joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a4310
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65c1d8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x74f8a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.005a2680
mov byte [esi + 0x31fd], bl
mov dword [esi + 0xe4], ebx
mov dword [esi + 0x49f4], ebx
mov byte [esi + 0x3209], bl
mov byte [esi + 0xdd], bl
cmp dword [esi + 0x3218], ebx
jne 0x5a4383
push 0x601
call fcn.005ec342
add esp, 4
mov dword [esi + 0x3218], eax
mov eax, dword [esi + 0x3218]
cmp eax, ebx
jne 0x5a43a4
mov eax, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [eax], 3
lea eax, [ebp - 0x28]
push eax
call fcn.0061bba1
add esp, 4
mov ecx, dword [ebp - 0x28]
push ecx
call sub.WS2_32.dll_htonl
mov edx, dword [esi + 0x3218]
mov dword [edx + 1], eax
mov eax, dword [esi + 0x3218]
add eax, 5
mov dword [eax], ebx
mov edi, 9
mov dword [ebp - 0x18], edi
cmp edi, 0x600
jg 0x5a43ff
call fcn.0061cda6
and eax, 0x800000ff
jns 0x5a43f3
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [esi + 0x3218]
mov byte [edi + ecx], al
inc edi
jmp 0x5a43d5
mov edx, dword [esi + 0xc0]
cmp dword [edx + 0x24], 5
jne 0x5a4425
push 0x601
mov eax, dword [esi + 0x3218]
push eax
push str.send
mov ecx, esi
call fcn.005a3970
jmp 0x5a444b
push str.send_handshake
push ebx
push 0x601
mov ecx, dword [esi + 0x3218]
push ecx
mov edx, dword [esi + 0x31e8]
push edx
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.0055bff0
mov edi, eax
lea ecx, [ebp - 0x14]
call fcn.00402500
mov byte [ebp - 4], 1
push edi
push str.sending_handshake__res___ld_n
lea eax, [ebp - 0x14]
push eax
call fcn.00402f70
add esp, 0xc
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, esi
call fcn.0055b6c0
mov dword [esi + 0x321c], ebx
mov dword [esi + 0x3220], ebx
mov byte [esi + 0x31fe], bl
mov byte [esi + 0x31ff], bl
mov ecx, esi
call fcn.0055b910
mov dword [esi + 0x9c], 0x14
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.00402570
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5a44f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x344c], ebx
je 0x5a4514
cmp byte [esi + 0x3474], bl
je 0x5a4514
mov byte [esi + 0x3474], bl
mov byte [esi + 0x3475], bl
mov byte [esp + 0xf], bl
cmp byte [esi + 0x3474], bl
je 0x5a453b
mov ecx, esi
call fcn.005a23d0
cmp eax, ebx
jne 0x5a4621
mov byte [esi + 0x3475], 1
mov byte [esp + 0xf], 1
cmp byte [esi + 0x3475], bl
je 0x5a45e2
cmp dword [esi + 0x344c], ebx
je 0x5a45dc
mov edx, dword [esi + 0x39c]
cmp edx, ebx
jle 0x5a457e
mov ecx, dword [esi + 0x398]
mov al, byte [ecx + esi + 0x324c]
inc ecx
dec edx
mov byte [esp + 0xe], al
mov dword [esi + 0x398], ecx
mov dword [esi + 0x39c], edx
jmp 0x5a45ad
mov ecx, dword [esi + 0x31e8]
push ebx
push 1
lea eax, [esp + 0x16]
push eax
push ecx
call sub.WS2_32.dll_recv
mov edi, eax
push str.recv_byte
push edi
mov ecx, esi
call fcn.0055bff0
test eax, eax
jne 0x5a46c9
mov al, byte [esp + 0xe]
mov dl, al
dec dl
cmp dl, 0x20
ja 0x5a45c8
movsx eax, al
lea eax, [eax + eax*8 + 0xc8]
mov dword [esi + 0x345c], eax
jmp 0x5a45d6
cmp al, 0x21
jle 0x5a45d6
mov dword [esi + 0x345c], 0x1f4
dec dword [esi + 0x344c]
mov byte [esi + 0x3475], bl
cmp dword [esi + 0x344c], ebx
jne 0x5a4631
cmp dword [esi + 0x39c], ebx
mov byte [esi + 0x3474], 1
mov dword [esi + 0x3470], ebx
jg 0x5a44f8
cmp byte [esp + 0xf], bl
je 0x5a44f8
push 0x2733
call sub.WS2_32.dll_WSASetLastError
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
push eax
call sub.WS2_32.dll_WSASetLastError
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
mov eax, dword [esi + 0x39c]
cmp eax, ebx
jle 0x5a467c
mov edi, dword [esp + 0x18]
cmp eax, edi
jge 0x5a4645
mov edi, eax
mov ecx, dword [esi + 0x398]
mov eax, dword [esp + 0x14]
push edi
lea edx, [ecx + esi + 0x324c]
push edx
push eax
call fcn.00619c20
add dword [esi + 0x398], edi
sub dword [esi + 0x39c], edi
add esp, 0xc
sub dword [esi + 0x344c], edi
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret 8
mov eax, dword [esi + 0x344c]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jl 0x5a468c
mov eax, ecx
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x31e8]
push ebx
push eax
push ecx
push edx
call sub.WS2_32.dll_recv
mov edi, eax
push str.rtmpt_recv
push edi
mov ecx, esi
call fcn.0055bff0
test eax, eax
jne 0x5a46c9
sub dword [esi + 0x344c], edi
jne 0x5a46c9
cmp dword [esi + 0xe4], ebx
jbe 0x5a46c9
mov ecx, esi
call fcn.005a4290
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret 8
Function at 0x5a46e0
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push 0xffffffffffffffff
push 0x65c120
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x74f8a0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x14]
call fcn.00402500
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov eax, dword [esi + 0xc0]
mov ecx, dword [eax]
push ecx
lea edx, [esp + 0x18]
push str.POST__open_1_HTTP_1.1_r_nContent_Type:_application_x_fcs_r_nUser_Agent:_Shockwave_Flash_r_nHost:__s_r_nContent_Length:_1_r_nConnection:_Keep_Alive_r_nCache_Control:_no_cache_r_n_r_n
push edx
call fcn.00402f70
add esp, 0xc
push str.Sending_RTMPT_open_n
mov ecx, esi
call fcn.0055b6c0
mov eax, dword [esp + 0x14]
push eax
mov ecx, esi
call fcn.0055b6c0
mov edx, dword [esp + 0x14]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x5a3883
mov ecx, dword [esi + 0x31e8]
push str.RTMPT_Connect
push ebx
sub eax, edi
push eax
push edx
push ecx
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.0055bff0
mov edi, eax
cmp edi, ebx
jne 0x5a3948
mov eax, dword [esi + 0x31e8]
push str.RTMPT_Connect
push ebx
push 1
lea edx, [esp + 0x1f]
push edx
push eax
mov byte [esp + 0x27], bl
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.0055bff0
lea ecx, [esp + 0x18]
mov edi, eax
mov dword [esi + 0x346c], ebx
mov byte [esi + 0x3474], 1
mov dword [esi + 0x344c], ebx
mov dword [esi + 0x39c], ebx
mov dword [esi + 0x9c], 0x19
mov dword [esi + 0x3464], ebx
mov dword [esi + 0x3468], ebx
mov dword [esi + 0x3470], ebx
call fcn.00402500
mov byte [esp + 0x24], 1
push edi
lea ecx, [esp + 0x1c]
push 0x6aa588
push ecx
call fcn.00402f70
mov edx, dword [esp + 0x24]
add esp, 0xc
push edx
mov ecx, esi
call fcn.0055b6c0
mov byte [esp + 0x24], bl
lea ecx, [esp + 0x18]
call fcn.00402570
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00402570
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
push esi
mov esi, ecx
cmp byte [esi + 0x3474], 0
je 0x5a4707
call fcn.005a23d0
test eax, eax
jne 0x5a4747
push str.Ident_data:_n
mov ecx, esi
mov dword [esi + 0x3468], eax
call fcn.0055b6c0
cmp dword [esi + 0x344c], 0
push ebp
push edi
je 0x5a4776
push 0x200
lea ebp, [esi + 0x324c]
push ebp
mov ecx, esi
call fcn.005a44f0
mov edi, eax
push str.recv_identres
push edi
mov ecx, esi
call fcn.0055bff0
mov ecx, eax
test ecx, ecx
je 0x5a4749
sub eax, 0x2733
neg eax
sbb eax, eax
pop edi
and eax, ecx
pop ebp
pop esi
ret
push edi
push ebp
mov ecx, esi
call fcn.0054f320
add dword [esi + 0x3468], edi
mov eax, dword [esi + 0x3468]
cmp dword [esi + 0x344c], eax
mov dword [esi + 0x398], 0
jle 0x5a4776
pop edi
pop ebp
xor eax, eax
pop esi
ret
push 1
push 0x676000
mov ecx, esi
call fcn.0054f320
push str.Ident_res_OK_n
mov ecx, esi
call fcn.0055b6c0
pop edi
pop ebp
mov ecx, esi
pop esi
jmp 0x5a3810
Function at 0x5a5020
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x3474], 0
je 0x5a503b
call fcn.005a23d0
test eax, eax
jne 0x5a5079
mov dword [esi + 0x3468], eax
cmp dword [esi + 0x344c], 0
push edi
je 0x5a509e
push 0x200
lea eax, [esi + 0x324c]
push eax
mov ecx, esi
call fcn.005a44f0
mov edi, eax
push str.recv_idle1res
push edi
mov ecx, esi
call fcn.0055bff0
mov ecx, eax
test ecx, ecx
je 0x5a507b
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, ecx
pop edi
pop esi
ret
add dword [esi + 0x3468], edi
mov eax, dword [esi + 0x3468]
cmp dword [esi + 0x344c], eax
mov dword [esi + 0x398], 0
jle 0x5a509e
pop edi
xor eax, eax
pop esi
ret
push str.Idle_res_OK_n
mov ecx, esi
call fcn.0055b6c0
pop edi
mov ecx, esi
pop esi
jmp fcn.005a4310
Function at 0x5a57a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x65c348
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x74f8a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call fcn.005aa580
mov dword [esp + 0x38], 0
push 4
lea ecx, [esp + 0xc]
mov byte [esp + 0x12], 2
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 5
call fcn.005aa4b0
cmp byte [esp + 0x48], 0
mov dword [esp + 0x20], 4
je 0x5a580c
mov eax, dword [esp + 0x28]
push 0x2625a0
push eax
jmp 0x5a5816
mov ecx, dword [esp + 0x28]
push 0x1312d0
push ecx
call fcn.005a2610
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
add esp, 8
push 0
push edx
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.005a5190
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 8]
call fcn.005aa5a0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 0xc

Function at 0x5a5860
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x65c348
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x74f8a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call fcn.005aa580
mov dword [esp + 0x38], 0
push 4
lea ecx, [esp + 0xc]
mov byte [esp + 0x12], 2
mov byte [esp + 0x10], 1
mov byte [esp + 0x11], 3
call fcn.005aa4b0
mov eax, dword [esi + 0x49b8]
mov ecx, dword [esp + 0x28]
push eax
push ecx
mov dword [esp + 0x28], 4
call fcn.005a2610
mov edx, dword [esi + 0x49b8]
add esp, 8
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esi + 0x49bc], edx
call fcn.005a5190
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 8]
call fcn.005aa5a0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x5a6db0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x65c4c0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x74f8a0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0x10]
call fcn.005aa580
mov dword [esp + 0x40], 0
push 0x100
lea ecx, [esp + 0x14]
mov byte [esp + 0x1a], 3
mov byte [esp + 0x18], 1
mov byte [esp + 0x19], 0x14
call fcn.005aa4b0
mov esi, dword [esp + 0x30]
push str.createStream
lea ecx, [esp + 0x10]
call fcn.004030b0
mov byte [esp + 0x40], 1
lea eax, [esp + 0xc]
push eax
push esi
call fcn.005a3330
add esp, 8
add esi, eax
mov byte [esp + 0x40], 0
lea ecx, [esp + 0xc]
call fcn.00402570
fld qword [esp + 0x48]
sub esp, 8
fstp qword [esp]
push esi
call fcn.005a2630
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
add esp, 0xc
add esi, eax
push 0
mov byte [esi], 5
push ecx
inc esi
sub esi, dword [esp + 0x38]
push edx
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
mov dword [esp + 0x38], esi
call fcn.005a5190
mov esi, eax
mov dword [esp + 0x40], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.005aa5a0
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x38
ret 0x10
Function at 0x5a84e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0x18]
xor ebx, ebx
push edi
mov edi, ecx
cmp eax, ebx
jbe 0x5a8518
cmp dword [esi + 0x20], ebx
jne 0x5a8518
push eax
mov ecx, esi
call fcn.005aa4b0
test al, al
jne 0x5a8518
push str.Err_in_RTMPConn_17_n
mov ecx, edi
call fcn.0055b6c0
pop edi
pop esi
lea eax, [ebx + 8]
pop ebx
ret 4
mov eax, dword [esi + 0x18]
sub eax, dword [esi + 0x1c]
push ebp
mov ebp, dword [edi + 0x347c]
cmp ebp, ebx
jne 0x5a852f
mov ebp, dword [edi + 0x3478]
cmp eax, ebp
jge 0x5a8535
mov ebp, eax
mov dword [edi + 0x347c], ebx
test ebp, ebp
je 0x5a8599
mov eax, dword [edi + 0xc0]
cmp dword [eax + 0x24], 5
jne 0x5a855c
mov ecx, dword [esi + 0x20]
add ecx, dword [esi + 0x1c]
push ebp
push ecx
mov ecx, edi
call fcn.005a44f0
jmp 0x5a8572
mov edx, dword [esi + 0x20]
add edx, dword [esi + 0x1c]
mov eax, dword [edi + 0x31e8]
push 0
push ebp
push edx
push eax
call sub.WS2_32.dll_recv
mov ebx, eax
push str.recv_pheader
push ebx
mov ecx, edi
call fcn.0055bff0
mov ecx, eax
test ecx, ecx
je 0x5a8599
sub eax, 0x2733
pop ebp
neg eax
pop edi
sbb eax, eax
pop esi
and eax, ecx
pop ebx
ret 4
add dword [esi + 0x1c], ebx
cmp ebx, ebp
je 0x5a85b1
sub ebp, ebx
mov dword [edi + 0x347c], ebp
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
movzx eax, byte [esi + 6]
add eax, 0x151
lea ecx, [eax + eax*4]
push esi
lea ecx, [edi + ecx*8]
call fcn.005a26f0
xor ebx, ebx
mov ecx, edi
mov dword [edi + 0x9c], 0x15
mov dword [edi + 0x347c], ebx
call fcn.0055b910
mov edx, dword [esi + 0x1c]
cmp edx, dword [esi + 0x18]
jne 0x5a864a
mov eax, dword [esi + 8]
mov dword [esi + 0x14], eax
cmp byte [esi + 0x10], bl
jne 0x5a8602
movzx ecx, byte [esi + 6]
mov edx, dword [edi + ecx*4 + 0x48a8]
add edx, eax
mov dword [esi + 0x14], edx
movzx eax, byte [esi + 6]
mov ecx, dword [esi + 0x14]
mov dword [edi + eax*4 + 0x48a8], ecx
movzx eax, byte [esi + 6]
lea edx, [eax + eax*4]
mov dword [edi + edx*8 + 0x34c8], ebx
movzx eax, byte [esi + 6]
lea eax, [eax + eax*4]
mov dword [edi + eax*8 + 0x34c4], ebx
movzx eax, byte [esi + 6]
lea ecx, [eax + eax*4]
mov byte [edi + ecx*8 + 0x34b8], 0
push esi
mov ecx, edi
call fcn.005a82d0
pop ebp
pop edi
pop esi
pop ebx
ret 4
mov ecx, esi
mov dword [esi + 0x20], ebx
call fcn.005aa590
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
Function at 0x5a8660
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x49cc]
push edi
test eax, eax
jle 0x5a86ed
mov ecx, dword [esi + 0xc0]
cmp dword [ecx + 0x24], 5
mov ecx, dword [esi + 0x3224]
jne 0x5a8694
sub eax, ecx
lea edx, [ecx + esi + 0x49d0]
push eax
push edx
mov ecx, esi
call fcn.005a44f0
jmp 0x5a86ad
push 0
sub eax, ecx
push eax
lea eax, [ecx + esi + 0x49d0]
mov ecx, dword [esi + 0x31e8]
push eax
push ecx
call sub.WS2_32.dll_recv
mov edi, eax
push str.recv_pheader
push edi
mov ecx, esi
call fcn.0055bff0
mov ecx, eax
test ecx, ecx
je 0x5a86d2
sub eax, 0x2733
neg eax
sbb eax, eax
pop edi
and eax, ecx
pop esi
ret 4
add dword [esi + 0x3224], edi
mov eax, dword [esi + 0x3224]
cmp eax, dword [esi + 0x49cc]
je 0x5a86ed
pop edi
xor eax, eax
pop esi
ret 4
push ebx
mov ecx, esi
call fcn.0055b910
mov edi, dword [esp + 0x10]
xor bl, bl
cmp dword [esi + 0x49cc], 3
jl 0x5a87ca
lea edx, [esi + 0x49d0]
push edx
call fcn.005a2570
add esp, 4
mov dword [edi + 8], eax
cmp dword [esi + 0x49cc], 6
jl 0x5a8755
lea eax, [esi + 0x49d3]
push eax
call fcn.005a2570
add esp, 4
mov ecx, edi
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], 0
call fcn.005aa550
cmp dword [esi + 0x49cc], 6
jle 0x5a8755
mov cl, byte [esi + 0x49d6]
mov byte [edi + 5], cl
cmp dword [esi + 0x49cc], 0xb
jne 0x5a8770
lea edx, [esi + 0x49d7]
push edx
call fcn.0054ea60
add esp, 4
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0xffffff
jne 0x5a87ca
mov eax, dword [esi + 0xc0]
cmp dword [eax + 0x24], 5
jne 0x5a8795
push 4
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.005a44f0
jmp 0x5a87aa
mov eax, dword [esi + 0x31e8]
push 0
push 4
lea edx, [esp + 0x18]
push edx
push eax
call sub.WS2_32.dll_recv
cmp eax, 4
je 0x5a87b8
pop ebx
pop edi
or eax, 0xffffffff
pop esi
ret 4
lea ecx, [esp + 0x10]
push ecx
call fcn.005a25a0
add esp, 4
mov dword [edi + 0x14], eax
mov bl, 1
movzx eax, byte [edi + 5]
add eax, 0xfffffff8
xor cl, cl
cmp eax, 0xe
ja case.0x5a87df.10
movzx edx, byte [eax + 0x5a8860]
jmp dword [edx*4 + 0x5a8858]
mov cl, 1
test bl, bl
jne 0x5a87f2
mov eax, dword [edi + 8]
mov dword [edi + 0x14], eax
cmp byte [edi + 0x10], 0
jne 0x5a8806
movzx edx, byte [edi + 6]
mov eax, dword [esi + edx*4 + 0x48a8]
add dword [edi + 0x14], eax
test cl, cl
mov ecx, esi
je 0x5a882d
mov dword [esi + 0x9c], 0x18
call fcn.005a1f70
test eax, eax
jne 0x5a884e
push edi
mov ecx, esi
call fcn.005a89a0
pop ebx
pop edi
pop esi
ret 4
mov dword [esi + 0x9c], 0x17
call fcn.005a1f70
test eax, eax
jne 0x5a884e
push edi
mov ecx, esi
call fcn.005a84e0
pop ebx
pop edi
pop esi
ret 4
pop ebx
pop edi
xor eax, eax
pop esi
ret 4
Function at 0x5a8870
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc0]
mov dword [esi + 0x3230], 0
cmp dword [eax + 0x24], 5
jne 0x5a889a
push 1
lea ecx, [esp + 0xb]
push ecx
mov ecx, esi
call fcn.005a44f0
jmp 0x5a88af
mov eax, dword [esi + 0x31e8]
push 0
push 1
lea edx, [esp + 0xf]
push edx
push eax
call sub.WS2_32.dll_recv
push str.recv_pheader_type
push eax
mov ecx, esi
call fcn.0055bff0
mov ecx, eax
test ecx, ecx
je 0x5a88d2
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, ecx
pop esi
pop ecx
ret 4
push edi
mov ecx, esi
call fcn.0055b910
mov cl, byte [esp + 0xb]
mov edi, dword [esp + 0x10]
mov al, cl
sar al, 6
and al, 3
and cl, 0x3f
mov byte [edi + 4], al
mov byte [edi + 6], cl
jne 0x5a88ff
pop edi
mov eax, 0xffffffff
pop esi
pop ecx
ret 4
cmp cl, 1
jne 0x5a890d
pop edi
or eax, 0xffffffff
pop esi
pop ecx
ret 4
movzx ecx, al
mov eax, dword [ecx*4 + 0x6aa454]
mov dword [esi + 0x49cc], eax
cmp eax, 0xc
jne 0x5a8926
mov byte [edi + 0x10], 1
cmp dword [esi + 0x49cc], 0xc
jge 0x5a894d
mov ecx, edi
call fcn.005aa550
movzx eax, byte [edi + 6]
add eax, 0x151
lea edx, [eax + eax*4]
lea eax, [esi + edx*8]
push eax
mov ecx, edi
call fcn.005a26f0
dec dword [esi + 0x49cc]
xor eax, eax
mov dword [esi + 0x49d0], eax
mov dword [esi + 0x49d4], eax
mov dword [esi + 0x49d8], eax
cmp dword [esi + 0x49cc], eax
mov dword [esi + 0x9c], 0x16
mov dword [esi + 0x3224], eax
mov ecx, esi
jle 0x5a8994
call fcn.005a1f70
test eax, eax
je 0x5a8992
pop edi
xor eax, eax
pop esi
pop ecx
ret 4
mov ecx, esi
push edi
call fcn.005a8660
pop edi
pop esi
pop ecx
ret 4
Function at 0x5aaf40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65c850
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x74f8a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push str._dkf
lea ecx, [ebp - 0x24]
push ecx
call fcn.0061af5b
add esp, 0xc
push 0x10
push edi
push 0
push 0
lea edx, [ebp - 0x24]
push edx
mov eax, dword [esi + 0x104]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0061807e
mov esp, ebp
pop ebp
ret 8

Function at 0x5aaff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65c880
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x74f8a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push str._dkf
lea ecx, [ebp - 0x24]
push ecx
call fcn.0061af5b
add esp, 0xc
mov dword [ebp - 0x2c], 0x10
lea edx, [ebp - 0x2c]
push edx
push edi
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [esi + 0x104]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5ab088
mov eax, 1
jmp 0x5ab08a
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0061807e
mov esp, ebp
pop ebp
ret 8
Function at 0x5abd00
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x23c]
test eax, eax
je 0x5abd7b
cmp dword [esi + 0x174], 0
push edi
je 0x5abd5e
mov ecx, dword [esi + 0x1a0]
test ecx, ecx
je 0x5abd5e
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push str.bUseSpeedLimiter
push eax
call edi
mov eax, dword [esi + 0x23c]
push 8
lea edx, [esi + 0x168]
push edx
push 0
push 0
push str.psnSpeedLimit
push eax
call edi
pop edi
pop esi
pop ecx
ret
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.bUseSpeedLimiter
push eax
call edi
mov ecx, dword [esi + 0x23c]
push str.psnSpeedLimit
push ecx
call edi
pop edi
pop esi
pop ecx
ret

Function at 0x5abd80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x23c]
test eax, eax
je 0x5abe18
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0
push str.bUseSpeedLimiter
push eax
mov dword [esp + 0x20], 4
call edi
test eax, eax
jne 0x5abe17
mov eax, dword [esp + 0xc]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0
mov dword [esi + 0x1a0], eax
mov eax, dword [esi + 0x23c]
push str.psnSpeedLimit
push eax
mov dword [esi + 0x174], 1
mov dword [esp + 0x20], 8
call edi
test eax, eax
jne 0x5abe17
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x168], ecx
mov dword [esi + 0x16c], edx
mov dword [esi + 0x170], 1
pop edi
pop esi
add esp, 0x10
ret

Function at 0x5abe20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x23c]
test eax, eax
je 0x5abe96
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0
push str.nSkFr1
push eax
mov dword [esp + 0x20], 4
call edi
test eax, eax
jne 0x5abe95
mov eax, dword [esp + 0xc]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0
mov dword [esi + 0x190], eax
mov eax, dword [esi + 0x23c]
push str.dLstDrSk1
push eax
mov dword [esp + 0x20], 8
call edi
test eax, eax
jne 0x5abe95
fld qword [esp + 0x10]
fstp qword [esi + 0x198]
pop edi
pop esi
add esp, 0x10
ret
Function at 0x5ac140
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65c930
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x74f8a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
cmp dword [esi + 0x23c], 0
je 0x5ac269
mov dword [ebp - 4], 0
wait
mov eax, dword [esi + 0x1c0]
mov ecx, dword [esi + 0x1c4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
push 8
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0x6920f4
mov ecx, dword [esi + 0x23c]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call edi
mov eax, dword [esi + 0x1c8]
mov dword [ebp - 0x14], eax
cmp eax, 0x64
jle 0x5ac1db
push 4
lea edx, [ebp - 0x14]
push edx
push 4
push 0
push str.Speed
mov eax, dword [esi + 0x23c]
push eax
call edi
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0x24]
cmp ecx, 4
je 0x5ac1f4
cmp ecx, 5
je 0x5ac1f4
cmp dword [eax + 0x320], 0
je 0x5ac215
fld qword [esi + 0x188]
fstp qword [ebp - 0x28]
push 8
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push str.dwnlDuration
mov edx, dword [esi + 0x23c]
push edx
call edi
cmp dword [ebp + 8], 0
je 0x5ac261
mov eax, dword [esi + 0x190]
test eax, eax
jle 0x5ac261
mov dword [ebp + 8], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push str.nSkFr1
mov ecx, dword [esi + 0x23c]
push ecx
call edi
fld qword [esi + 0x198]
fstp qword [ebp - 0x30]
push 8
lea edx, [ebp - 0x30]
push edx
push 0
push 0
push str.dLstDrSk1
mov eax, dword [esi + 0x23c]
push eax
call edi
wait
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4