joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e5f0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a0
mov eax, dword [0x629af0]
xor eax, esp
mov dword [esp + 0x19c], eax
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x42e635
push 0x61e098
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x1d
call fcn.005829c0
mov ecx, dword [esp + 0x19c]
xor ecx, esp
mov eax, 0x632d78
call fcn.0057976c
mov esp, ebp
pop ebp
ret

Function at 0x42e800
Capabilities:
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x5c2051
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
push esi
mov eax, dword [0x629af0]
xor eax, esp
push eax
lea eax, [esp + 0x124]
mov dword fs:[0], eax
mov eax, dword [esp + 0x138]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x42e86c
lea ecx, [esp + 0xc]
push ecx
mov ecx, 0x632cd8
call fcn.0042af50
push str.GetIP_Error_dwIP___INADDR_NONE
mov ecx, eax
mov dword [esp + 0x130], 0
call fcn.0040eb00
lea ecx, [esp + 0xc]
jmp 0x42e93c
mov edx, dword [esp + 0x138]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x42e8ba
lea eax, [esp + 0xc]
push eax
mov ecx, 0x632cd8
call fcn.0042af50
mov dword [esp + 0x12c], 1
test eax, eax
je 0x42e8a1
add eax, 8
jmp 0x42e8a3
xor eax, eax
push str.GetIP_Error_pHost__NULL
push eax
call fcn.00411aa0
add esp, 8
lea ecx, [esp + 0xc]
jmp 0x42e93c
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov esi, dword [esp + 0x134]
push eax
add esi, 0xc
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
mov ecx, esi
call fcn.004096a0
mov ecx, esi
call fcn.00409700
lea ecx, [esp + 0x98]
push ecx
mov ecx, 0x632cd8
mov dword [esp + 0xc], eax
call fcn.0042af50
lea edx, [esp + 8]
push edx
push str._ip
lea ecx, [esp + 0x140]
push ecx
push str.GetIP_url
mov ecx, eax
mov dword [esp + 0x13c], 2
call fcn.0040eb00
mov ecx, eax
call fcn.0040ea00
mov ecx, eax
call fcn.0040eb00
mov ecx, eax
call fcn.0040ea00
lea ecx, [esp + 0x98]
mov dword [esp + 0x12c], 0xffffffff
call fcn.0042ad30
mov ecx, dword [esp + 0x124]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x128
ret 8
Function at 0x42ea50
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x124
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push 0x1007
push 0xffff
push eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
jne 0x42eab5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 4], eax
push 0x61e098
lea eax, [esp + 8]
push eax
call fcn.005829c0
mov eax, dword [esp + 8]
test eax, eax
je 0x42ead0
push 0x61e098
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], eax
call fcn.005829c0
mov ecx, dword [esi]
lea edx, [esp + 0x10]
push edx
push 0
push 0
lea eax, [esp + 0x24]
push eax
inc ecx
push ecx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x42eb06
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x61e098
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], eax
call fcn.005829c0
test eax, eax
jne 0x42eb59
cmp dword [esi + 4], eax
je 0x42eb2f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 4]
cmp eax, 0xc350
jbe 0x42eb2f
inc dword [esi + 8]
cmp dword [esi + 8], 3
jb 0x42eb3d
mov ecx, esi
call fcn.0042ed50
mov eax, 0xfffffffe
add esp, 0x124
ret 8
mov eax, 0xfffffffc
mov dword [esp + 8], eax
mov dword [esp + 4], eax
push 0x61e098
lea eax, [esp + 8]
push eax
call fcn.005829c0
mov edx, dword [esi]
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esi + 4], 0
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x42eb88
push 0x61e098
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x9e
call fcn.005829c0
mov ecx, dword [esp + 0x12c]
mov edx, dword [esp + 0x128]
mov eax, dword [esi]
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x42eb34
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x61e098
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], eax
call fcn.005829c0
int3
Function at 0x42ebd0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x124
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push 0x1007
push 0xffff
push eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
jne 0x42ec35
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 4], eax
push 0x61e098
lea eax, [esp + 8]
push eax
call fcn.005829c0
mov eax, dword [esp + 8]
test eax, eax
je 0x42ec50
push 0x61e098
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], eax
call fcn.005829c0
mov ecx, dword [esi]
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x20]
push eax
push 0
inc ecx
push ecx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x42ec86
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x61e098
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], eax
call fcn.005829c0
test eax, eax
jne 0x42ecd9
cmp dword [esi + 4], eax
je 0x42ecaf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 4]
cmp eax, 0xc350
jbe 0x42ecaf
inc dword [esi + 8]
cmp dword [esi + 8], 3
jb 0x42ecbd
mov ecx, esi
call fcn.0042ed50
mov eax, 0xfffffffe
add esp, 0x124
ret 8
mov eax, 0xfffffffc
mov dword [esp + 8], eax
mov dword [esp + 4], eax
push 0x61e098
lea eax, [esp + 8]
push eax
call fcn.005829c0
mov edx, dword [esi]
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esi + 4], 0
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x42ed08
push 0x61e098
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0xd1
call fcn.005829c0
mov ecx, dword [esp + 0x12c]
mov edx, dword [esp + 0x128]
mov eax, dword [esi]
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x42ecb4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x61e098
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], eax
call fcn.005829c0
int3
Function at 0x42ed50
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
sub esp, 0x20
mov eax, dword [0x629af0]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
mov esi, ecx
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x42ed90
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
je 0x42ed8a
push 0x61e098
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x11c
call fcn.005829c0
mov dword [esi], 0xffffffff
movzx edx, word [esi + 0x28]
mov ecx, 2
push edx
mov word [esp + 0x10], cx
call dword [sym.imp.WS2_32.dll_htons]
lea ecx, [esi + 0xc]
mov word [esp + 0xe], ax
call fcn.00409700
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 6
push 1
push 2
mov dword [esp + 0x1c], eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x42ede7
push 0x61e098
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0xe0
call fcn.005829c0
lea ecx, [esp + 8]
push ecx
push 0x8004667e
push eax
mov dword [esp + 0x14], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x42ee1c
push 0x61e098
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0xe2
call fcn.005829c0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi]
mov dword [esi + 4], eax
push 0x10
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esi + 8], 0
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x42ee65
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2733
je 0x42ee65
call esi
push 0x61e098
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], eax
call fcn.005829c0
mov ecx, dword [esp + 0x1c]
pop esi
xor ecx, esp
call fcn.0057976c
add esp, 0x20
ret
Function at 0x42f0a0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5c0a5b
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x629af0]
xor eax, esp
mov dword [esp + 0x43c], eax
push ebx
push ebp
push esi
mov eax, dword [0x629af0]
xor eax, esp
push eax
lea eax, [esp + 0x450]
mov dword fs:[0], eax
xor ebx, ebx
push 0x3ff
lea eax, [esp + 0x51]
push ebx
push eax
mov byte [esp + 0x58], bl
call fcn.0057e200
add esp, 0xc
lea esi, [esp + 0x30]
mov eax, edi
call fcn.0042eea0
mov ebp, eax
lea esi, [esp + 0x14]
mov eax, edi
mov dword [esp + 0x458], ebx
call fcn.0042eec0
mov ecx, ebp
mov esi, eax
call fcn.00409700
push eax
mov ecx, esi
call fcn.00409700
push eax
lea ecx, [esp + 0x54]
push str.HEAD__s_HTTP_1.1_r_nAccept:__r_nUser_Agent:_sx_r_nHost:__s_r_nConnection:close_r_nCache_Control:_no_cache_r_n_r_n
push ecx
call fcn.00579a03
add esp, 0x10
lea ecx, [esp + 0x14]
call fcn.00409660
lea ecx, [esp + 0x30]
mov dword [esp + 0x458], 0xffffffff
call fcn.00409660
lea edx, [esp + 0x4c]
lea esi, [edi + 0x64]
push edx
mov ecx, esi
call fcn.004096a0
mov eax, dword [edi + 0x78]
mov ecx, esi
mov dword [esp + 0x10], eax
call fcn.00409700
push 0x400
lea esi, [edi + 0x48c]
push ebx
push esi
mov ebp, eax
call fcn.0057e200
add esp, 0xc
cmp ebp, ebx
je 0x42f19a
mov ecx, dword [esp + 0x10]
push ecx
push ebp
push esi
call fcn.0057de50
add esp, 0xc
mov edx, dword [edi + 0x78]
push 0x400
mov dword [esi + 0x404], edx
mov dword [esi + 0x400], ebx
lea esi, [edi + 0x84]
push ebx
push esi
call fcn.0057e200
add esp, 0xc
mov dword [esi + 0x404], 0x400
mov dword [esi + 0x400], ebx
mov ecx, dword [esp + 0x450]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x43c]
xor ecx, esp
call fcn.0057976c
add esp, 0x44c
ret
Function at 0x4353f0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x629af0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, 0x202
mov word [ebp - 0x19c], ax
lea ecx, [ebp - 0x198]
push ecx
movzx edx, word [ebp - 0x19c]
push edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x435434
mov eax, 2
jmp 0x43548f
movzx eax, word [ebp - 0x198]
and eax, 0xff
movzx ecx, al
movzx edx, word [ebp - 0x19c]
and edx, 0xff
movzx eax, dl
cmp ecx, eax
jne 0x435480
movzx ecx, word [ebp - 0x198]
shr ecx, 8
and ecx, 0xff
movzx edx, cl
movzx eax, word [ebp - 0x19c]
shr eax, 8
and eax, 0xff
movzx ecx, al
cmp edx, ecx
je 0x43548d
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
jmp 0x43548f
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0057976c
mov esp, ebp
pop ebp
ret
Function at 0x435680
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00435860
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x20], 0
jne 0x435832
cmp dword [ebp - 0x10], 0
jne 0x435832
mov dword [ebp - 0x28], 0
call fcn.00444cc0
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
lea ecx, [ebp - 0x2c]
push ecx
push 0x3e8
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.004413c0
add esp, 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4357b7
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x435724
mov dword [ebp - 0x24], 0x38
jmp 0x435832
cmp dword [ebp - 0x2c], 0
jne 0x43579d
call fcn.00444cc0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x34]
push eax
call fcn.00444d00
add esp, 0x10
cmp eax, 0xa
jg 0x435794
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 2
jle 0x435792
cmp dword [ebp - 0x1c], 0xa
jge 0x435779
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov edx, 1
shl edx, cl
mov dword [ebp - 0x44], edx
jmp 0x435780
mov dword [ebp - 0x44], 0x3e8
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.004362d0
add esp, 4
jmp 0x43579b
mov dword [ebp - 0x1c], 0
jmp 0x4357a4
mov dword [ebp - 0x1c], 0
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004417c0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4357ec
cmp dword [ebp - 0x28], 0
jne 0x4357ec
lea ecx, [ebp - 0x3c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00442fb0
add esp, 8
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x4357ec
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 1
mov edx, dword [ebp + 8]
push edx
call fcn.00435860
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xc]
jne 0x43581e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x14]
cmp eax, 0x2710
jbe 0x43581c
mov dword [ebp - 0x24], 0x5c
jmp 0x435832
jmp 0x43582d
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
jmp 0x4356c1
cmp dword [ebp - 0x10], 0
je 0x43584a
mov eax, dword [ebp - 0x10]
sub eax, 3
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x1b
jmp 0x43584d
mov eax, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret
Function at 0x444340
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax*4 + 0x154]
mov dword [ebp - 8], edx
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp dword [ebp - 4], 0xffffffff
jne 0x4443db
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
jne 0x4443a0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 0x51
jmp 0x4443db
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00435db0
add esp, 8
push eax
push str.Send_failure:__s
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call fcn.004440d0
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 0x8604], edx
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x37
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x444870
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4448b5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2733
jne 0x4448ae
mov eax, 0x51
jmp 0x4448bf
mov eax, 0x38
jmp 0x4448bf
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x444c20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1a8], 0
je 0x444c5a
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x134]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1a8]
call edx
add esp, 0x14
jmp 0x444cae
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x444cac
cmp dword [ebp - 4], 2
jle 0x444c6e
jmp 0x444cac
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x130]
push edx
push 1
push 2
mov eax, dword [ebp + 0xc]
imul eax, eax, 3
add eax, 0x5ca2c4
push eax
call fcn.0057ca18
add esp, 0x10
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x130]
push edx
push 1
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0057ca18
add esp, 0x10
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x447c10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x629af0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x110], ecx
mov edx, dword [ebp + 8]
cmp dword [edx + 0x8c], 2
jne 0x447c3f
jmp 0x447e23
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1d4], 0
jne 0x447e17
mov dword [ebp - 0x10c], 0x80
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x88]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x447cb5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x114]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00435db0
add esp, 8
push eax
mov eax, dword [ebp - 0x114]
push eax
push str.getpeername___failed_with_errno__d:__s
mov ecx, dword [ebp - 0x110]
push ecx
call fcn.004440d0
add esp, 0x10
jmp 0x447e23
mov dword [ebp - 0x10c], 0x80
push 0x80
push 0
lea edx, [ebp - 0x108]
push edx
call fcn.0057e200
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x447d31
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00435db0
add esp, 8
push eax
mov edx, dword [ebp - 0x114]
push edx
push str.getsockname___failed_with_errno__d:__s
mov eax, dword [ebp - 0x110]
push eax
call fcn.004440d0
add esp, 0x10
jmp 0x447e23
mov ecx, dword [ebp + 8]
add ecx, 0xe8
push ecx
mov edx, dword [ebp + 8]
add edx, 0xb8
push edx
lea eax, [ebp - 0x88]
push eax
call fcn.00447e40
add esp, 0xc
test eax, eax
jne 0x447d98
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x114]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00435db0
add esp, 8
push eax
mov eax, dword [ebp - 0x114]
push eax
push str.ssrem_inet_ntop___failed_with_errno__d:__s
mov ecx, dword [ebp - 0x110]
push ecx
call fcn.004440d0
add esp, 0x10
jmp 0x447e23
push 0x2e
mov edx, dword [ebp + 8]
add edx, 0xb8
push edx
mov eax, dword [ebp + 8]
add eax, 0x58
push eax
call fcn.0057de50
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, 0x11c
push ecx
mov edx, dword [ebp + 8]
add edx, 0xec
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.00447e40
add esp, 0xc
test eax, eax
jne 0x447e17
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x114]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00435db0
add esp, 8
push eax
mov eax, dword [ebp - 0x114]
push eax
push str.ssloc_inet_ntop___failed_with_errno__d:__s
mov ecx, dword [ebp - 0x110]
push ecx
call fcn.004440d0
add esp, 0x10
jmp 0x447e23
mov edx, dword [ebp + 8]
push edx
call fcn.00447ba0
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057976c
mov esp, ebp
pop ebp
ret
Function at 0x4484f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x629af0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0x4020
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 4
mov dword [ebp - 4], 6
cmp dword [0x62c894], 0
jne 0x448596
push 0x9c
push 0
lea eax, [ebp - 0xc0]
push eax
call fcn.0057e200
add esp, 0xc
mov dword [ebp - 0xc0], 0x9c
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xbc], ecx
push 3
push 2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
push 2
lea ecx, [ebp - 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
je 0x44858c
mov dword [0x62c894], 2
jmp 0x448596
mov dword [0x62c894], 1
cmp dword [0x62c894], 2
jne 0x4485a1
jmp 0x4485e5
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
push 0x1001
push 0xffff
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4485cb
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x10]
jle 0x4485cb
jmp 0x4485e5
push 4
lea eax, [ebp - 0x10]
push eax
push 0x1001
push 0xffff
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0057976c
mov esp, ebp
pop ebp
ret
Function at 0x448950
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [eax + 0x46c], 0
setne cl
mov dword [ebp - 4], ecx
push 4
lea edx, [ebp - 4]
push edx
push 8
push 0xffff
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x44899d
mov ecx, dword [ebp + 0xc]
push ecx
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
mov edx, dword [ebp + 8]
push edx
call fcn.00444030
add esp, 0xc
jmp 0x448a33
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x470]
push ecx
call fcn.00469210
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
imul edx, edx, 0x3e8
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x474]
push edx
call fcn.00469210
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
imul eax, eax, 0x3e8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x448a33
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov edx, dword [ebp + 0xc]
push edx
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
mov eax, dword [ebp + 8]
push eax
call fcn.00444030
add esp, 0x10
mov esp, ebp
pop ebp
ret