joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484ed0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [eax + 0x38]
mov dl, byte [eax + 0x34]
push ebx
push ebp
push esi
xor esi, esi
test ecx, ecx
push edi
jle 0x484f0a
movzx edi, dl
mov ecx, dword [eax + 0x260]
mov ebx, ecx
shr ebx, 0x18
xor ebx, edi
mov ebp, dword [ebx*4 + 0x4bb678]
shl ecx, 8
xor ecx, ebp
mov dword [eax + 0x260], ecx
mov ecx, dword [eax + 0x38]
inc esi
cmp esi, ecx
jl 0x484ee3
mov ecx, dword [eax + 0x34]
mov bl, 1
mov byte [eax + ecx + 0x58], bl
mov ecx, dword [eax + 0x38]
mov esi, ecx
dec esi
je 0x484fae
dec esi
je 0x484f8a
dec esi
je 0x484f7e
mov byte [ecx + eax + 0x54], bl
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
inc ecx
mov dword [eax + 0x44], ecx
mov byte [ecx + esi], dl
mov ebp, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
inc ebp
mov dword [eax + 0x44], ebp
mov ecx, ebp
mov byte [ecx + esi], dl
mov ebx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
inc ebx
mov dword [eax + 0x44], ebx
mov ecx, ebx
mov byte [ecx + esi], dl
mov edi, dword [eax + 0x44]
mov dl, byte [eax + 0x38]
mov esi, dword [eax + 0x24]
inc edi
mov dword [eax + 0x44], edi
mov ecx, edi
sub dl, 4
mov byte [ecx + esi], dl
mov ecx, dword [eax + 0x44]
pop edi
pop esi
inc ecx
pop ebp
mov dword [eax + 0x44], ecx
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
inc dword [eax + 0x44]
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
mov esi, dword [eax + 0x44]
inc esi
mov dword [eax + 0x44], esi
mov ecx, esi
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
mov ecx, dword [eax + 0x44]
pop edi
pop esi
inc ecx
pop ebp
mov dword [eax + 0x44], ecx
pop ebx
ret
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [ecx + esi], dl
mov ecx, dword [eax + 0x44]
pop edi
pop esi
inc ecx
pop ebp
mov dword [eax + 0x44], ecx
pop ebx
ret

Function at 0x486160
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [sym.imp.MSVCR71.dll__iob]
push str.1.0.1__23_June_2000
push eax
add ecx, 0x40
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to_me_at:_jseward_acm.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks.__Julian_Seward__21_March_2000._n_n
push ecx
call dword [sym.imp.MSVCR71.dll_fprintf]
add esp, 0x10
push 3
call dword [sym.imp.MSVCR71.dll_exit]
int3
Function at 0x488150
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [eax + 0x25c]
test ecx, ecx
jle 0x48635c
push ebx
mov ecx, 0xfffffff8
push esi
mov esi, dword [eax + 0x4c]
mov bl, byte [eax + 0x25b]
mov edx, dword [eax + 0x2c]
mov byte [edx + esi], bl
mov edx, dword [eax + 0x4c]
mov esi, dword [eax + 0x25c]
mov ebx, dword [eax + 0x258]
inc edx
add esi, ecx
mov dword [eax + 0x4c], edx
shl ebx, 8
mov edx, esi
test edx, edx
mov dword [eax + 0x258], ebx
mov dword [eax + 0x25c], esi
jg 0x486321
pop esi
pop ebx
ret
push ebx
push ebp
mov ebp, dword [sym.imp.MSVCR71.dll_fprintf]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esi + 0x44]
xor ebx, ebx
cmp edi, ebx
jle 0x4881c3
mov edx, dword [esi + 0x264]
mov ecx, dword [esi + 0x260]
mov eax, edx
shr eax, 0x1f
add edx, edx
or eax, edx
mov edx, dword [esi + 0x26c]
not ecx
xor eax, ecx
cmp edx, 1
mov dword [esi + 0x260], ecx
mov dword [esi + 0x264], eax
jle 0x48819a
mov dword [esi + 0x4c], ebx
cmp dword [esi + 0x268], 2
jl 0x4881ba
push edi
push eax
mov eax, dword [sym.imp.MSVCR71.dll__iob]
push ecx
push edx
add eax, 0x40
push str.____block__d:_crc__0x_8x__combined_CRC__0x_8x__size___d_n
push eax
call ebp
add esp, 0x18
push esi
call fcn.0048c4a0
add esp, 4
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x44]
mov eax, dword [esi + 0x26c]
add ecx, edx
cmp eax, 1
mov dword [esi + 0x2c], ecx
jne 0x48821b
mov ecx, 0x42
mov edi, 8
mov eax, esi
mov dword [esi + 0x25c], ebx
mov dword [esi + 0x258], ebx
call fcn.00486360
mov ecx, 0x5a
call fcn.00486360
mov ecx, 0x68
call fcn.00486360
mov dl, byte [esi + 0x270]
add dl, 0x30
movzx ecx, dl
call fcn.00486360
cmp dword [esi + 0x44], ebx
jle 0x4882bd
mov ecx, 0x31
mov edi, 8
mov eax, esi
call fcn.00486360
mov ecx, 0x41
call fcn.00486360
mov ecx, 0x59
call fcn.00486360
mov ecx, 0x26
call fcn.00486360
mov ecx, 0x53
call fcn.00486360
mov ecx, 0x59
call fcn.00486360
mov ebx, dword [esi + 0x260]
mov ecx, ebx
shr ecx, 0x18
mov dword [esp + 0x14], ebx
call fcn.00486360
movzx ecx, byte [esp + 0x16]
call fcn.00486360
movzx ecx, bh
call fcn.00486360
mov ecx, ebx
and ecx, 0xff
call fcn.00486360
xor ecx, ecx
mov edi, 1
call fcn.00486360
mov ecx, dword [esi + 0x1c]
mov edi, 0x18
call fcn.00486360
call fcn.00486460
call fcn.00486630
mov al, byte [esp + 0x18]
test al, al
je 0x48836e
mov ecx, 0x17
mov edi, 8
mov eax, esi
call fcn.00486360
mov ecx, 0x72
call fcn.00486360
mov ecx, 0x45
call fcn.00486360
mov ecx, 0x38
call fcn.00486360
mov ecx, 0x50
call fcn.00486360
mov ecx, 0x90
call fcn.00486360
mov ebx, dword [esi + 0x264]
mov ecx, ebx
shr ecx, 0x18
mov dword [esp + 0x18], ebx
call fcn.00486360
movzx ecx, byte [esp + 0x1a]
call fcn.00486360
movzx ecx, bh
call fcn.00486360
mov ecx, ebx
and ecx, 0xff
call fcn.00486360
cmp dword [esi + 0x268], 2
jl 0x488363
mov eax, dword [esi + 0x264]
mov ecx, dword [sym.imp.MSVCR71.dll__iob]
push eax
add ecx, 0x40
push str.____final_combined_CRC__0x_x_n
push ecx
call ebp
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
jmp 0x486310
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x48c7f0
Capabilities:
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x49e458
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x74
mov eax, dword [0x4bc410]
xor eax, esp
push esi
mov esi, dword [esp + 0x88]
push edi
xor edi, edi
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 8], edi
mov dword [esp + 0x1c], 0x4ac054
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x28], 0x67452301
mov dword [esp + 0x2c], 0xefcdab89
mov dword [esp + 0x30], 0x98badcfe
mov dword [esp + 0x34], 0x10325476
mov ecx, dword [esp + 0x94]
push ecx
push eax
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x90], edi
call fcn.0048d334
add esp, 0xc
lea ecx, [esp + 0x1c]
call fcn.0048c610
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
push ecx
push esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
call fcn.0048c670
mov ecx, dword [esp + 0x88]
add esp, 0xc
pop edi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x74]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00496ace
add esp, 0x80
ret

Function at 0x48c8e0
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
mov dword [ecx + 0x18], 0xc3d2e1f0
ret

Function at 0x48cb40
Capabilities:
Hash data using sha1

Disassembly:
mov eax, ecx
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret
Function at 0x48e650
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x804
mov eax, dword [0x4bc410]
mov ecx, dword [esp + 0x808]
xor eax, esp
mov dword [esp + 0x800], eax
lea eax, [esp + 0x80c]
push eax
push ecx
lea edx, [esp + 8]
push 0x800
push edx
call dword [sym.imp.MSVCR71.dll__vsnprintf]
add esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.00496ace
add esp, 0x804
ret

Function at 0x48e6b0
Capabilities:
Get file version info

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push 0
push ebp
mov byte [esi + 3], 0
mov byte [esi + 2], 0
mov byte [esi + 1], 0
mov byte [esi], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [esp + 0x14], eax
je 0x48e74f
push edi
push eax
call sub.MFC71.DLL_operator_new
add esp, 4
mov edi, eax
mov eax, dword [esp + 0x18]
push edi
push eax
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x48e73f
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x10]
push edx
push 0x4a1f5c
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
push edi
je 0x48e740
mov eax, dword [esp + 0x10]
mov cl, byte [eax + 0xa]
mov byte [esi], cl
mov dl, byte [eax + 8]
mov byte [esi + 1], dl
mov cl, byte [eax + 0xe]
mov byte [esi + 2], cl
mov dl, byte [eax + 0xc]
mov byte [esi + 3], dl
call sub.MFC71.DLL_operator_delete
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
push edi
call sub.MFC71.DLL_operator_delete
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
pop esi
xor eax, eax
pop ebp
pop ecx
ret
Function at 0x48f180
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x49e4b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
lea ecx, [esp + 4]
call dword [0x49f754]
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push str.MachineInfo.cfg
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push eax
push 0
push 0x4ac424
push str.Nat_Info
call esi
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0
push str.nattype
push str.Nat_Info
call esi
mov edx, dword [esp + 0x20]
lea ecx, [esp + 4]
mov dword [edx], eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0
push str.testtime
push str.Nat_Info
call esi
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 8]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x48f490
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x49e522
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push 1
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Right]
push 0x4a1f5c
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Compare]
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [esp + 8]
inc bl
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
test bl, bl
je 0x48f51e
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
dec eax
push eax
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x24]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Left]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 1
call dword [0x49f214]
lea ecx, [esp + 8]
mov byte [esp + 0x14], 0
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
lea ecx, [esp + 0x1c]
je 0x48f554
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x10
ret
push 0x5c
call dword [sym.imp.MFC71.DLL_ATL::CStringT::ReverseFind]
cmp eax, 0xffffffff
je 0x48f5ae
push ecx
mov edx, esp
mov dword [esp + 0xc], esp
push eax
push edx
lea ecx, [esp + 0x28]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Left]
call fcn.0048f490
add esp, 4
push 0
lea ecx, [esp + 0x20]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [esp + 0x1c]
mov esi, eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x10
ret
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0xc]
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret
Function at 0x48f730
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
push 0x4ac4a8
push 1
push 0
push 0x4ac498
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [edi], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jge 0x48f776
push esi
push str.CoCreateInstance_failed:_0x_08lx_n
jmp 0x48f7aa
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push eax
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jge 0x48f793
push esi
push str.get_LocalPolicy_failed:_0x_08lx_n
jmp 0x48f7aa
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jge 0x48f7b3
push esi
push str.get_CurrentProfile_failed:_0x_08lx_n
call dword [sym.imp.MSVCR71.dll_printf]
add esp, 8
mov eax, dword [esp + 8]
test eax, eax
je 0x48f7c1
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x48f7cf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
mov eax, esi
pop esi
add esp, 8
ret 4
Function at 0x48fc60
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
push 0x17d0
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0x40000
call fcn.00492560
mov ebp, dword [esp + 0x38]
push 0xd4
push ebp
mov edi, eax
call fcn.00492580
mov esi, dword [esp + 0x3c]
add esp, 0xc
mov dword [edi + 0x20], eax
lea eax, [esp + 0x10]
push eax
push 0x8004667e
push esi
mov dword [edi], esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push 4
lea ecx, [esp + 0x18]
push ecx
push 0x1002
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
xor edx, edx
mov dword [esp + 0x1c], edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x24], edx
push ecx
mov dword [esp + 0x2c], edx
push esi
mov dword [esp + 0x24], 0x10
mov dword [esp + 0x34], edx
call dword [sym.imp.WS2_32.dll_getsockname]
xor ebx, ebx
cmp eax, 0xffffffff
jne 0x48fcff
mov word [edi + 8], bx
jmp 0x48fd0e
mov edx, dword [esp + 0x1e]
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [edi + 8], ax
mov esi, dword [edi + 0x20]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [edi + 0x24], ebp
imul ebp, ebp, 0xd4
add ebp, esi
cmp esi, ebp
mov dword [edi + 4], ebx
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x18], 0x578
mov dword [edi + 0x28], esi
mov dword [edi + 0x5b0], ebx
mov dword [edi + 0x7bc], ebx
mov dword [edi + 0x7c0], ebx
mov word [edi + 0x7c4], bx
mov dword [edi + 0x17c8], ebx
mov dword [edi + 0x17cc], ebx
jae 0x48fdfe
lea ebx, [ebx]
mov dword [esi], edi
mov eax, dword [edi + 0x20]
mov ecx, esi
sub ecx, eax
mov eax, 0x4d4873ed
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
lea ecx, [esi + 0xa4]
add eax, edx
push ecx
mov word [esi + 6], ax
mov dword [esi + 0x14], ebx
call fcn.004925b0
lea edx, [esi + 0xac]
push edx
call fcn.004925b0
lea eax, [esi + 0xb4]
push eax
call fcn.004925b0
lea ecx, [esi + 0xbc]
push ecx
call fcn.004925b0
lea edx, [esi + 0xc4]
push edx
call fcn.004925b0
lea eax, [esi + 0xcc]
push eax
call fcn.004925b0
push esi
call fcn.00490670
mov ecx, dword [edi + 0x24]
mov edx, dword [edi + 0x20]
imul ecx, ecx, 0xd4
add esi, 0xd4
add ecx, edx
add esp, 0x1c
cmp esi, ecx
jb 0x48fd70
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4923e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
push edi
push esi
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 0xc], eax
call fcn.00490bf0
add esp, 8
cmp eax, 0xffffffff
je 0x492544
cmp eax, 1
je 0x49253c
push ebx
push ebp
call fcn.00492600
mov ebx, dword [esp + 0x1c]
mov dword [0x4bdb38], eax
add ebx, eax
mov ebp, 2
sub eax, dword [esi + 0x14]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x3e8
jl 0x49243f
push esi
call fcn.00490040
add esp, 4
push 1
push edi
push esi
call fcn.00492110
add esp, 0xc
cmp eax, 0xffffffff
je 0x492510
cmp eax, 1
je 0x4924f0
push edi
call fcn.004918e0
add esp, 4
cmp eax, 0xffffffff
je 0x492526
cmp eax, 1
je 0x4924f0
push 1
push edi
push esi
call fcn.00492110
add esp, 0xc
cmp eax, 0xffffffff
je 0x492510
cmp eax, 1
je 0x4924f0
push edi
push esi
call fcn.00490bf0
add esp, 8
cmp eax, 0xffffffff
je 0x4924fa
cmp eax, 1
je 0x4924f0
call fcn.00492600
mov ecx, eax
cmp ecx, ebx
mov dword [0x4bdb38], ecx
jae 0x4924e9
mov eax, ebx
sub eax, ecx
mov ecx, dword [esi]
cdq
xor eax, edx
sub eax, edx
push eax
lea eax, [esp + 0x1c]
push eax
push ecx
mov dword [esp + 0x24], ebp
call fcn.00492760
add esp, 0xc
test eax, eax
jne 0x492508
call fcn.00492600
cmp dword [esp + 0x18], ebp
mov dword [0x4bdb38], eax
je 0x492427
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
ret
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
ret
push str.Error_dispatching_incoming_packets
call dword [sym.imp.MSVCR71.dll_perror]
add esp, 4
pop ebp
pop ebx
pop edi
or eax, 0xffffffff
pop esi
ret
push str.Error_sending_outgoing_packets
call dword [sym.imp.MSVCR71.dll_perror]
add esp, 4
pop ebp
pop ebx
pop edi
or eax, 0xffffffff
pop esi
ret
push str.Error_receiving_incoming_packets
call dword [sym.imp.MSVCR71.dll_perror]
add esp, 4
pop ebp
pop ebx
pop edi
or eax, 0xffffffff
pop esi
ret
pop edi
mov eax, 1
pop esi
ret
push str.Error_dispatching_incoming_packets
call dword [sym.imp.MSVCR71.dll_perror]
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret

Function at 0x492620
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x49264b
xor eax, eax
mov ax, word [esi + 4]
mov word [esp + 4], 2
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esi]
mov word [esp + 6], ax
mov dword [esp + 8], ecx
mov edx, esi
neg edx
push 0
sbb edx, edx
push 0
and edx, 0x10
push edx
mov edx, dword [esp + 0x30]
neg esi
sbb esi, esi
lea eax, [esp + 0x10]
and esi, eax
mov eax, dword [esp + 0x2c]
push esi
push 0
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSASendTo]
cmp eax, 0xffffffff
pop esi
jne 0x492699
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
add esp, 0x10
ret
Function at 0x4926b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x18
push esi
mov esi, dword [esp + 0x24]
push 0
push 0
mov eax, esi
neg eax
sbb eax, eax
lea ecx, [esp + 0x10]
and eax, ecx
push eax
mov edx, esi
neg edx
sbb edx, edx
lea eax, [esp + 0x18]
and edx, eax
mov eax, dword [esp + 0x38]
push edx
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x38]
push edx
mov edx, dword [esp + 0x38]
push eax
push ecx
push edx
mov dword [esp + 0x2c], 0x10
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
jne 0x492723
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
je 0x49271c
sub eax, 0x13
jne 0x49272b
xor eax, eax
pop esi
add esp, 0x18
ret
mov eax, dword [esp + 4]
test ah, ah
jns 0x492733
or eax, 0xffffffff
pop esi
add esp, 0x18
ret
test esi, esi
je 0x49274c
mov ecx, dword [esp + 0xe]
mov eax, dword [esp + 0x10]
push ecx
mov dword [esi], eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esi + 4], ax
mov eax, dword [esp + 0x24]
pop esi
add esp, 0x18
ret

Function at 0x492760
Capabilities:
Get socket status

Disassembly:
sub esp, 0x210
mov eax, dword [esp + 0x21c]
xor edx, edx
mov ecx, 0x3e8
div ecx
push esi
mov esi, dword [esp + 0x21c]
push edi
mov edi, dword [esp + 0x21c]
mov dword [esp + 0x114], 0
mov dword [esp + 0x10], 0
imul edx, edx, 0x3e8
mov dword [esp + 8], eax
mov eax, dword [esi]
test al, 1
mov dword [esp + 0xc], edx
je 0x4927b9
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 1
test al, 2
je 0x4927cf
mov dword [esp + 0x118], edi
mov dword [esp + 0x114], 1
lea edx, [esp + 8]
push edx
push 0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x120]
push ecx
lea edx, [edi + 1]
push edx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jge 0x4927fd
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x210
ret
test eax, eax
mov dword [esi], 0
je 0x49282e
lea eax, [esp + 0x10]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x492819
or dword [esi], 1
lea ecx, [esp + 0x114]
push ecx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x49282e
or dword [esi], 2
pop edi
xor eax, eax
pop esi
add esp, 0x210
ret
Function at 0x492880
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, 0x4bc38a
mov edi, 0x4bc38e
mov ebp, 0x4bc392
sub esi, ecx
sub edi, ecx
mov edx, 0x4bc388
lea eax, [ecx + 2]
sub ebp, ecx
mov cl, byte [edx + 3]
xor byte [eax - 2], cl
mov cl, byte [edx + 2]
xor byte [eax - 1], cl
mov ecx, dword [edx]
mov bl, byte [eax]
sar ecx, 8
xor bl, cl
mov byte [eax], bl
mov cl, byte [edx]
xor byte [eax + 1], cl
mov cl, byte [esi + eax + 3]
xor byte [eax + 2], cl
mov cl, byte [esi + eax + 2]
xor byte [eax + 3], cl
mov ecx, dword [esi + eax]
mov bl, byte [eax + 4]
sar ecx, 8
xor bl, cl
mov byte [eax + 4], bl
mov cl, byte [esi + eax]
xor byte [eax + 5], cl
mov cl, byte [edi + eax + 3]
xor byte [eax + 6], cl
mov cl, byte [edi + eax + 2]
xor byte [eax + 7], cl
mov ecx, dword [edi + eax]
mov bl, byte [eax + 8]
sar ecx, 8
xor bl, cl
mov byte [eax + 8], bl
mov cl, byte [edi + eax]
xor byte [eax + 9], cl
mov cl, byte [eax + ebp + 3]
xor byte [eax + 0xa], cl
mov cl, byte [eax + ebp + 2]
xor byte [eax + 0xb], cl
mov ecx, dword [eax + ebp]
mov bl, byte [eax + 0xc]
sar ecx, 8
xor bl, cl
mov byte [eax + 0xc], bl
mov cl, byte [eax + ebp]
xor byte [eax + 0xd], cl
add edx, 0x10
add eax, 0x10
cmp edx, 0x4bc3c8
jl 0x4928a1
pop edi
pop esi
pop ebp
pop ebx
ret