joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407d2f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0x64
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], 0x73006e
mov dword [ebp - 0xc], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
div ecx
xor eax, eax
add word [ebp - 0xc], dx
mov dword [esp + 8], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
sub esp, 0x10
test eax, eax
jne 0x407d8e
dec esi
jne 0x407d3f
mov word [ebx], 0
xor ebx, ebx
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 8

Function at 0x407d99
Capabilities:
Read file on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x407dd6
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x407ddd
Capabilities:
Write file on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x407e1a
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x40801e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea eax, [ebp - 0x14]
sub esp, 0x30
mov dword [ebp - 0x10], 0x800
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
xor eax, eax
cmp dword [ebp + 0x18], 0
setne al
shl eax, 8
or eax, 0x20019
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00407f6a
sub esp, 0x10
test eax, eax
je 0x40806c
mov word [ebx], 0
jmp 0x4080bf
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x14]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
mov word [ebx + 0x7fe], 0
test esi, esi
jne 0x408065
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
ja 0x408065
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0x14
Function at 0x40837a
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp], 0x440d00
mov dword [esp + 4], eax
call fcn.004081a9
push ebx
push ebx
mov dword [esp], 0x440d00
call fcn.00407b26
push edx
test eax, eax
jne 0x4083ab
xor eax, eax
jmp 0x408427
mov dword [esp], eax
mov ebx, eax
call fcn.00408265
push ecx
test byte [0x41b92c], 0x80
je 0x4083cd
mov ax, word [ebx]
test ax, ax
je 0x4083a7
cmp ax, 0x5c
je 0x4083a7
sub ebx, 0x440d00
sar ebx, 1
mov dword [esp], 0x440d00
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ecx
mov dword [esp], 0x440d00
cmp ebx, eax
jge 0x40840c
call fcn.00408342
push edx
test eax, eax
je 0x4083fd
test byte [eax], 0x10
je 0x4083a7
mov dword [esp], 0x440d00
call fcn.00407ab4
push eax
jmp 0x4083d5
call fcn.004081dd
push eax
mov dword [esp], 0x440d00
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
push edx
setne al
movzx eax, al
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x40842e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x40846c
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x408473
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
mov dword [esp + 4], str._s_S.dll
add edx, 0x40c660
add eax, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret 4
Function at 0x408e1c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x441d64], 0
mov ebp, esp
push esi
mov edx, dword [ebp + 0xc]
push ebx
jne 0x408e59
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
je 0x408e44
mov eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x408e36
mov dword [ecx*4 + 0x441d60], eax
inc ecx
cmp ecx, 0x100
jne 0x408e2f
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x408e7b
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x441d60]
jmp 0x408e63
pop ebx
not eax
pop esi
pop ebp
ret 0xc
Function at 0x403dc0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x403e21
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x403e04
cmp edi, 2
jb 0x403e04
cmp byte [esi], cl
jne 0x403e04
cmp byte [esi + 1], cl
jne 0x403e04
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x47b918]
jmp 0x403dd5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x47b918]
test edi, edi
jne 0x403dd5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x403e50
cmp cl, 0x23
jne 0x403e37
cmp byte [esi], cl
jne 0x403e37
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x47b918]
test cl, cl
jne 0x403e28
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x403f40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x403f54
mov dword [ebx], 0
mov edx, 0x47fbb0
call fcn.00403e60
mov esi, eax
test esi, esi
je 0x404042
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x404038
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x404038
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x404038
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x404038
mov eax, dword [0x4927a0]
test eax, eax
je 0x403fcc
inc dword [eax + 0xb0]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x404038
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x40401d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x4927a0]
add esp, 4
test eax, eax
je 0x40400a
dec dword [eax + 0xb0]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x40402f
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411460
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4901c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
lea edx, [ebp - 8]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [0x4927a0]
push esi
push edi
mov esi, 4
mov edi, dword [eax + 0x3f04]
mov eax, dword [edi + 0xfc]
mov ebx, dword [edi + 0x104]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x47b918]
sub esi, 1
jne 0x4114a0
mov eax, dword [0x4927a0]
not ebx
cmp dword [eax + 0x3f28], ebx
jne 0x4114da
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 0xc]
mov ecx, ebx
call fcn.004222f0
add esp, 8
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea ecx, [edi + 0xfc]
call fcn.004224f0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046e4b9
mov esp, ebp
pop ebp
ret

Function at 0x411500
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4901c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
lea edx, [ebp - 8]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [0x4927a0]
push esi
push edi
mov esi, 4
mov edi, dword [eax + 0x3f04]
mov eax, dword [edi + 0xfc]
mov ebx, dword [edi + 0x104]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x47b918]
sub esi, 1
jne 0x411540
mov eax, dword [0x4927a0]
not ebx
cmp dword [eax + 0x3f28], ebx
jne 0x41157a
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.004222f0
add esp, 8
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea ecx, [edi + 0xfc]
call fcn.004224f0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046e4b9
mov esp, ebp
pop ebp
ret
Function at 0x4170b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x53b8], 0
lea esi, [edi + 0x53bc]
je 0x417132
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x4170ec
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00422f60
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.00404380
mov edx, dword [esi]
mov ecx, 0x492799
push dword [edi + 0x53b8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x53c4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.00404380
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417510
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
mov dword [ebp - 4], ecx
push esi
lea esi, [ecx + 1]
push edi
test bl, bl
je 0x417558
or edi, 0xffffffff
nop dword [eax]
cmp bl, 0x23
jne 0x41753f
cmp byte [esi], bl
jne 0x41753f
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x47b918]
test bl, bl
jne 0x417530
mov ebx, dword [0x4927a0]
not eax
mov edi, dword [ebx + 0x5390]
mov esi, edi
neg esi
sbb esi, esi
lea ecx, [edi + 4]
and esi, ecx
je 0x417592
cmp dword [esi], eax
je 0x4175a1
mov edx, dword [esi - 4]
mov ecx, dword [ebx + 0x5388]
add edx, esi
add ecx, 4
xor esi, esi
add ecx, edi
cmp edx, ecx
cmovne esi, edx
test esi, esi
jne 0x417573
mov ecx, dword [ebp - 4]
call fcn.00417430
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x417592
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4175b0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x4927a0]
test bl, bl
je 0x4175f6
or edi, 0xffffffff
cmp bl, 0x23
jne 0x4175d7
cmp byte [esi], bl
jne 0x4175d7
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x47b918]
test bl, bl
jne 0x4175c8
mov edi, dword [0x4927a0]
mov esi, dword [edi + 0x537c]
xor ecx, ecx
not eax
test esi, esi
jle 0x41761c
mov edi, dword [edi + 0x5384]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x417622
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x417610
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x42b210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x42b24a
mov eax, dword [0x4927a0]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x42b23d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x42b27b
mov eax, dword [0x4927a0]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x42b26e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x42b2ac
mov eax, dword [0x4927a0]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x42b29f
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x42b2f9
mov eax, dword [0x4927a0]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x42b2ec
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x42b32a
mov eax, dword [0x4927a0]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x42b31d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x42b35b
mov eax, dword [0x4927a0]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x42b34e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.0042db30
Function at 0x442e00
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474060
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4901c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
cmp dword [esi + 0x60], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], vtable.boost::asio::detail::win_iocp_io_context.0
je 0x442ec5
call fcn.00443470
mov ebx, dword [esi + 0x60]
push 0xffffffffffffffff
push 0
mov eax, dword [ebx + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [ebx + 8]
call edi
xor eax, eax
mov ecx, 0x4928a8
lock xadd dword [ecx], eax
mov ecx, dword [ebx + 4]
test eax, eax
push 0
setne al
push ecx
test al, al
je 0x442e91
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x442ea7
push method.boost::asio::detail::execution_context_service_base_class_boost::asio::detail::win_iocp_socket_service_class_boost::asio::ip::tcp__.virtual_8
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [esi + 0x60]
test ebx, ebx
je 0x442ebe
push dword [ebx + 4]
call edi
push 0xc
push ebx
call fcn.0046e8e2
add esp, 8
mov dword [esi + 0x60], 0
lea ecx, [esi + 0x54]
call fcn.0044ced0
lea eax, [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [esi + 0x30]
test eax, eax
je 0x442ee1
push eax
call edi
mov ebx, dword [esi + 0x2c]
test ebx, ebx
je 0x442ef8
push dword [ebx + 4]
call edi
push 0xc
push ebx
call fcn.0046e8e2
add esp, 8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x442f02
push eax
call edi
test byte [ebp + 8], 1
mov dword [esi], vtable.boost::asio::execution_context::service.0
je 0x442f19
push 0x64
push esi
call fcn.0046e8e2
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046e4b9
mov esp, ebp
pop ebp
ret 4
Function at 0x443c30
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4901c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x18], esi
cmp ebx, 0xffffffff
je 0x443e06
cmp byte [ebp + 8], 0
je 0x443c92
mov al, byte [edx]
test al, 8
je 0x443c92
or al, 8
xor ecx, ecx
push 4
mov byte [edx], al
lea eax, [ebp - 8]
push eax
push 0x80
push 0xffff
push ebx
mov dword [ebp - 8], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea ecx, [ebp - 0x14]
setne dl
call fcn.00443ba0
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
mov ecx, esi
test ebx, ebx
setne dl
call fcn.00443ba0
test ebx, ebx
je 0x443df4
mov esi, dword [0x490a54]
push edi
mov edi, dword [0x490a50]
cmp edi, 0x257edfd1
jne 0x443ccc
cmp esi, 0xb2ab117a
je 0x443cdc
cmp edi, 0x257edfd0
jne 0x443ce0
cmp esi, 0xb2ab117a
jne 0x443ce0
mov al, 1
jmp 0x443d00
mov eax, dword [0x490a48]
mov ecx, 0x490a48
push 0x2733
mov eax, dword [eax + 0x18]
call eax
mov esi, dword [0x490a54]
mov edi, dword [0x490a50]
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
movzx eax, al
mov dword [ebp - 0x14], 0x2733
add eax, 2
mov dword [ebp - 0x10], 0x490a48
movq xmm0, qword [ebp - 0x14]
movq qword [ebp - 0x14], xmm0
mov dword [ebp - 0xc], eax
call fcn.004411e0
test al, al
jne 0x443dab
cmp edi, 0x257edfd1
jne 0x443d40
cmp esi, 0xb2ab117a
je 0x443d50
cmp edi, 0x257edfd0
jne 0x443d54
cmp esi, 0xb2ab117a
jne 0x443d54
mov al, 1
jmp 0x443d68
mov eax, dword [0x490a48]
mov ecx, 0x490a48
push 0x4d5
mov eax, dword [eax + 0x18]
call eax
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
movzx eax, al
mov dword [ebp - 0x14], 0x4d5
add eax, 2
mov dword [ebp - 0x10], 0x490a48
movq xmm0, qword [ebp - 0x14]
movq qword [ebp - 0x14], xmm0
mov dword [ebp - 0xc], eax
call fcn.004411e0
test al, al
jne 0x443dab
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046e4b9
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 8]
push eax
push 0x8004667e
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp - 0x20]
push esi
and byte [eax], 0xfc
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
setne dl
call fcn.00443ba0
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046e4b9
mov esp, ebp
pop ebp
ret
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046e4b9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0046e4b9
mov esp, ebp
pop ebp
ret
Function at 0x444160
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4901c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push edi
push 0
push 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 8]
mov dword [ebp - 0xc], 0
push edx
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [0x490a50]
mov edi, eax
mov ecx, dword [0x490a54]
cmp edx, 0x257edfd1
jne 0x4441c1
cmp ecx, 0xb2ab117a
je 0x4441d1
cmp edx, 0x257edfd0
jne 0x4441d8
cmp ecx, 0xb2ab117a
jne 0x4441d8
test edi, edi
setne al
jmp 0x4441e8
mov eax, dword [0x490a48]
mov ecx, 0x490a48
push edi
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
add eax, 2
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x490a48
mov edi, eax
movq xmm0, qword [ebp - 0x1c]
movq qword [esi], xmm0
mov dword [esi + 8], eax
mov dword [ebp - 0x10], 0x1ffff7
cmp edi, 1
je 0x444218
mov eax, dword [esi]
mov ecx, eax
jmp 0x44422a
mov eax, dword [esi + 4]
xor edx, edx
div dword [ebp - 0x10]
mov ecx, dword [esi]
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x40
jne 0x444283
mov ecx, dword [0x490a50]
mov eax, dword [0x490a54]
cmp ecx, 0x257edfd1
jne 0x444249
cmp eax, 0xb2ab117a
je 0x444258
cmp ecx, 0x257edfd0
jne 0x444266
cmp eax, 0xb2ab117a
jne 0x444266
mov al, 1
mov dword [ebp - 0x1c], 0x2746
jmp 0x4442eb
mov eax, dword [0x490a48]
mov ecx, 0x490a48
push 0x2746
mov eax, dword [eax + 0x18]
call eax
mov dword [ebp - 0x1c], 0x2746
jmp 0x4442eb
cmp edi, 1
je 0x44428c
mov eax, ecx
jmp 0x44429c
mov eax, dword [esi + 4]
xor edx, edx
div dword [ebp - 0x10]
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x4d2
jne 0x444306
mov ecx, dword [0x490a50]
mov eax, dword [0x490a54]
cmp ecx, 0x257edfd1
jne 0x4442bd
cmp eax, 0xb2ab117a
je 0x4442cc
cmp ecx, 0x257edfd0
jne 0x4442d0
cmp eax, 0xb2ab117a
jne 0x4442d0
mov al, 1
jmp 0x4442e4
mov eax, dword [0x490a48]
mov ecx, 0x490a48
push 0x274d
mov eax, dword [eax + 0x18]
call eax
mov dword [ebp - 0x1c], 0x274d
movzx eax, al
mov dword [ebp - 0x18], 0x490a48
add eax, 2
movq xmm0, qword [ebp - 0x1c]
movq qword [esi], xmm0
mov dword [esi + 8], eax
jmp 0x444347
cmp edi, 1
je 0x44430f
mov eax, ecx
jmp 0x44431f
mov eax, dword [esi + 4]
xor edx, edx
div dword [ebp - 0x10]
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x2738
je 0x44435f
cmp edi, 1
jne 0x44433f
mov eax, dword [esi + 4]
xor edx, edx
mov edi, 0x1ffff7
div edi
imul eax, edx, 0x3e8
add ecx, eax
cmp ecx, 0xea
je 0x44435f
test ebx, ebx
je 0x44435f
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046e4b9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xorps xmm0, xmm0
mov eax, dword [ebp - 8]
xor ecx, ebp
movq qword [esi], xmm0
pop edi
mov dword [esi + 8], 0
pop esi
pop ebx
call fcn.0046e4b9
mov esp, ebp
pop ebp
ret