joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59c920
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x62c780
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x63e198
mov dword [esp + 0x10], 7
call fcn.0059c9f0
lea ecx, [esi + 0x40]
mov byte [esp + 0x10], 6
call fcn.00602ad6
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 5
call fcn.00401070
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 4
call fcn.00602ad6
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 3
call fcn.00602ad6
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 2
call fcn.00602ad6
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 1
call fcn.00602ad6
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 0
call fcn.00602ad6
add esi, 4
mov dword [esp + 4], esi
mov dword [esi], method.CCommandLineInfo.virtual_0
mov eax, dword [esi + 4]
mov dword [esp + 0x10], 8
test eax, eax
je 0x59c9dd
mov ecx, dword [esi + 8]
push ecx
push eax
call fcn.005fb998
mov edx, dword [esi + 4]
push edx
call fcn.005fef05
add esp, 4
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x59e030
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62c830
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov eax, dword [esi]
mov edi, dword [esi + 0x8c]
mov dword [ebp - 4], ebx
call dword [eax + 0x20]
mov eax, dword [esi + 0x31dc]
cmp dword [eax + 0x134], 2
jne 0x59e09f
cmp dword [esi + 0x54], ebx
jl 0x59e09f
jg 0x59e07e
cmp dword [esi + 0x50], ebx
jbe 0x59e09f
mov dword [esi + 0x8c], 7
mov dword [esi + 0x84], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 0x18
je 0x59e0a9
cmp edi, 0x15
jne 0x59e08e
cmp dword [esi + 0xd0], ebx
je 0x59e08e
cmp dword [eax + 0x140], 0x757b
jne 0x59e08e
mov ecx, esi
call fcn.005a4ca0
cmp eax, ebx
je 0x59e1b6
push str.OneKeyFrameBack_failed__Erase_outfile_n
mov ecx, esi
call fcn.0054c4f0
mov ecx, dword [esi + 0x90]
lea eax, [ebp - 0x28]
mov edx, dword [ecx + 0x60]
push edx
push str._dkf
push eax
call fcn.005e6db3
mov edx, dword [esi + 0x31dc]
add esp, 0xc
lea ecx, [ebp - 0x28]
mov eax, dword [edx + 0x104]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esi + 0x90]
mov edx, dword [ecx + 0x10]
lea ecx, [esi + 0x10]
push edx
call fcn.00554e50
mov ecx, dword [esi + 0x90]
mov dword [esi + 0x50], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x6c], ebx
mov eax, dword [ecx + 0x1c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
fild qword [ebp - 0x18]
cmp eax, ebx
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd8], ebx
fstp qword [esi + 0x31e0]
jne 0x59e179
mov eax, dword [esi + 0x31dc]
cmp ecx, dword [eax + 0xb0]
jne 0x59e179
push str.This_is_first_part__n
mov ecx, esi
call fcn.0054c4f0
mov byte [esi + 0x31f1], 1
mov byte [esi + 0x31f3], bl
jmp 0x59e180
mov byte [esi + 0x31f3], 1
mov byte [esi + 0x31f5], bl
mov byte [esi + 0x31f6], bl
mov dword [esi + 0x4a18], ebx
mov dword [esi + 0x4a1c], ebx
mov byte [esi + 0x31ed], bl
mov byte [esi + 0x31ec], bl
mov dword [esi + 0x3228], ebx
mov byte [esi + 0x31f9], bl
mov byte [esi + 0x31f8], bl
mov ecx, esi
mov byte [esi + 0xcd], 1
call fcn.00550790
mov edx, dword [esi]
lea eax, [esi + 0x31d8]
push eax
mov ecx, esi
call dword [edx + 0x18]
cmp eax, ebx
je 0x59e08e
mov ecx, dword [esi + 0x31dc]
cmp eax, 0x7569
mov dword [ecx + 0x140], eax
jne 0x59e08e
mov ecx, dword [esi + 0x31dc]
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x59e220
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62c848
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], ebx
call fcn.0059fb50
mov eax, dword [esi + 0x3208]
mov byte [esi + 0x31ed], bl
cmp eax, ebx
mov dword [esi + 0xd4], ebx
mov dword [esi + 0x49e4], ebx
mov byte [esi + 0x31f9], bl
mov byte [esi + 0xcd], bl
jne 0x59e28b
push 0x601
call fcn.005feedc
add esp, 4
mov dword [esi + 0x3208], eax
mov eax, dword [esi + 0x3208]
cmp eax, ebx
jne 0x59e2ab
mov eax, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [eax], 3
lea eax, [ebp - 0x24]
push eax
call fcn.005e7d47
mov ecx, dword [ebp - 0x24]
add esp, 4
push ecx
call sub.WS2_32.dll_htonl
mov edx, dword [esi + 0x3208]
mov edi, 9
mov dword [edx + 1], eax
mov eax, dword [esi + 0x3208]
add eax, 5
mov dword [eax], ebx
cmp edi, 0x600
jg 0x59e304
call fcn.005e8a1a
and eax, 0x800000ff
jns 0x59e2f7
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [esi + 0x3208]
inc edi
mov byte [ecx + edi - 1], al
jmp 0x59e2dc
mov edx, dword [esi + 0xb0]
cmp dword [edx + 0x24], 5
jne 0x59e32a
mov eax, dword [esi + 0x3208]
push 0x601
push eax
push str.send
mov ecx, esi
call fcn.0059f270
jmp 0x59e350
mov ecx, dword [esi + 0x3208]
mov edx, dword [esi + 0x31d8]
push str.send_handshake
push ebx
push 0x601
push ecx
push edx
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.0054c5b0
mov edi, eax
mov eax, dword [0x6cc708]
mov dword [ebp - 0x14], eax
push edi
lea ecx, [ebp - 0x14]
push str.sending_handshake__res___ld_n
push ecx
mov byte [ebp - 4], 1
call fcn.005fb90b
mov edx, dword [ebp - 0x14]
add esp, 0xc
mov ecx, esi
push edx
call fcn.0054c4f0
mov ecx, esi
mov dword [esi + 0x320c], ebx
mov dword [esi + 0x3210], ebx
mov byte [esi + 0x31ee], bl
mov byte [esi + 0x31ef], bl
call fcn.0054e940
lea ecx, [ebp - 0x14]
mov dword [esi + 0x8c], 0x14
mov byte [ebp - 4], bl
call fcn.00602ad6
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x59e4a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62c860
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x322c]
mov dword [ebp - 0x10], esp
test eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], 0
jne 0x59e502
push 0x3ff
call fcn.005e6c79
add esp, 4
mov edi, eax
mov ecx, 0xff
xor eax, eax
mov dword [ebx + 0x322c], edi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebx + 0x3238], 0x3ff
mov eax, dword [ebx + 0x3238]
mov ecx, dword [ebx + 0x322c]
push eax
push 0
push ecx
call fcn.005e7390
mov ecx, dword [ebx + 0x322c]
add esp, 0xc
sub eax, ecx
mov byte [ebp - 0x11], 0
mov edi, eax
mov dword [ebp - 0x1c], edi
mov edx, dword [ebx + 0x38c]
test edx, edx
jle 0x59e65f
mov ecx, dword [ebx + 0x388]
mov eax, 0x200
sub eax, ecx
mov esi, edx
cmp edx, eax
jl 0x59e54e
mov esi, eax
push esi
lea edx, [ecx + ebx + 0x323c]
push 0xa
push edx
call fcn.005e7390
add esp, 0xc
test eax, eax
je 0x59e57b
mov edx, dword [ebx + 0x388]
sub eax, ebx
sub eax, edx
sub eax, 0x323b
mov esi, eax
mov dword [ebp - 0x18], esi
jmp 0x59e57e
mov dword [ebp - 0x18], esi
mov eax, dword [ebx + 0x3238]
mov ecx, eax
sub ecx, edi
dec ecx
cmp esi, ecx
jl 0x59e5c7
mov edx, dword [ebx + 0x322c]
lea eax, [eax + esi + 1]
push eax
push edx
mov dword [ebx + 0x3238], eax
call fcn.005e7f27
add esp, 8
mov dword [ebx + 0x322c], eax
test eax, eax
jne 0x59e5c7
mov eax, 0x753b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x322c]
mov eax, dword [ebx + 0x388]
mov ecx, esi
add edi, edx
mov edx, ecx
lea esi, [ebx + eax + 0x323c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1c]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebx + 0x388]
mov edx, dword [ebx + 0x38c]
add eax, ecx
add esi, ecx
sub edx, ecx
mov ecx, dword [ebx + 0x322c]
mov dword [ebx + 0x388], esi
mov dword [ebx + 0x38c], edx
mov dword [ebp - 0x1c], eax
mov byte [eax + ecx], 0
mov edx, dword [ebx + 0x322c]
cmp byte [eax + edx - 1], 0xa
je 0x59e6e3
mov al, byte [ebp - 0x11]
test al, al
je 0x59e65f
mov eax, dword [ebx + 0x31d8]
push 0
push eax
mov ecx, ebx
call fcn.0054e130
test eax, eax
je 0x59e65f
mov eax, 0x7533
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 0x31d8]
lea edi, [ebx + 0x323c]
push 0
push 0x200
push edi
push ecx
call sub.WS2_32.dll_recv
mov esi, eax
push str.recv_next_line
push esi
mov ecx, ebx
call fcn.0054c5b0
cmp eax, 0x2733
jne 0x59e6a0
mov edx, dword [ebx + 0x31d8]
push 0
push 0x200
push edi
push edx
jmp 0x59e674
test eax, eax
jne 0x59e6e5
mov edi, dword [ebp - 0x1c]
mov dword [ebx + 0x388], eax
mov dword [ebx + 0x38c], esi
mov byte [ebp - 0x11], 1
jmp 0x59e52b
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x59ecf0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xor ebx, ebx
mov edi, 0x1f4
cmp dword [ebp + 0x343c], ebx
je 0x59ed1a
cmp byte [ebp + 0x3464], bl
je 0x59ed1a
mov byte [ebp + 0x3464], bl
mov byte [ebp + 0x3465], bl
mov al, byte [ebp + 0x3464]
mov byte [esp + 0x13], bl
cmp al, bl
je 0x59ed43
mov ecx, ebp
call fcn.0059eb50
cmp eax, ebx
jne 0x59ee13
mov byte [ebp + 0x3465], 1
mov byte [esp + 0x13], 1
cmp byte [ebp + 0x3465], bl
je 0x59ede5
cmp dword [ebp + 0x343c], ebx
je 0x59eddf
mov edx, dword [ebp + 0x38c]
cmp edx, ebx
jle 0x59ed86
mov ecx, dword [ebp + 0x388]
mov al, byte [ecx + ebp + 0x323c]
inc ecx
dec edx
mov byte [esp + 0x12], al
mov dword [ebp + 0x388], ecx
mov dword [ebp + 0x38c], edx
jmp 0x59edb5
mov ecx, dword [ebp + 0x31d8]
push ebx
lea eax, [esp + 0x16]
push 1
push eax
push ecx
call sub.WS2_32.dll_recv
mov esi, eax
push str.recv_byte
push esi
mov ecx, ebp
call fcn.0054c5b0
test eax, eax
jne 0x59eef5
mov al, byte [esp + 0x12]
cmp al, bl
jle 0x59edcf
cmp al, 0x22
jge 0x59edcf
movsx eax, al
lea edx, [eax + eax*8 + 0xc8]
mov dword [ebp + 0x344c], edx
jmp 0x59edd9
cmp al, 0x21
jle 0x59edd9
mov dword [ebp + 0x344c], edi
dec dword [ebp + 0x343c]
mov byte [ebp + 0x3465], bl
cmp dword [ebp + 0x343c], ebx
jne 0x59ee39
mov eax, dword [ebp + 0x38c]
mov byte [ebp + 0x3464], 1
cmp eax, ebx
mov dword [ebp + 0x3460], ebx
jg 0x59ecfe
cmp byte [esp + 0x13], bl
jne 0x59ee24
jmp 0x59ecfe
push eax
call sub.WS2_32.dll_WSASetLastError
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
push 0x2733
call sub.WS2_32.dll_WSASetLastError
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
mov eax, dword [ebp + 0x38c]
cmp eax, ebx
jle 0x59eea0
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
jl 0x59ee4d
mov eax, ecx
mov edx, dword [ebp + 0x388]
mov edi, dword [esp + 0x18]
mov ecx, eax
lea esi, [edx + ebp + 0x323c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x388]
mov edx, dword [ebp + 0x38c]
mov ecx, dword [ebp + 0x343c]
add esi, eax
sub edx, eax
sub ecx, eax
mov dword [ebp + 0x388], esi
pop edi
mov dword [ebp + 0x38c], edx
mov dword [ebp + 0x343c], ecx
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [ebp + 0x343c]
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
jl 0x59eeb0
mov eax, ecx
mov ecx, dword [ebp + 0x31d8]
push ebx
push eax
mov eax, dword [esp + 0x20]
push eax
push ecx
call sub.WS2_32.dll_recv
mov esi, eax
push str.rtmpt_recv
push esi
mov ecx, ebp
call fcn.0054c5b0
test eax, eax
jne 0x59eef5
mov eax, dword [ebp + 0x343c]
sub eax, esi
mov dword [ebp + 0x343c], eax
jne 0x59eef5
cmp dword [ebp + 0xd4], ebx
jbe 0x59eef5
mov ecx, ebp
call fcn.0059d220
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x59efd0
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push 0xffffffffffffffff
push 0x62c8b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x6cc708]
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 0xb0]
lea eax, [esp + 0x10]
xor ebx, ebx
mov edx, dword [ecx]
mov dword [esp + 0x20], ebx
push edx
push str.POST__fcs_ident2_HTTP_1.1_r_nContent_Type:_application_x_fcs_r_nUser_Agent:_Shockwave_Flash_r_nHost:__s_r_nContent_Length:_1_r_nConnection:_Keep_Alive_r_nCache_Control:_no_cache_r_n_r_n
push eax
call fcn.005fb90b
add esp, 0xc
mov ecx, esi
push str.Sending_RTMPT_ident_n
call fcn.0054c4f0
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0054c4f0
mov edx, dword [esp + 0x10]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push str.RTMPT_Ident
dec ecx
push ebx
push ecx
push edx
mov edx, dword [esi + 0x31d8]
push edx
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.0054c5b0
mov edi, eax
cmp edi, ebx
jne 0x59f0ea
mov ecx, dword [esi + 0x31d8]
push str.RTMPT_Ident_s2
push ebx
lea eax, [esp + 0x17]
push 1
push eax
push ecx
mov byte [esp + 0x23], bl
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.0054c5b0
mov byte [esi + 0x3464], 1
mov dword [esi + 0x343c], ebx
mov dword [esi + 0x38c], ebx
mov dword [esi + 0x8c], 0x1b
mov dword [esi + 0x3460], ebx
mov edx, dword [0x6cc708]
mov edi, eax
mov dword [esp + 0x14], edx
push edi
lea eax, [esp + 0x18]
push str.Send_res_ld_n
push eax
mov byte [esp + 0x2c], 1
call fcn.005fb90b
mov ecx, dword [esp + 0x20]
add esp, 0xc
push ecx
mov ecx, esi
call fcn.0054c4f0
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call fcn.00602ad6
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.00602ad6
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x59f110
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push 0xffffffffffffffff
push 0x62c8d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x6cc708]
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 0xb0]
lea eax, [esp + 0x10]
xor ebx, ebx
mov edx, dword [ecx]
mov dword [esp + 0x20], ebx
push edx
push str.POST__open_1_HTTP_1.1_r_nContent_Type:_application_x_fcs_r_nUser_Agent:_Shockwave_Flash_r_nHost:__s_r_nContent_Length:_1_r_nConnection:_Keep_Alive_r_nCache_Control:_no_cache_r_n_r_n
push eax
call fcn.005fb90b
add esp, 0xc
mov ecx, esi
push str.Sending_RTMPT_open_n
call fcn.0054c4f0
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0054c4f0
mov edx, dword [esp + 0x10]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push str.RTMPT_Connect
dec ecx
push ebx
push ecx
push edx
mov edx, dword [esi + 0x31d8]
push edx
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.0054c5b0
mov edi, eax
cmp edi, ebx
jne 0x59f23c
mov ecx, dword [esi + 0x31d8]
push str.RTMPT_Connect
push ebx
lea eax, [esp + 0x17]
push 1
push eax
push ecx
mov byte [esp + 0x23], bl
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.0054c5b0
mov dword [esi + 0x345c], ebx
mov byte [esi + 0x3464], 1
mov dword [esi + 0x343c], ebx
mov dword [esi + 0x38c], ebx
mov dword [esi + 0x8c], 0x19
mov dword [esi + 0x3454], ebx
mov dword [esi + 0x3458], ebx
mov dword [esi + 0x3460], ebx
mov edx, dword [0x6cc708]
mov edi, eax
mov dword [esp + 0x14], edx
push edi
lea eax, [esp + 0x18]
push str.Send_res_ld_n
push eax
mov byte [esp + 0x2c], 1
call fcn.005fb90b
mov ecx, dword [esp + 0x20]
add esp, 0xc
push ecx
mov ecx, esi
call fcn.0054c4f0
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call fcn.00602ad6
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.00602ad6
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x59f270
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push 0xffffffffffffffff
push 0x62c8e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x6cc708]
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esi + 0xb0]
mov ebx, dword [esp + 0x28]
mov eax, dword [esi + 0x345c]
push ebx
mov edx, dword [ecx]
mov ecx, dword [esi + 0x3450]
push edx
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
lea eax, [esp + 0x20]
push str.POST___s__s__ld_HTTP_1.1_r_nContent_Type:_application_x_fcs_r_nUser_Agent:_Shockwave_Flash_r_nHost:__s_r_nContent_Length:__ld_r_nConnection:_Keep_Alive_r_nCache_Control:_no_cache_r_n_r_n
push eax
mov dword [esp + 0x34], 0
call fcn.005fb90b
mov edi, dword [esi + 0x345c]
mov eax, dword [esp + 0x28]
add esp, 0x1c
inc edi
mov dword [esi + 0x345c], edi
mov ecx, dword [eax - 8]
push str.RTMPT_send
push 0
push ecx
mov ecx, dword [esi + 0x31d8]
push eax
push ecx
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.0054c5b0
mov edi, eax
test edi, edi
je 0x59f32d
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call fcn.00602ad6
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
mov edx, dword [esp + 0x24]
mov eax, dword [esi + 0x31d8]
push str.RTMPT_send
push 0
push ebx
push edx
push eax
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.0054c5b0
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x18], 0xffffffff
call fcn.00602ad6
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x5a07f0
Capabilities:
Enumerate pe sections
Receive data
Receive data on socket

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xb0]
mov dword [edi + 0x3220], 0
cmp dword [eax + 0x24], 5
jne 0x5a081b
lea ecx, [esp + 0xb]
push 1
push ecx
mov ecx, edi
call fcn.0059ecf0
jmp 0x5a0830
mov eax, dword [edi + 0x31d8]
push 0
lea edx, [esp + 0xf]
push 1
push edx
push eax
call sub.WS2_32.dll_recv
push str.recv_pheader_type
push eax
mov ecx, edi
call fcn.0054c5b0
mov ecx, eax
test ecx, ecx
je 0x5a0854
sub eax, 0x2733
pop edi
neg eax
sbb eax, eax
pop esi
and eax, ecx
pop ecx
ret 4
mov ecx, edi
call fcn.0054e940
mov cl, byte [esp + 0xb]
mov esi, dword [esp + 0x10]
mov al, cl
sar al, 6
and al, 3
and cl, 0x3f
mov byte [esi + 4], al
mov byte [esi + 6], cl
jne 0x5a087e
pop edi
or eax, 0xffffffff
pop esi
pop ecx
ret 4
cmp cl, 1
jne 0x5a088c
pop edi
or eax, 0xffffffff
pop esi
pop ecx
ret 4
and eax, 0xff
mov eax, dword [eax*4 + 0x63e19c]
cmp eax, 0xc
mov dword [edi + 0x49bc], eax
jne 0x5a08a7
mov byte [esi + 0x10], 1
cmp dword [edi + 0x49bc], 0xc
jge 0x5a090c
mov ecx, esi
call fcn.005a56f0
xor eax, eax
mov al, byte [esi + 6]
lea ecx, [eax + eax*4]
mov dl, byte [edi + ecx*8 + 0x349c]
lea eax, [edi + ecx*8 + 0x3498]
mov byte [esi + 4], dl
mov cl, byte [eax + 5]
mov byte [esi + 5], cl
mov dl, byte [eax + 6]
mov byte [esi + 6], dl
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
mov cl, byte [eax + 0x10]
mov byte [esi + 0x10], cl
mov edx, dword [eax + 0x14]
mov dword [esi + 0x14], edx
mov ecx, dword [eax + 0x18]
mov dword [esi + 0x18], ecx
mov edx, dword [eax + 0x1c]
mov dword [esi + 0x1c], edx
mov ecx, dword [eax + 0x20]
mov dword [esi + 0x20], ecx
mov dl, byte [eax + 0x24]
mov byte [esi + 0x24], dl
mov ecx, dword [edi + 0x49bc]
xor eax, eax
dec ecx
mov dword [edi + 0x49bc], ecx
lea ecx, [edi + 0x49c0]
mov dword [edi + 0x49c0], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [edi + 0x3214], eax
mov eax, dword [edi + 0x49bc]
mov dword [edi + 0x8c], 0x16
test eax, eax
jle 0x5a095a
mov ecx, edi
call fcn.0059e450
test eax, eax
je 0x5a095a
pop edi
xor eax, eax
pop esi
pop ecx
ret 4
push esi
mov ecx, edi
call fcn.005a0970
pop edi
pop esi
pop ecx
ret 4
Function at 0x5a0970
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x49bc]
test eax, eax
jle 0x5a0a08
mov ecx, dword [esi + 0xb0]
mov edx, dword [ecx + 0x24]
mov ecx, dword [esi + 0x3214]
cmp edx, 5
jne 0x5a09ab
sub eax, ecx
lea edx, [ecx + esi + 0x49c0]
push eax
push edx
mov ecx, esi
call fcn.0059ecf0
jmp 0x5a09c4
sub eax, ecx
push 0
push eax
lea eax, [ecx + esi + 0x49c0]
mov ecx, dword [esi + 0x31d8]
push eax
push ecx
call sub.WS2_32.dll_recv
mov edi, eax
push str.recv_pheader
push edi
mov ecx, esi
call fcn.0054c5b0
mov ecx, eax
test ecx, ecx
je 0x5a09ea
sub eax, 0x2733
pop edi
neg eax
sbb eax, eax
pop esi
and eax, ecx
pop ebx
ret 4
mov edx, dword [esi + 0x3214]
mov ecx, dword [esi + 0x49bc]
add edx, edi
mov eax, edx
mov dword [esi + 0x3214], edx
cmp eax, ecx
jne 0x5a0b77
mov ecx, esi
call fcn.0054e940
mov eax, dword [esi + 0x49bc]
mov edi, dword [esp + 0x10]
xor bl, bl
cmp eax, 3
jl 0x5a0ae8
lea edx, [esi + 0x49c0]
push edx
call fcn.0059f800
mov dword [edi + 8], eax
mov eax, dword [esi + 0x49bc]
add esp, 4
cmp eax, 6
jl 0x5a0a73
lea eax, [esi + 0x49c3]
push eax
call fcn.0059f800
add esp, 4
mov ecx, edi
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], 0
call fcn.005a56f0
cmp dword [esi + 0x49bc], 6
jle 0x5a0a73
mov cl, byte [esi + 0x49c6]
mov byte [edi + 5], cl
cmp dword [esi + 0x49bc], 0xb
jne 0x5a0a8e
lea edx, [esi + 0x49c7]
push edx
call fcn.00576660
add esp, 4
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0xffffff
jne 0x5a0ae8
mov eax, dword [esi + 0xb0]
cmp dword [eax + 0x24], 5
jne 0x5a0ab3
lea ecx, [esp + 0x10]
push 4
push ecx
mov ecx, esi
call fcn.0059ecf0
jmp 0x5a0ac8
mov eax, dword [esi + 0x31d8]
push 0
lea edx, [esp + 0x14]
push 4
push edx
push eax
call sub.WS2_32.dll_recv
cmp eax, 4
je 0x5a0ad6
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret 4
lea ecx, [esp + 0x10]
push ecx
call fcn.0059f830
add esp, 4
mov dword [edi + 0x14], eax
mov bl, 1
xor eax, eax
xor cl, cl
mov al, byte [edi + 5]
add eax, 0xfffffff8
cmp eax, 0xe
ja case.0x5a0aff.9
xor edx, edx
mov dl, byte [eax + 0x5a0b88]
jmp dword [edx*4 + 0x5a0b80]
mov cl, 1
test bl, bl
jne 0x5a0b12
mov eax, dword [edi + 8]
mov dword [edi + 0x14], eax
mov al, byte [edi + 0x10]
test al, al
jne 0x5a0b2d
xor edx, edx
mov dl, byte [edi + 6]
mov eax, dword [esi + edx*4 + 0x4898]
mov edx, dword [edi + 0x14]
add edx, eax
mov dword [edi + 0x14], edx
test cl, cl
je 0x5a0b54
mov ecx, esi
mov dword [esi + 0x8c], 0x18
call fcn.0059e450
test eax, eax
jne 0x5a0b77
push edi
mov ecx, esi
call fcn.005a0ba0
pop edi
pop esi
pop ebx
ret 4
mov ecx, esi
mov dword [esi + 0x8c], 0x17
call fcn.0059e450
test eax, eax
jne 0x5a0b77
push edi
mov ecx, esi
call fcn.005a2f70
pop edi
pop esi
pop ebx
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
ret 4