joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451e60
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.0042eb10
add esp, 8
mov ecx, eax
call fcn.0042e6a0
mov ecx, eax
call fcn.0042e6a0
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ecx + 0x2c]
je 0x451f46
mov eax, dword [ebp - 0xc]
sub eax, 0x61c88647
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 4]
shl esi, 4
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00451860
mov ecx, 4
imul edx, ecx, 0
add esi, dword [eax + edx]
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
xor esi, eax
mov edi, dword [ebp - 4]
shr edi, 5
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00451860
mov ecx, 4
shl ecx, 0
add edi, dword [eax + ecx]
xor esi, edi
add esi, dword [ebp - 8]
mov dword [ebp - 8], esi
mov esi, dword [ebp - 8]
shl esi, 4
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00451860
mov edx, 4
shl edx, 1
add esi, dword [eax + edx]
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
xor esi, eax
mov edi, dword [ebp - 8]
shr edi, 5
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00451860
mov ecx, 4
imul edx, ecx, 3
add edi, dword [eax + edx]
xor esi, edi
add esi, dword [ebp - 4]
mov dword [ebp - 4], esi
jmp 0x451e98
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0042e810
mov ecx, eax
call fcn.0042e6e0
mov ecx, eax
call fcn.0042e6e0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x490220
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a6708
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x632f90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00489710
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], vtable.CryptoPP::QuotientRing_class_CryptoPP::EuclideanDomainOf_class_CryptoPP::PolynomialMod2__.0
mov edx, dword [ebp + 8]
add edx, 0xc
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.0048d700
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
add eax, 0x30
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004d3630
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x491650
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a68d0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x632f90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00427f80
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CryptoPP::BaseN_Decoder.0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], vtable.CryptoPP::BaseN_Decoder.1.0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x18], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1c], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x20], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x24], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], 0
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00412d70
mov byte [ebp - 4], 1
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00478bb0
lea eax, [ebp + 0xc]
push eax
call fcn.004a84b0
push eax
push 1
lea ecx, [ebp + 8]
push ecx
call fcn.0049fe30
push eax
lea edx, [ebp - 0x24]
push edx
call fcn.00481ca0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
call fcn.00474350
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004dfa40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00429410
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x49cd20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a7b55
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push esi
mov eax, dword [0x632f90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x34]
call fcn.004910e0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004bb260
mov esi, eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x30
call fcn.004bb260
add esi, eax
push esi
lea ecx, [ebp - 0x34]
call fcn.004b9d20
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004ab3a0
mov ecx, dword [ebp + 0x18]
push ecx
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.004ab3a0
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x34]
call fcn.004b9540
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x34]
call fcn.004b87f0
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
call edx
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0047fa20
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
call eax
mov ecx, dword [ebp - 0x18]
or ecx, 1
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.00457ee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00494c40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4a08c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a8295
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x632f90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x30]
call fcn.004910e0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004bb260
push eax
lea ecx, [ebp - 0x30]
call fcn.004b9d20
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.004ab3a0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x30]
call fcn.004b9540
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x30]
call fcn.004b87f0
mov eax, dword [eax]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
call eax
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.0047fa20
add esp, 0x10
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x14]
or eax, 1
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00457ee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00494c40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4cd100
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 8], 0
jmp 0x4cd119
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x4cd30c
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + 0x5c3a90]
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
shl eax, 3
movzx ecx, byte [ebp - 1]
sar ecx, 5
and ecx, 1
imul edx, ecx, 0x11b
xor eax, edx
movzx ecx, byte [ebp - 1]
sar ecx, 5
and ecx, 2
imul edx, ecx, 0x11b
xor eax, edx
movzx ecx, byte [ebp - 1]
sar ecx, 5
and ecx, 4
imul edx, ecx, 0x11b
xor eax, edx
movzx ecx, byte [ebp - 1]
shl ecx, 2
movzx edx, byte [ebp - 1]
sar edx, 6
and edx, 1
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [ebp - 1]
sar edx, 6
and edx, 2
imul edx, edx, 0x11b
xor ecx, edx
xor eax, ecx
movzx ecx, byte [ebp - 1]
xor eax, ecx
shl eax, 8
movzx edx, byte [ebp - 1]
shl edx, 3
movzx ecx, byte [ebp - 1]
sar ecx, 5
and ecx, 1
imul ecx, ecx, 0x11b
xor edx, ecx
movzx ecx, byte [ebp - 1]
sar ecx, 5
and ecx, 2
imul ecx, ecx, 0x11b
xor edx, ecx
movzx ecx, byte [ebp - 1]
sar ecx, 5
and ecx, 4
imul ecx, ecx, 0x11b
xor edx, ecx
movzx ecx, byte [ebp - 1]
xor edx, ecx
shl edx, 0x10
or eax, edx
movzx edx, byte [ebp - 1]
shl edx, 3
movzx ecx, byte [ebp - 1]
sar ecx, 5
and ecx, 1
imul ecx, ecx, 0x11b
xor edx, ecx
movzx ecx, byte [ebp - 1]
sar ecx, 5
and ecx, 2
imul ecx, ecx, 0x11b
xor edx, ecx
movzx ecx, byte [ebp - 1]
sar ecx, 5
and ecx, 4
imul ecx, ecx, 0x11b
xor edx, ecx
movzx ecx, byte [ebp - 1]
shl ecx, 2
movzx esi, byte [ebp - 1]
sar esi, 6
and esi, 1
imul esi, esi, 0x11b
xor ecx, esi
movzx esi, byte [ebp - 1]
sar esi, 6
and esi, 2
imul esi, esi, 0x11b
xor ecx, esi
xor edx, ecx
movzx ecx, byte [ebp - 1]
shl ecx, 1
movzx esi, byte [ebp - 1]
sar esi, 7
and esi, 1
imul esi, esi, 0x11b
xor ecx, esi
xor edx, ecx
shl edx, 0x18
or eax, edx
mov dword [ebp - 0xc], eax
movzx eax, byte [ebp - 1]
shl eax, 3
movzx edx, byte [ebp - 1]
sar edx, 5
and edx, 1
imul ecx, edx, 0x11b
xor eax, ecx
movzx edx, byte [ebp - 1]
sar edx, 5
and edx, 2
imul ecx, edx, 0x11b
xor eax, ecx
movzx edx, byte [ebp - 1]
sar edx, 5
and edx, 4
imul ecx, edx, 0x11b
xor eax, ecx
movzx edx, byte [ebp - 1]
shl edx, 1
movzx ecx, byte [ebp - 1]
sar ecx, 7
and ecx, 1
imul ecx, ecx, 0x11b
xor edx, ecx
xor eax, edx
movzx edx, byte [ebp - 1]
xor eax, edx
or eax, dword [ebp - 0xc]
xor edx, edx
mov cl, 0x20
call fcn.00526f80
mov ecx, eax
mov esi, edx
xor edx, edx
or ecx, dword [ebp - 0xc]
or esi, edx
movzx eax, byte [ebp - 1]
cdq
or ecx, eax
or esi, edx
mov eax, dword [ebp - 8]
mov dword [eax*8 + 0x643e90], ecx
mov dword [eax*8 + 0x643e94], esi
jmp 0x4cd110
mov byte [0x644691], 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4cd320
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
jmp 0x4cd338
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x4cd3c8
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + str.cw]
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
shl eax, 8
movzx ecx, byte [ebp - 1]
shl ecx, 0x10
or eax, ecx
movzx edx, byte [ebp - 1]
shl edx, 1
movzx ecx, byte [ebp - 1]
sar ecx, 7
and ecx, 1
imul ecx, ecx, 0x11b
xor edx, ecx
shl edx, 0x18
or eax, edx
mov dword [ebp - 0xc], eax
movzx eax, byte [ebp - 1]
shl eax, 1
movzx edx, byte [ebp - 1]
sar edx, 7
and edx, 1
imul ecx, edx, 0x11b
xor eax, ecx
movzx edx, byte [ebp - 1]
xor eax, edx
or eax, dword [ebp - 0xc]
xor edx, edx
mov cl, 0x20
call fcn.00526f80
xor ecx, ecx
or eax, dword [ebp - 0xc]
or edx, ecx
mov ecx, dword [ebp - 8]
mov dword [ecx*8 + 0x643680], eax
mov dword [ecx*8 + 0x643684], edx
jmp 0x4cd32f
mov edx, 8
imul eax, edx, 0x101
xor ecx, ecx
xor edx, edx
mov dword [eax + 0x643680], ecx
mov dword [eax + 0x643684], edx
mov eax, 8
shl eax, 8
xor ecx, ecx
xor edx, edx
mov dword [eax + 0x643680], ecx
mov dword [eax + 0x643684], edx
mov byte [0x644690], 1
mov esp, ebp
pop ebp
ret
Function at 0x4e1a80
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b043d
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x632f90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54], ecx
push 0xf0000000
push 1
push 0
push 0
mov eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4e1b01
push str.CryptAcquireContext
lea ecx, [ebp - 0x28]
call fcn.0040a7f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x50]
call fcn.004e1b70
push 0x620cf8
lea edx, [ebp - 0x50]
push edx
call fcn.00529aab
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a780
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00526f37
mov esp, ebp
pop ebp
ret
Function at 0x4ec400
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b165e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x632f90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov edi, dword [ebp + 8]
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov ebx, dword [ebp + 0x10]
mov eax, 0xaaaaaaab
push 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
lea ecx, [ebx*4]
mul ecx
mov ecx, edi
shr edx, 1
add edx, 3
push edx
call fcn.0041f390
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x4ec47f
mov ecx, dword [edi]
mov esi, dword [ebp + 0xc]
mov eax, 0xaaaaaaab
mul ebx
shr edx, 1
lea eax, [edx + edx*2]
sub ebx, eax
test edx, edx
je 0x4ec507
mov edi, edx
nop word [eax + eax]
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shr eax, 4
shl edx, 4
or edx, eax
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx edx, byte [esi + 1]
movzx eax, byte [esi + 2]
and edx, 0xf
shr eax, 6
shl edx, 2
or edx, eax
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
movzx eax, byte [esi + 2]
add esi, 3
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], al
add ecx, 4
sub edi, 1
jne 0x4ec4a0
mov edi, dword [ebp + 8]
sub ebx, 1
je 0x4ec554
sub ebx, 1
jne 0x4ec57f
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shr eax, 4
shl edx, 4
or edx, eax
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
and eax, 0xf
mov byte [ecx + 3], 0x3d
movzx eax, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
jmp 0x4ec57c
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi]
and eax, 3
mov word [ecx + 2], 0x3d3d
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
add ecx, 4
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x4ec589
mov eax, dword [edi]
sub ecx, eax
push 0
push ecx
mov ecx, edi
call fcn.0041f390
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4eef70
Capabilities:
Hash data using murmur3

Disassembly:
mov eax, dword [0x644cf8]
test eax, eax
je 0x4eef89
push eax
push 0
call fcn.004feb90
mov eax, dword [0x644cf8]
add esp, 8
mov edx, dword [0x628034]
xor ecx, ecx
push esi
push edi
mov edi, dword [0x628038]
test edi, edi
je 0x4ef014
mov esi, edx
nop
cmp dword [esi], 0
jne 0x4eefb0
inc ecx
add esi, 4
cmp ecx, edi
jb 0x4eefa0
jmp 0x4ef014
mov edi, dword [esi]
mov eax, dword [edi + 4]
mov ecx, dword [edi]
mov dword [esi], ecx
dec dword [0x62803c]
cmp dword [esi], 0
jne 0x4eefef
mov ecx, dword [0x628038]
xor edx, edx
shr eax, 6
div ecx
inc edx
cmp edx, ecx
jae 0x4eefed
mov eax, dword [0x628034]
lea esi, [eax + edx*4]
nop
cmp dword [esi], 0
jne 0x4eefef
inc edx
add esi, 4
cmp edx, ecx
jb 0x4eefe0
xor esi, esi
mov eax, dword [0x644d08]
push edi
test eax, eax
je 0x4eeffd
call eax
jmp 0x4ef002
call fcn.00550c3b
add esp, 4
test esi, esi
jne 0x4eefb0
mov eax, dword [0x644cf8]
mov edx, dword [0x628034]
pop edi
pop esi
test edx, edx
je 0x4ef035
mov eax, dword [0x644d08]
push edx
test eax, eax
je 0x4ef028
call eax
jmp 0x4ef02d
call fcn.00550c3b
mov eax, dword [0x644cf8]
add esp, 4
mov dword [0x628038], 0
mov dword [0x628034], 0
mov dword [0x62803c], 0
mov dword [0x628040], 0
mov dword [0x628044], 0xffffffff
test eax, eax
je 0x4ef07b
push eax
push 0
call fcn.004feba0
mov eax, dword [0x644cf8]
add esp, 8
mov dword [0x644ce4], 0
test eax, eax
je 0x4ef0a3
push 0
push eax
call fcn.004feb80
add esp, 8
mov dword [0x644cf8], 0
call fcn.004fef20
call fcn.004fe190
jmp 0x4fba90
push ebx
push esi
push edi
call fcn.004ff840
mov edx, dword [0x62c6d4]
xor eax, eax
test edx, edx
je 0x4fbb33
mov ecx, dword [0x62c6d0]
mov esi, ecx
cmp dword [esi], 0
jne 0x4fbabf
inc eax
add esi, 4
cmp eax, edx
jb 0x4fbab0
jmp 0x4fbb39
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [esi]
mov ecx, dword [edi + 4]
shr ecx, 0x10
xor ecx, dword [edi + 4]
imul ecx, ecx, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, dword [edi]
mov dword [esi], eax
dec dword [0x62c6d8]
cmp dword [esi], 0
jne 0x4fbb9a
mov eax, ecx
xor edx, edx
shr eax, 0x10
xor eax, ecx
mov ecx, dword [0x62c6d4]
div ecx
inc edx
cmp edx, ecx
jae 0x4fbb25
mov eax, dword [0x62c6d0]
lea esi, [eax + edx*4]
cmp dword [esi], 0
jne 0x4fbb9a
inc edx
add esi, 4
cmp edx, ecx
jb 0x4fbb14
push dword [edi + 8]
call ebx
push edi
call fcn.004ef3b0
add esp, 4
mov ecx, dword [0x62c6d0]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x4fbb49
push ecx
call fcn.004ef3b0
add esp, 4
mov eax, dword [0x644d48]
mov dword [0x62c6d4], 0
mov dword [0x62c6d0], 0
mov dword [0x62c6d8], 0
mov dword [0x62c6dc], 0
mov dword [0x62c6e0], 0xffffffff
test eax, eax
je 0x4fbb99
push 0
push eax
call fcn.004feb80
add esp, 8
mov dword [0x644d48], 0
ret
push dword [edi + 8]
call ebx
push edi
call fcn.004ef3b0
add esp, 4
test esi, esi
jne 0x4fbac5
jmp 0x4fbb33
Function at 0x4f2260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x14c], 0
je 0x4f228d
call fcn.004feb40
test eax, eax
je 0x4f228d
push dword [edi + 0x14c]
call fcn.004fec20
add esp, 4
test eax, eax
je 0x4f232b
push esi
mov esi, dword [esp + 0x10]
movzx eax, word [esi + 8]
test al, 1
jne 0x4f22ba
mov eax, dword [esi + 0x1c]
push 1
cdq
push edx
push eax
push esi
push 0x62a0c4
push str._s:__p_fd__I64d__not_on_queue__x
push 1
call fcn.004fdc30
add esp, 0x1c
pop esi
pop edi
ret
shr eax, 4
not eax
and eax, 1
sub dword [edi + 0x78], eax
and word [esi + 8], 0xfffe
mov ecx, dword [esi + 0x3c]
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x50000000
jne 0x4f2318
sar ecx, 0x14
movzx ecx, cl
cmp ecx, dword [edi + 0xb4]
jge 0x4f2318
mov eax, dword [edi + 0xb0]
mov edx, dword [eax + ecx*4]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
test ecx, ecx
je 0x4f230a
mov dword [ecx + 0x18], eax
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
pop esi
pop edi
mov dword [ecx], eax
ret
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
pop esi
pop edi
mov dword [ecx], eax
ret
lea eax, [edi + 0xd8]
push esi
push eax
call fcn.004ef550
add esp, 8
pop esi
pop edi
ret
push 0x629ff4
push 0x629ffc
push 0xcc8
push 0x62a030
push 0x62a038
push 0xdeaddead
call fcn.004fdc30
add esp, 0x18
push 0x62a05c
push 0x62a064
push 0xcc8
push 0x62a098
push 0x62a0a0
push 2
call fcn.00559d7d
add esp, 4
push eax
call fcn.004212e0
add esp, 0x18
call fcn.0055d4ee
int3
Function at 0x4f7ec0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov dword [esp + 0xc], 1
push edi
test esi, esi
je 0x4f7eda
movzx ecx, word [esi]
jmp 0x4f7edc
xor ecx, ecx
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4f7fe4
mov ebx, dword [esp + 0x24]
mov edx, 0x4000001
mov eax, ebx
and eax, 4
mov dword [esp + 0x2c], eax
mov eax, 0x84000001
push 0
cmove eax, edx
push eax
push ecx
call fcn.004fbcb0
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x4f7fe4
push 4
lea eax, [esp + 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
js 0x4f7fdb
test bl, 8
je 0x4f7f4c
push edi
call fcn.004f9830
add esp, 4
test eax, eax
js 0x4f7fdb
test bl, bl
jns 0x4f7f5d
push edi
call fcn.004f9840
add esp, 4
test eax, eax
js 0x4f7fdb
test bl, 0x40
je 0x4f7f6f
push edi
call fcn.004f9890
add esp, 4
test eax, eax
js 0x4f7fdb
test ebx, 0x100
je 0x4f7f84
push edi
call fcn.004f9850
add esp, 4
test eax, eax
js 0x4f7fdb
test esi, esi
je 0x4f7f98
push dword [esp + 0x30]
push esi
push edi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
js 0x4f7fdb
mov esi, dword [esp + 0x18]
test esi, esi
je 0x4f7fec
push esi
call fcn.00502420
add esp, 4
test eax, eax
je 0x4f7fec
call fcn.00502080
cmp dword [eax], 0
je 0x4f7fec
cmp dword [eax + 8], 0
je 0x4f7fec
push edi
push ebp
push ebx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push esi
call fcn.004f82e0
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x4f80b3
push edi
call fcn.004f9880
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
test ebp, ebp
jle 0x4f800d
push ebp
push edi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jns 0x4f801f
push edi
call fcn.004f9880
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
jns 0x4f801f
push 0x80
push edi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
js 0x4f7fdb
push 0x64
push 1
call fcn.004ef2c0
mov esi, eax
add esp, 8
test esi, esi
je 0x4f7fdb
mov eax, dword [esp + 0x1c]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov eax, 1
mov word [esi + 0x18], ax
xor eax, eax
mov dword [esi], 0x5c40e4
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], 0
test bl, 1
jne 0x4f806b
mov dword [esi + 0x1c], 0x4000000
mov eax, 0x4000000
cmp dword [esp + 0x2c], 0
je 0x4f807a
or eax, 0x80000000
mov dword [esi + 0x1c], eax
test bl, 0x10
je 0x4f808c
push 1
call fcn.004feb50
add esp, 4
mov dword [esi + 4], eax
push esi
push 0x4f8680
push 0x12
push edi
push dword [esp + 0x28]
lea eax, [esi + 0x24]
push eax
call fcn.004edd30
add esp, 0x18
test bl, 0x20
jne 0x4f80b3
push esi
call fcn.004f8100
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret