mov dword [edi], esi
mov dword [ebp - 0x14], 0
call fcn.0042ebc0
lea ecx, [ebp + 0x3c]
call fcn.00428f80
lea ecx, [ebp + 0x14]
call fcn.0042a230
lea ecx, [ebp + 8]
call fcn.00428f80
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x50