joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ee40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov edx, 1
cmp dword [esi + 0x48], edx
jle 0x45ef4b
push ebx
push edi
lea eax, [esi + 0x5e]
xor ebx, ebx
xor ecx, ecx
mov bl, byte [eax - 1]
mov cl, byte [eax + 1]
add eax, 0x10
mov edi, dword [ebx*4 + 0x4b68f8]
mov ecx, dword [ecx*4 + 0x4b70f8]
xor ebx, ebx
xor ecx, edi
mov bl, byte [eax - 0x10]
mov edi, dword [ebx*4 + 0x4b6cf8]
xor ebx, ebx
mov bl, byte [eax - 0x12]
xor ecx, edi
mov edi, dword [ebx*4 + 0x4b64f8]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0x12], ecx
mov bl, byte [eax - 0xc]
xor ecx, ecx
mov cl, byte [eax - 0xb]
mov edi, dword [ebx*4 + 0x4b6cf8]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x4b70f8]
mov bl, byte [eax - 0xd]
xor ecx, edi
mov edi, dword [ebx*4 + 0x4b68f8]
xor ebx, ebx
mov bl, byte [eax - 0xe]
xor ecx, edi
mov edi, dword [ebx*4 + 0x4b64f8]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0xe], ecx
mov bl, byte [eax - 8]
xor ecx, ecx
mov cl, byte [eax - 7]
mov edi, dword [ebx*4 + 0x4b6cf8]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x4b70f8]
mov bl, byte [eax - 9]
xor ecx, edi
mov edi, dword [ebx*4 + 0x4b68f8]
xor ebx, ebx
mov bl, byte [eax - 0xa]
xor ecx, edi
mov edi, dword [ebx*4 + 0x4b64f8]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0xa], ecx
mov bl, byte [eax - 4]
xor ecx, ecx
mov cl, byte [eax - 3]
mov edi, dword [ebx*4 + 0x4b6cf8]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x4b70f8]
mov bl, byte [eax - 5]
xor ecx, edi
mov edi, dword [ebx*4 + 0x4b68f8]
xor ebx, ebx
mov bl, byte [eax - 6]
xor ecx, edi
mov edi, dword [ebx*4 + 0x4b64f8]
xor ecx, edi
inc edx
mov dword [eax - 6], ecx
mov ecx, dword [esi + 0x48]
cmp edx, ecx
jl 0x45ee56
pop edi
pop ebx
pop esi
ret
Function at 0x460cd0
Capabilities:
Initialize winsock library

Disassembly:
mov al, byte [0x4bac40]
sub esp, 0x218
test al, al
jne 0x460ce8
mov al, 1
add esp, 0x218
ret
push ebx
push ebp
push esi
mov ebp, dword [sym.imp.WS2_32.dll_WSAStartup]
push edi
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x98]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x98]
push eax
push 0x909
call ebp
mov esi, eax
cmp esi, 0x276c
jne 0x460dad
mov ebx, 5
mov dword [esp + 0x10], 2
cmp ebx, 1
jl 0x460d76
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jns 0x460d45
mov dword [esp + 0x10], 9
dec ebx
test ebx, ebx
je 0x460d76
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x98]
xor edx, edx
mov dh, byte [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x98]
mov dl, bl
push ecx
push edx
call ebp
mov esi, eax
cmp esi, 0x276c
je 0x460d2c
test esi, esi
jne 0x460db5
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x48]
push eax
push ebx
push str.Using_ws2_32.dll_version__d__d
push ecx
call fcn.0047e034
mov ecx, dword [esp + 0x23c]
add esp, 0x10
lea eax, [esp + 0x48]
mov edx, dword [ecx]
push eax
push str.ws2_32_DLL_Version
call dword [edx + 0x28]
jmp 0x460e5a
test esi, esi
je 0x460e5a
cmp esi, 0x276b
jne 0x460dd0
mov ecx, dword [esp + 0x22c]
push str.The_underlying_network_subsystem_is_not_ready_for_network_communication.
mov edx, dword [ecx]
jmp 0x460e57
cmp esi, 0x276c
jne 0x460deb
mov ecx, dword [esp + 0x22c]
push str.The_version_of_Windows_Sockets_support_requested_is_not_provided_by_this_particular_Windows_Sockets_implementation.
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x460e5a
cmp esi, 0x2734
jne 0x460e03
mov ecx, dword [esp + 0x22c]
push str.A_blocking_Windows_Sockets_1.1_operation_is_in_progress.
mov edx, dword [ecx]
jmp 0x460e57
cmp esi, 0x2753
jne 0x460e1e
mov ecx, dword [esp + 0x22c]
push str.Limit_on_the_number_of_tasks_supported_by_the_Windows_Sockets_implementation_has_been_reached.
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x460e5a
cmp esi, 0x271e
jne 0x460e36
mov ecx, dword [esp + 0x22c]
push str.The_lpWSAData_is_not_a_valid_pointer.
mov edx, dword [ecx]
jmp 0x460e57
push esi
lea eax, [esp + 0x18]
push str.WSAStartup_error:_0x_x
push eax
call fcn.0047e034
mov ecx, dword [esp + 0x238]
add esp, 0xc
lea eax, [esp + 0x14]
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebp
mov byte [0x4bac40], 0
pop ebx
sete al
add esp, 0x218
ret

Function at 0x460ea0
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 0x54]
cmp edx, 0xffffffff
je 0x460f05
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea ecx, [esi + 8]
test eax, eax
je 0x460eda
cmp eax, 0x3e8
jb 0x460eda
cmp eax, 0x1e8480
jae 0x460eda
push 4
push ecx
push 0x1001
push 0xffff
push edx
call edi
mov eax, dword [esi + 0xc]
lea ecx, [esi + 0xc]
test eax, eax
je 0x460f05
cmp eax, 0x3e8
jb 0x460f05
cmp eax, 0x1e8480
jae 0x460f05
mov eax, dword [esi + 0x54]
push 4
push ecx
push 0x1002
push 0xffff
push eax
call edi
pop edi
pop esi
ret
Function at 0x460f10
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x491cd8
push eax
mov al, byte [0x4bac40]
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
mov esi, ecx
test al, al
je 0x460f49
push edi
call fcn.00460cd0
add esp, 4
test al, al
je 0x46102a
push edi
push 1
mov ecx, esi
call fcn.00462f70
push 0
push 1
push 2
mov bl, 1
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x54], eax
jne 0x460f7b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push edi
push eax
call fcn.004614f0
add esp, 8
xor bl, bl
mov ecx, esi
call fcn.00460ea0
mov al, byte [esp + 0x24]
test al, al
je 0x461028
lea ebp, [esi + 0x100]
mov ecx, ebp
call fcn.0041c950
test eax, eax
jne 0x460fa9
mov eax, dword [esi + 0x128]
test eax, eax
je 0x461028
mov ebx, dword [edi]
mov ecx, ebp
call fcn.0041c940
push eax
push str.BindIpAddr
mov ecx, edi
call dword [ebx + 0x28]
mov eax, dword [esi + 0x128]
test eax, eax
je 0x460fd4
mov edx, dword [edi]
push eax
push str.BindPort
mov ecx, edi
call dword [edx + 0x2c]
push edi
mov ecx, ebp
call fcn.0041c940
push eax
mov ecx, esi
call fcn.00462e80
mov bl, al
test bl, bl
jne 0x461028
mov eax, dword [edi]
push str.Failed_to_bind_to_local_IP_address
mov ecx, edi
call dword [eax + 0x10]
lea ecx, [esp + 0x24]
call fcn.00428f40
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0
push ecx
push 2
mov ecx, esi
call fcn.00462f70
or eax, 0xffffffff
lea ecx, [esp + 0x24]
mov dword [esi + 0x54], eax
mov dword [esp + 0x18], eax
call fcn.00428f80
mov al, bl
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8
Function at 0x461210
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x491d7e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x10]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.00473b70
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], ebx
call fcn.00473b70
lea ecx, [esi + 0x5c]
mov byte [esp + 0x18], 1
mov byte [esi + 0x50], bl
mov dword [esi + 0x54], 0xffffffff
call fcn.00473a60
lea ecx, [esi + 0x70]
mov byte [esp + 0x18], 2
call fcn.00473850
lea ecx, [esi + 0x98]
mov byte [esp + 0x18], 3
call fcn.00473850
lea ecx, [esi + 0xd0]
mov byte [esp + 0x18], 4
mov dword [esi + 0xc0], 0x7530
mov dword [esi + 0xc4], 0x1b58
mov dword [esi + 0xc8], ebx
call fcn.0041d9e0
lea ecx, [esi + 0x100]
mov byte [esp + 0x18], 5
mov dword [esi + 0xf8], ebx
call fcn.0041d9e0
lea ecx, [esp + 8]
mov byte [esp + 0x18], 6
mov dword [esi + 0x128], ebx
mov byte [esi + 0x12c], bl
mov dword [esi], vtable.ChilkatSocket.0
call fcn.00428f40
mov al, byte [0x4bac40]
mov byte [esp + 0x18], 7
cmp al, bl
je 0x4612fb
lea eax, [esp + 8]
push eax
call fcn.00460cd0
add esp, 4
mov dword [esi + 0x4c], 1
mov dword [esi + 0x2c], 2
mov ecx, dword [0x4bac3c]
mov byte [esp + 0x18], 6
mov dword [esi + 0x58], ecx
mov eax, dword [0x4bac3c]
inc eax
lea ecx, [esp + 8]
mov dword [0x4bac3c], eax
call fcn.00428f80
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x461340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x491dee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.ChilkatSocket.0
mov eax, dword [esi + 0x54]
mov dword [esp + 0x14], 6
cmp eax, 0xffffffff
je 0x4613a6
lea ecx, [esp + 4]
call fcn.00428f40
lea eax, [esp + 4]
mov ecx, esi
push eax
push 2
mov byte [esp + 0x1c], 7
call fcn.00462f70
lea ecx, [esp + 4]
mov dword [esi + 0x54], 0xffffffff
mov byte [esp + 0x14], 6
call fcn.00428f80
lea ecx, [esi + 0x100]
mov byte [esp + 0x14], 5
call fcn.0041dcd0
lea ecx, [esi + 0xd0]
mov byte [esp + 0x14], 4
call fcn.0041dcd0
lea ecx, [esi + 0x98]
mov byte [esp + 0x14], 3
call fcn.004738a0
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 2
call fcn.004738a0
lea ecx, [esi + 0x5c]
mov byte [esp + 0x14], 1
call fcn.00473ac0
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 0
call fcn.00473bc0
lea ecx, [esi + 0x10]
mov dword [esp + 0x14], 0xffffffff
call fcn.00473bc0
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x462a30
Capabilities:
Get socket status

Disassembly:
mov eax, dword [ecx + 0x54]
sub esp, 0x10c
cmp eax, 0xffffffff
jne 0x462a5a
mov ecx, dword [esp + 0x114]
push str.invalid_socket__not_ready_for_writing.
mov eax, dword [ecx]
call dword [eax + 0x10]
xor al, al
add esp, 0x10c
ret 8
mov ecx, dword [esp + 0x110]
test ecx, ecx
jne 0x462a6a
mov ecx, 0x20f580
mov dword [esp], ecx
lea ecx, [esp]
push ecx
lea edx, [esp + 0xc]
push 0
push edx
push 0
push 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x462ab9
mov ecx, dword [esp + 0x114]
push str.select_returned_a_socket_error
mov eax, dword [ecx]
call dword [eax + 0x10]
xor al, al
add esp, 0x10c
ret 8
cmp eax, 1
jne 0x462ac9
mov al, al
add esp, 0x10c
ret 8
mov ecx, dword [esp + 0x114]
push str.socket_is_not_ready_for_writing.
mov edx, dword [ecx]
call dword [edx + 0x10]
xor al, al
add esp, 0x10c
ret 8

Function at 0x462af0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x11c]
push esi
push edi
mov edi, dword [esp + 0x128]
mov byte [ebx], 0
mov byte [edi], 0
mov esi, dword [ecx + 0x54]
cmp esi, 0xffffffff
jne 0x462b37
mov ecx, dword [esp + 0x120]
push str.invalid_socket__not_ready_for_writing.
mov eax, dword [ecx]
call dword [eax + 0x10]
mov byte [edi], 1
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x10c
ret 0x10
mov ecx, dword [esp + 0x11c]
test ecx, ecx
jne 0x462b47
mov ecx, 0x80befc00
mov eax, 0x10624dd3
mov dword [esp + 0x18], esi
mul ecx
shr edx, 6
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], 1
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
sub ecx, edx
lea edx, [esp + 0x14]
lea eax, [ecx + ecx*4]
lea ecx, [esp + 0xc]
push ecx
push 0
lea eax, [eax + eax*4]
push edx
push 0
push 0
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esp + 0x24], eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x462bbc
mov ecx, dword [esp + 0x120]
push str.select_returned_a_socket_error
mov eax, dword [ecx]
call dword [eax + 0x10]
mov byte [edi], 1
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x10c
ret 0x10
cmp eax, 1
jne 0x462bcf
pop edi
pop esi
mov al, al
pop ebx
add esp, 0x10c
ret 0x10
mov ecx, dword [esp + 0x120]
push str.socket_is_not_ready_for_writing
mov edx, dword [ecx]
call dword [edx + 0x10]
pop edi
mov byte [ebx], 1
pop esi
xor al, al
pop ebx
add esp, 0x10c
ret 0x10
Function at 0x4630a0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x120]
push esi
push edi
mov edi, dword [esp + 0x124]
mov esi, ecx
test edi, edi
mov byte [ebp], 0
je 0x4630f6
push 0x78
push 0
mov ecx, edi
call fcn.00430a60
mov ecx, edi
call fcn.0045d750
test al, al
je 0x4630f6
mov ecx, dword [esp + 0x12c]
push str.Wait_for_data_aborted_by_app
mov eax, dword [ecx]
call dword [eax + 0x10]
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x10c
ret 0x18
mov edi, dword [esi + 0x54]
cmp edi, 0xffffffff
jne 0x463121
mov ecx, dword [esp + 0x12c]
push str.Wait_for_data_passed_invalid_socket.
mov edx, dword [ecx]
call dword [edx + 0x10]
pop edi
mov byte [ebp], 1
pop esi
xor al, al
pop ebp
add esp, 0x10c
ret 0x18
mov ecx, dword [esp + 0x11c]
push ebx
mov bl, byte [esp + 0x124]
test bl, bl
jne 0x46313d
test ecx, ecx
jne 0x46313d
mov ecx, 0x14
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov eax, edx
neg eax
shl eax, 2
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*8]
cmp eax, 0x7a120
jbe 0x463165
mov eax, 0x7a120
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
test bl, bl
pop ebx
jne 0x463183
test edx, edx
jne 0x463183
test eax, eax
jne 0x463183
mov eax, 0x3e8
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], edx
push ecx
push 0
lea edx, [esp + 0x1c]
push 0
push edx
push 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x4631f6
mov ecx, dword [esp + 0x12c]
mov byte [ebp], 1
push str.The_peer_has_closed_the_socket__TCP__connection
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [esi + 0x54]
push 2
push ecx
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [esi + 0x54]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x54], 0xffffffff
mov byte [esi + 0x50], 0
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x10c
ret 0x18
test eax, eax
pop edi
pop esi
setne al
pop ebp
add esp, 0x10c
ret 0x18
Function at 0x463210
Capabilities:
Get socket status

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 0x110
push ebx
mov ebx, dword [esp + 0x118]
push ebp
push esi
mov esi, dword [esp + 0x12c]
push edi
mov edi, ecx
mov byte [eax], 0
mov ecx, dword [esp + 0x138]
mov byte [esi], 0
test ebx, ebx
mov byte [ecx], 0
je 0x46324c
cmp ebx, 0x32
jae 0x46324c
mov ebx, 0x32
mov ebp, dword [esp + 0x128]
test ebp, ebp
jne 0x46325c
mov ebp, 0x80befc00
cmp dword [edi + 0x54], 0xffffffff
jne 0x463285
mov ecx, dword [esp + 0x13c]
push str.Invalid_socket.
mov edx, dword [ecx]
call dword [edx + 0x10]
mov byte [esi], 1
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret 0x1c
xor eax, eax
mov cl, 1
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x463299
cmp eax, ebp
jae 0x4633ce
test ebx, ebx
mov esi, ebx
jne 0x4632a1
mov esi, ebp
test ebp, ebp
je 0x4632b7
cmp ebp, eax
jbe 0x4632b7
mov esi, ebp
sub esi, eax
test ebx, ebx
je 0x4632b7
cmp esi, ebx
jbe 0x4632b7
mov esi, ebx
test cl, cl
je 0x4632c7
shr esi, 1
cmp esi, 0x32
jae 0x4632c7
mov esi, 0x32
mov eax, 0x10624dd3
mov dword [esp + 0x1c], 1
mul esi
shr edx, 6
mov dword [esp + 0x14], edx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov ecx, eax
mov eax, esi
sub eax, ecx
lea ecx, [esp + 0x14]
push ecx
push 0
lea eax, [eax + eax*4]
push 0
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, dword [edi + 0x54]
shl edx, 3
mov dword [esp + 0x24], edx
lea edx, [esp + 0x28]
push edx
push 0
mov dword [esp + 0x34], eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x463374
test eax, eax
jne 0x4633bf
mov ecx, dword [esp + 0x10]
add ecx, esi
test ebp, ebp
mov dword [esp + 0x10], ecx
je 0x463341
mov eax, ecx
cmp eax, ebp
jae 0x4633ce
mov esi, dword [esp + 0x12c]
test esi, esi
je 0x463369
test ebx, ebx
je 0x463369
push 0x73
push ebx
mov ecx, esi
call fcn.004309f0
mov ecx, esi
call fcn.0045d750
test al, al
jne 0x463407
mov eax, dword [esp + 0x10]
xor cl, cl
jmp 0x46328d
mov eax, dword [esp + 0x130]
mov ecx, dword [esp + 0x13c]
push str.Error_waiting_for_socket_to_become_ready_for_reading.
mov byte [eax], 1
mov edx, dword [ecx]
call dword [edx + 0x10]
mov eax, dword [edi + 0x54]
push 2
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov ecx, dword [edi + 0x54]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi + 0x54], 0xffffffff
mov byte [edi + 0x50], 0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret 0x1c
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x110
ret 0x1c
mov esi, dword [esp + 0x13c]
push str.Timeout_waiting_to_read_socket_or_accept_connection
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x10]
mov eax, dword [esi]
push ebp
push str.timeoutMs
mov ecx, esi
call dword [eax + 0x2c]
mov ecx, dword [esp + 0x138]
pop edi
pop esi
pop ebp
mov byte [ecx], 1
xor al, al
pop ebx
add esp, 0x110
ret 0x1c
mov edx, dword [esp + 0x134]
mov ecx, dword [esp + 0x13c]
push str.socket_operation_aborted_by_application_callback
mov byte [edx], 1
mov eax, dword [ecx]
call dword [eax + 0x10]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret 0x1c
Function at 0x464340
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x491f78
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0x7d0
call fcn.0047dc6a
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x464386
mov ecx, dword [esp + 0x54]
push str.Socket_receive_memory_allocation_failed.
mov eax, dword [ecx]
call dword [eax + 0x10]
xor al, al
jmp 0x464497
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, esi
jae 0x4643a2
mov dword [esp + 0x14], eax
jmp 0x4643ad
sub eax, esi
cmp eax, 0x64
ja 0x464495
mov edx, dword [esp + 0x58]
lea ecx, [esp + 0x13]
lea ebx, [edi + 0x98]
push ecx
push edx
push 0
mov ecx, ebx
call fcn.00473930
mov al, byte [esp + 0x13]
test al, al
jne 0x464431
mov eax, dword [edi + 0x54]
push 0
push 0x7d0
push ebp
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
je 0x464443
cmp esi, 0xffffffff
je 0x46447f
test esi, esi
jle 0x464415
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], eax
mov al, byte [edi + 0x12c]
test al, al
je 0x464415
mov ecx, dword [esp + 0x58]
push ecx
push esi
lea ecx, [edi + 0x10]
call fcn.00473ca0
push esi
mov ecx, ebx
call fcn.004738d0
mov ecx, dword [esp + 0x50]
push esi
push ebp
call fcn.00428150
mov esi, dword [esp + 0x14]
jmp 0x464392
mov ecx, dword [esp + 0x54]
push str.Aborted_by_application_while_download_throttling__3_
mov edx, dword [ecx]
call dword [edx + 0x10]
xor al, al
jmp 0x464497
mov eax, dword [edi + 0x54]
push 2
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov ecx, dword [edi + 0x54]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
push ebp
mov dword [edi + 0x54], 0xffffffff
mov byte [edi + 0x50], 0
call fcn.0047d7af
mov ecx, dword [esp + 0x58]
add esp, 4
mov edx, dword [ecx]
push str.Socket_already_closed_by_peer.
call dword [edx + 0x10]
xor al, al
jmp 0x464497
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4644ac
push ebp
call fcn.0047d7af
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret 0xc
lea ecx, [esp + 0x18]
call fcn.0041d9e0
push str.SOCKET_ERROR:
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4c], 0
call fcn.0041d4d0
lea ecx, [esp + 0x18]
call fcn.0041ef70
mov esi, dword [esp + 0x54]
lea ecx, [esp + 0x18]
mov edi, dword [esi]
call fcn.0041c940
push eax
mov ecx, esi
call dword [edi + 0x10]
mov eax, dword [esi]
push str.Failed_to_accumulate_data_on_socket.
mov ecx, esi
call dword [eax + 0x10]
push ebp
call fcn.0047d7af
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], 0xffffffff
call fcn.0041dcd0
xor al, al
jmp 0x464497
Function at 0x46a8e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4924ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea edi, [esi + 8]
mov ecx, edi
call fcn.0041d9e0
xor eax, eax
mov ecx, edi
push eax
mov dword [esp + 0x18], eax
mov dword [esi + 0x34], eax
mov dword [esi], vtable.ParseEngine.0
call fcn.0041c960
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x46a960
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4924cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea edi, [esi + 8]
mov ecx, edi
call fcn.0041d9e0
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], 0
mov ecx, ebx
mov dword [esi + 0x34], 0
mov dword [esi], vtable.ParseEngine.0
call fcn.00426b30
push eax
mov ecx, ebx
call fcn.0041c940
push eax
mov ecx, edi
call fcn.0041d760
push 0
mov ecx, edi
call fcn.0041c960
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x30], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x46ed40
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
sub esp, 0x4c
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov ecx, 0x10
mov eax, dword [ebp + 8]
lea edi, [esp + 0x1c]
cdq
and edx, 7
lea esi, [ebp + 0x18]
add eax, edx
mov ebx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, esi
sar ebx, 3
call fcn.00426b30
cmp eax, 0x40
mov ecx, esi
jbe 0x46ed94
call fcn.0041c940
test eax, eax
je 0x46edc5
mov ecx, esi
call fcn.0041c940
mov ecx, 0x10
mov esi, eax
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
jmp 0x46edc5
call fcn.0041c940
test eax, eax
je 0x46edc5
mov ecx, esi
call fcn.00426b30
mov ecx, esi
mov edi, eax
call fcn.0041c940
mov esi, eax
mov eax, edi
lea edi, [esp + 0x1c]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov ecx, dword [ebp]
mov edx, dword [eax + 0x4bd15c]
mov dword [eax + ecx], edx
add eax, 4
cmp eax, 0x48
jl 0x46edc7
xor eax, eax
mov ecx, 0x100
mov edx, dword [ebp + 4]
mov esi, dword [eax + 0x4bd1a4]
mov dword [edx + eax], esi
add eax, 4
dec ecx
jne 0x46ede2
cmp eax, 0x1000
jl 0x46eddd
xor esi, esi
xor edi, edi
mov eax, dword [ebp]
lea ecx, [edi + eax]
lea eax, [esi + 1]
cdq
idiv ebx
mov dword [esp + 0x18], ecx
xor ecx, ecx
lea eax, [esi + 2]
add edi, 4
mov cl, byte [esp + edx + 0x1c]
cdq
idiv ebx
mov ch, byte [esp + esi + 0x1c]
xor eax, eax
shl ecx, 8
mov al, byte [esp + edx + 0x1c]
or ecx, eax
lea eax, [esi + 3]
cdq
idiv ebx
xor eax, eax
shl ecx, 8
mov al, byte [esp + edx + 0x1c]
or ecx, eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
xor edx, ecx
mov dword [eax], edx
lea eax, [esi + 4]
cdq
idiv ebx
cmp edi, 0x48
mov esi, edx
jl 0x46edff
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, ebp
call fcn.0046e540
mov eax, dword [ebp]
mov ecx, dword [esp + 0x10]
mov dword [esi + eax], ecx
mov edx, dword [ebp]
mov eax, dword [esp + 0x14]
mov dword [esi + edx + 4], eax
add esi, 8
cmp esi, 0x48
jl 0x46ee5f
mov esi, 4
mov edi, 0x80
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, ebp
call fcn.0046e540
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0x10]
mov dword [esi + eax - 4], ecx
mov edx, dword [ebp + 4]
mov eax, dword [esp + 0x14]
mov dword [esi + edx], eax
add esi, 8
dec edi
jne 0x46ee97
cmp esi, 0x1004
jl 0x46ee92
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret