joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3eb0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push edi
mov edi, eax
xor eax, eax
xor ebx, ebx
cmp edi, 0xffffffff
je 0x4a3fb0
cmp byte [ebp + 0xc], al
je 0x4a3f1d
mov ebx, dword [ebp + 8]
test byte [ebx], 8
je 0x4a3f1d
mov word [esp + 0xc], ax
mov word [esp + 0xe], ax
call fcn.005d95d0
or byte [ebx], 8
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 4
lea eax, [esp + 0x10]
push eax
push 0x80
push 0xffff
push edi
call sub.WS2_32.dll_setsockopt
mov ebx, eax
call fcn.005d95d0
call sub.WS2_32.dll_WSAGetLastError
test ebx, ebx
jne 0x4a3f1d
call fcn.005d95d0
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call sub.WS2_32.dll_closesocket
mov ebx, eax
call fcn.005d95d0
mov dword [esp + 0xc], eax
call sub.WS2_32.dll_WSAGetLastError
test ebx, ebx
mov ecx, dword [esp + 0xc]
mov dword [esi], eax
mov dword [esi + 4], ecx
je 0x4a3fb0
call fcn.005d95d0
cmp dword [esi + 4], eax
jne 0x4a3f5a
cmp dword [esi], 0x2733
je 0x4a3f6c
call fcn.005d95d0
cmp dword [esi + 4], eax
jne 0x4a3fac
cmp dword [esi], 0x4d5
jne 0x4a3fac
lea edx, [esp + 0xc]
push edx
push 0x8004667e
push edi
mov dword [esp + 0x18], 0
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp + 8]
and byte [eax], 0xfc
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call sub.WS2_32.dll_closesocket
mov ebx, eax
call fcn.005d95d0
mov edi, eax
call sub.WS2_32.dll_WSAGetLastError
mov dword [esi], eax
mov dword [esi + 4], edi
test ebx, ebx
jne 0x4a3fbc
xor edi, edi
call fcn.005d95d0
mov dword [esi], edi
mov dword [esi + 4], eax
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a3fd0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, eax
cmp edi, 0xffffffff
jne 0x4a3ff5
mov edi, 0x2719
call fcn.005d95d0
mov dword [esi], edi
mov dword [esi + 4], eax
xor al, al
pop edi
pop ebp
pop ebx
pop ecx
ret
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push edi
mov dword [esp + 0x18], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edi, eax
call fcn.005d95d0
mov ebx, eax
call sub.WS2_32.dll_WSAGetLastError
test edi, edi
mov dword [esi], eax
mov dword [esi + 4], ebx
jl 0x4a3fee
xor edi, edi
call fcn.005d95d0
mov dword [esi], edi
mov dword [esi + 4], eax
or byte [ebp], 2
pop edi
pop ebp
mov al, 1
pop ebx
pop ecx
ret

Function at 0x4a4050
Capabilities:
Connect socket

Disassembly:
push ecx
push ebx
push edi
mov edi, eax
cmp edi, 0xffffffff
jne 0x4a4070
mov edi, 0x2719
call fcn.005d95d0
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
pop edi
pop ebx
pop ecx
ret
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push edi
call sub.WS2_32.dll_connect
mov ebx, eax
call fcn.005d95d0
mov edi, eax
call sub.WS2_32.dll_WSAGetLastError
test ebx, ebx
mov dword [esi], eax
mov dword [esi + 4], edi
jne 0x4a40ab
xor edi, edi
call fcn.005d95d0
mov dword [esi], edi
mov dword [esi + 4], eax
pop edi
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x4a41d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push ebx
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edx, dword [esp + 0x1c]
push 0
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call fcn.005d95d0
mov edi, eax
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x40
mov dword [esi], eax
mov dword [esi + 4], edi
jne 0x4a422f
mov edi, 0x2746
jmp 0x4a423b
cmp eax, 0x4d2
jne 0x4a4245
mov edi, 0x274d
call fcn.005d95d0
mov dword [esi + 4], eax
mov dword [esi], edi
test ebx, ebx
je 0x4a4252
or eax, 0xffffffff
pop edi
pop ebx
add esp, 8
ret
xor edi, edi
call fcn.005d95d0
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
mov eax, dword [esp + 4]
pop ebx
add esp, 8
ret

Function at 0x4a44b0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 8
push ebx
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push 0
push 0
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push 0
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.WS2_32.dll_WSASendTo]
mov ebx, eax
call fcn.005d95d0
mov edi, eax
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x40
mov dword [esi], eax
mov dword [esi + 4], edi
jne 0x4a450e
mov edi, 0x2746
jmp 0x4a451a
cmp eax, 0x4d2
jne 0x4a4524
mov edi, 0x274d
call fcn.005d95d0
mov dword [esi + 4], eax
mov dword [esi], edi
test ebx, ebx
je 0x4a4531
or eax, 0xffffffff
pop edi
pop ebx
add esp, 8
ret
xor edi, edi
call fcn.005d95d0
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
mov eax, dword [esp + 8]
pop ebx
add esp, 8
ret
Function at 0x4a4680
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, edx
cmp edi, 0xffffffff
mov ebx, ecx
jne 0x4a46a8
mov edi, 0x2719
call fcn.005d95d0
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
pop ecx
ret
cmp ebp, 0xa5100000
jne 0x4a470d
cmp ebx, 2
jne 0x4a46cc
mov edi, 0x2726
call fcn.005d95d0
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
pop ecx
ret
cmp ebx, 1
jne 0x4a4720
cmp dword [esp + 0x1c], 4
jne 0x4a46b5
mov ecx, dword [esp + 0x18]
cmp dword [ecx], 0
je 0x4a46f7
or byte [eax], 4
xor edi, edi
call fcn.005d95d0
mov dword [esi + 4], eax
mov dword [esi], edi
xor eax, eax
pop edi
pop ebp
pop ebx
pop ecx
ret
and byte [eax], 0xfb
xor edi, edi
call fcn.005d95d0
mov dword [esi + 4], eax
mov dword [esi], edi
xor eax, eax
pop edi
pop ebp
pop ebx
pop ecx
ret
cmp ebp, 0xffff
jne 0x4a4720
cmp ebx, 0x80
jne 0x4a4720
or byte [eax], 8
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
push ebx
push ebp
push edi
call sub.WS2_32.dll_setsockopt
mov ebx, eax
call fcn.005d95d0
mov edi, eax
call sub.WS2_32.dll_WSAGetLastError
test ebx, ebx
mov dword [esi], eax
mov dword [esi + 4], edi
jne 0x4a475d
xor edi, edi
call fcn.005d95d0
mov dword [esi], edi
mov dword [esi + 4], eax
pop edi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x4a4890
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
cmp ebx, 0xffffffff
push edi
mov edi, eax
jne 0x4a48b5
mov edi, 0x2719
call fcn.005d95d0
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, ebx
pop edi
pop ebx
add esp, 8
ret
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edx, dword [esp + 0x14]
mov eax, dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push ebx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_getsockname]
mov ebx, eax
mov eax, dword [esp + 0xc]
mov dword [edi], eax
call fcn.005d95d0
mov edi, eax
call sub.WS2_32.dll_WSAGetLastError
test ebx, ebx
mov dword [esi], eax
mov dword [esi + 4], edi
jne 0x4a48fd
xor edi, edi
call fcn.005d95d0
mov dword [esi], edi
mov dword [esi + 4], eax
pop edi
mov eax, ebx
pop ebx
add esp, 8
ret
Function at 0x4a4990
Capabilities:
Get socket status

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
push 0
mov edi, eax
mov ebx, ecx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
test ebx, ebx
jne 0x4a49f4
cmp dword [esp + 0x18], ebx
jne 0x4a49f4
test ebp, ebp
jne 0x4a49f4
test edi, edi
je 0x4a4a12
mov ecx, dword [edi + 4]
mov eax, 0x10624dd3
imul ecx
mov ecx, dword [edi]
imul ecx, ecx, 0x3e8
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, ecx
jne 0x4a49db
mov eax, 1
push eax
call sub.KERNEL32.dll_Sleep
xor edi, edi
call fcn.005d95d0
mov dword [esi + 4], eax
mov dword [esi], edi
xor eax, eax
pop edi
pop ebp
pop ebx
pop ecx
ret
test edi, edi
je 0x4a4a12
cmp dword [edi], 0
jne 0x4a4a12
mov eax, dword [edi + 4]
test eax, eax
jle 0x4a4a12
cmp eax, 0x3e8
jge 0x4a4a12
mov dword [edi + 4], 0x3e8
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edi
push ebp
push edx
push ebx
push eax
call sub.WS2_32.dll_select
mov ebx, eax
call fcn.005d95d0
mov edi, eax
call sub.WS2_32.dll_WSAGetLastError
test ebx, ebx
mov dword [esi], eax
mov dword [esi + 4], edi
jl 0x4a4a47
xor edi, edi
call fcn.005d95d0
mov dword [esi], edi
mov dword [esi + 4], eax
pop edi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x4a4a50
Capabilities:
Get socket status

Disassembly:
sub esp, 0x114
push ebx
push edi
mov edi, eax
cmp edi, 0xffffffff
jne 0x4a4a7a
mov edi, 0x2719
call fcn.005d95d0
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
pop edi
pop ebx
add esp, 0x114
ret
push 0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
push edi
call sub.WS2_32.dll_select
mov ebx, eax
call fcn.005d95d0
mov edi, eax
call sub.WS2_32.dll_WSAGetLastError
test ebx, ebx
mov dword [esi], eax
mov dword [esi + 4], edi
je 0x4a4ac8
jle 0x4a4ad4
xor edi, edi
call fcn.005d95d0
mov dword [esi + 4], eax
mov dword [esi], edi
pop edi
mov eax, ebx
pop ebx
add esp, 0x114
ret

Function at 0x4a4ae0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x114
push ebx
push edi
mov edi, eax
cmp edi, 0xffffffff
jne 0x4a4b0a
mov edi, 0x2719
call fcn.005d95d0
mov dword [esi + 4], eax
mov dword [esi], edi
or eax, 0xffffffff
pop edi
pop ebx
add esp, 0x114
ret
push 0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push edi
call sub.WS2_32.dll_select
mov ebx, eax
call fcn.005d95d0
mov edi, eax
call sub.WS2_32.dll_WSAGetLastError
test ebx, ebx
mov dword [esi], eax
mov dword [esi + 4], edi
je 0x4a4b58
jle 0x4a4b64
xor edi, edi
call fcn.005d95d0
mov dword [esi + 4], eax
mov dword [esi], edi
pop edi
mov eax, ebx
pop ebx
add esp, 0x114
ret
Function at 0x4a4e20
Capabilities:
Resolve dns

Disassembly:
push ecx
push ebp
push esi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
cmp dword [esp + 0x14], 2
je 0x4a4e47
mov esi, 0x273f
call fcn.005d95d0
mov dword [edi], esi
mov dword [edi + 4], eax
xor eax, eax
pop esi
pop ebp
pop ecx
ret
mov eax, dword [esp + 0x10]
push eax
call sub.WS2_32.dll_gethostbyname
mov esi, eax
call fcn.005d95d0
mov ebp, eax
call sub.WS2_32.dll_WSAGetLastError
test esi, esi
mov dword [edi], eax
mov dword [edi + 4], ebp
je 0x4a4e41
xor ebp, ebp
call fcn.005d95d0
mov dword [edi], ebp
mov dword [edi + 4], eax
mov ecx, dword [esi]
mov dword [ebx], ecx
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
mov ecx, dword [esi + 0xc]
pop esi
mov dword [ebx + 0xc], ecx
mov eax, ebx
pop ebp
pop ecx
ret
Function at 0x4a6b50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5eac2f
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esp + 0x24], ebx
mov dword [esi], vtable.boost::asio::detail::win_iocp_io_service.0
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea eax, [esi + 0x30]
mov byte [esp + 0x24], 3
push eax
mov dword [esi + 0x2c], ebx
call fcn.004a8400
mov edi, eax
call fcn.005d95d0
mov dword [esp + 0x10], edi
neg edi
sbb edi, edi
test edi, fcn.00489120
mov dword [esp + 0x14], eax
je 0x4a6be3
lea ecx, [esp + 0x10]
push ecx
mov edx, str.mutex
call fcn.004a6540
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
or ecx, 0xffffffff
mov byte [esp + 0x24], 5
cmp dword [esp + 0x34], ecx
mov dword [esp + 0x30], ecx
lea eax, [esp + 0x30]
ja 0x4a6c06
lea eax, [esp + 0x34]
mov edx, dword [eax]
push edx
push ebx
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp eax, ebx
mov dword [esi + 0x14], eax
jne 0x4a6c49
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x10], edi
call fcn.005d95d0
neg edi
sbb edi, edi
test edi, fcn.00489120
mov dword [esp + 0x14], eax
je 0x4a6c49
lea eax, [esp + 0x10]
push eax
mov edx, str.iocp
call fcn.004a6540
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 0xc
Function at 0x4a6ed0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x5f0158
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
push ebx
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test eax, eax
jne 0x4a6f36
push 1
add esi, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
xor esi, esi
call fcn.005d95d0
mov dword [edi + 4], eax
mov dword [edi], esi
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov ecx, dword [0x65bac0]
push ecx
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x65bac0]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea edx, [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, edx
push eax
push ecx
mov dword [esp + 0x20], edx
call ebp
push edi
mov ecx, esi
mov dword [esp + 0x2c], ebx
call fcn.004a72d0
test eax, eax
je 0x4a6f89
cmp ebx, 0xffffffff
je 0x4a6f7d
add ebx, 1
push edi
mov ecx, esi
call fcn.004a72d0
test eax, eax
jne 0x4a6f75
mov edx, dword [esp + 0x1c]
mov eax, dword [0x65bac0]
push edx
push eax
call ebp
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x4a7cb0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov ebx, ecx
cmp dword [ebx + 0x14], 0
push edi
mov esi, eax
jne 0x4a7ccd
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x14], eax
jmp 0x4a7cdf
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebx + 0x14], eax
je 0x4a7cdf
mov dword [ebx + 0x14], 0xffffffff
mov eax, dword [ebp + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [esp + 0x24], 0
push 0
je 0x4a7d06
mov eax, dword [ebp + 4]
push 0
call fcn.004a71f0
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ebx, dword [ebx]
cmp ebx, 0xffffffff
jne 0x4a7d21
mov eax, dword [ebp + 4]
push 0x2719
call fcn.004a71f0
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push esi
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x30]
push edx
push eax
push ecx
push ebx
mov dword [esp + 0x40], 0
call dword [sym.imp.WS2_32.dll_WSASend]
mov edi, eax
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x4d2
jne 0x4a7d58
mov eax, 0x274d
test edi, edi
je 0x4a7d78
cmp eax, 0x3e5
je 0x4a7d78
mov edx, dword [esp + 0x24]
push edx
push eax
mov eax, dword [ebp + 4]
call fcn.004a71f0
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [ebp + 4]
mov edi, esi
call fcn.004a7180
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
Function at 0x4a7d90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov ebx, ecx
cmp dword [ebx + 0x14], 0
push edi
mov esi, eax
jne 0x4a7dad
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x14], eax
jmp 0x4a7dbf
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebx + 0x14], eax
je 0x4a7dbf
mov dword [ebx + 0x14], 0xffffffff
mov eax, dword [ebp + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [esp + 0x24], 0
push 0
je 0x4a7de6
mov eax, dword [ebp + 4]
push 0
call fcn.004a71f0
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ebx, dword [ebx]
cmp ebx, 0xffffffff
jne 0x4a7e01
mov eax, dword [ebp + 4]
push 0x2719
call fcn.004a71f0
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ecx, dword [esp + 0x24]
push esi
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x2c]
push ecx
push edx
push ebx
mov dword [esp + 0x40], 0
call dword [sym.imp.WS2_32.dll_WSARecv]
mov edi, eax
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x40
jne 0x4a7e40
mov eax, 0x2746
jmp 0x4a7e4c
cmp eax, 0x4d2
jne 0x4a7e4c
mov eax, 0x274d
test edi, edi
je 0x4a7e6c
cmp eax, 0x3e5
je 0x4a7e6c
mov ecx, dword [esp + 0x24]
push ecx
push eax
mov eax, dword [ebp + 4]
call fcn.004a71f0
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [ebp + 4]
mov edi, esi
call fcn.004a7180
pop edi
pop esi
pop ebp
pop ebx
ret 0x14

Function at 0x4a7e80
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
cmp dword [ebx + 0x14], 0
push esi
push edi
mov esi, eax
jne 0x4a7e98
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x14], eax
jmp 0x4a7eaa
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebx + 0x14], eax
je 0x4a7eaa
mov dword [ebx + 0x14], 0xffffffff
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [ebx]
cmp eax, 0xffffffff
push 0
jne 0x4a7ed9
mov eax, dword [edi + 4]
push 0x2719
call fcn.004a71f0
pop edi
pop esi
add esp, 8
ret 0x14
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push esi
push ecx
push edx
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x30]
push ecx
push edx
push eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
mov edi, eax
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x4d2
jne 0x4a7f22
mov eax, 0x274d
test edi, edi
je 0x4a7f47
cmp eax, 0x3e5
je 0x4a7f47
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x14]
push ecx
push eax
mov eax, dword [edx + 4]
call fcn.004a71f0
pop edi
pop esi
add esp, 8
ret 0x14
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov edi, esi
call fcn.004a7180
pop edi
pop esi
add esp, 8
ret 0x14
Function at 0x4a84d0
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0xffffffffffffffff
push 0
lea edx, [esp + 8]
push edx
push 2
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x65b688
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test eax, eax
push 0
je 0x4a851d
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
add esp, 8
ret
mov edx, dword [esi + 4]
push edx
push method.CWnd.virtual_8
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov eax, dword [esi + 4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add esp, 8
ret

Function at 0x4a8540
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
push 0
push 0
push 1
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
test ebx, ebx
mov dword [esi + 4], ebx
jne 0x4a859f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
mov dword [esp + 0x10], edi
call fcn.005d95d0
neg edi
sbb edi, edi
test edi, fcn.00489120
mov dword [esp + 0x14], eax
je 0x4a859f
lea eax, [esp + 0x10]
push eax
mov edx, str.thread.entry_event
call fcn.004a6540
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, dword [ebp + 8]
mov dword [edi + 8], eax
mov dword [esi + 8], eax
cmp dword [edi + 8], 0
jne 0x4a85f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi]
mov edi, eax
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov dword [esp + 0x10], edi
call fcn.005d95d0
neg edi
sbb edi, edi
test edi, fcn.00489120
mov dword [esp + 0x14], eax
je 0x4a85f6
lea ecx, [esp + 0x10]
push ecx
mov edx, str.thread.exit_event
call fcn.004a6540
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea edx, [esp + 0xc]
push edx
push 0
push esi
push 0x4a86a0
push eax
push 0
mov dword [esp + 0x24], 0
call fcn.005bacd5
add esp, 0x18
test eax, eax
mov dword [edi + 4], eax
jne 0x4a867c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi]
mov dword [esp + 0x10], eax
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
test ebx, ebx
je 0x4a8642
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi + 8]
test edi, edi
je 0x4a8650
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x10], esi
call fcn.005d95d0
neg esi
sbb esi, esi
test esi, fcn.00489120
mov dword [esp + 0x14], eax
je 0x4a867c
lea ecx, [esp + 0x10]
push ecx
mov edx, str.thread
call fcn.004a6540
test ebx, ebx
je 0x4a8690
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8