joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x439aea
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x439a7d
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.004391c0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x439a43
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x439bb3
call fcn.00439a8f
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x439b4a
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.004395e0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x439afb
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x439bb3
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.004395e0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x439bae
jmp 0x439bb3
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x43a8e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43a8fe
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x43a940
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43a95e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret
Function at 0x43a9a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43a9c2
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x43aa20
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43aa42
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x43aaa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43aaca
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret

Function at 0x43ab30
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43ab5a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x43abc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x43ac1f
Function at 0x43ac2e
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43ac10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x43aca0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x43acff

Function at 0x43ad0e
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43acf0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret
Function at 0x43d380
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x43d8a0
test edx, edx
je 0x43d8a0
call fcn.0043d397
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x43d8e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0043d380
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x43d951
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x43d916
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x43e260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x43e2e4
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x43e2bc
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x43e2c4
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.0043e2e9
Function at 0x44b9d6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov eax, ecx
mov edi, edx
push 0
push 0x14
mov dword [ebp - 4], edi
and dword [eax], 0
mov dword [ebp - 8], eax
call fcn.00449dfc
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x44ba00
push 7
pop eax
jmp 0x44ba78
cmp dword [0x63523c], 0
push ebx
je 0x44ba4a
mov eax, dword [0x635340]
test eax, eax
je 0x44ba1f
push 0xc8
call eax
pop ecx
test eax, eax
jne 0x44ba4a
mov eax, dword [ebp + 8]
lea ebx, [esi + 8]
mov dword [ebx], edi
lea edi, [esi + 4]
push edi
mov dword [esi + 0xc], eax
xor eax, eax
push eax
push esi
push 0x44b9b5
push eax
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x44ba59
jmp 0x44ba4d
lea ebx, [esi + 8]
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea edi, [esi + 4]
cmp dword [ebx], 0
pop ebx
jne 0x44ba71
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push dword [ebp + 8]
mov dword [edi], eax
call dword [ebp - 4]
pop ecx
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 8]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x44f8bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ecx + 8]
mov eax, edx
push edi
mov edi, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 4], eax
test edi, edi
jle 0x44f8ef
push ebx
mov ebx, dword [ecx]
mov al, byte [edx + eax]
xor byte [ebx + esi], al
lea eax, [esi + 1]
xor esi, esi
cmp eax, dword [ecx + 4]
cmovl esi, eax
mov eax, dword [ebp - 4]
inc edx
cmp edx, edi
jl 0x44f8d5
pop ebx
add dword [ecx + 0xc], edi
pop edi
mov dword [ecx + 8], esi
pop esi
leave
ret
Function at 0x470c92
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x631040]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov eax, ecx
mov ecx, dword [ebp + 8]
push esi
mov esi, edx
mov dword [esp + 0xc], ecx
push edi
xor edi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], ecx
test esi, esi
je 0x470dff
push edi
push 0x44
mov ecx, eax
call fcn.0044a313
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x470dfb
push dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [esp + 0x10]
call fcn.00470967
pop ecx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [ebx], eax
mov edx, dword [esi + 0x1c]
call fcn.00470aa0
pop ecx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x1c], eax
mov edx, dword [esi + 0x20]
call fcn.00470949
pop ecx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x20], eax
mov edx, dword [esi + 0x24]
call fcn.00470967
pop ecx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x24], eax
mov edx, dword [esi + 0x28]
call fcn.00470949
pop ecx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x28], eax
mov edx, dword [esi + 0x2c]
call fcn.00470967
mov edx, dword [esp + 0x18]
mov dword [ebx + 0x2c], eax
mov al, byte [esi + 4]
lea esi, [ebx + 0x30]
mov byte [ebx + 4], al
mov eax, dword [esp + 0x20]
pop ecx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x34], eax
mov dword [esi], edi
mov edx, dword [edx + 0x38]
call fcn.00470949
mov dword [ebx + 0x38], eax
mov eax, dword [esp + 0x18]
pop ecx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + 0x3c]
call fcn.00470949
pop ecx
mov ecx, dword [esp + 0x14]
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov eax, dword [ecx + 8]
or dword [ebx + 0x14], 0xffffffff
and eax, 0xffffffdf
or dword [ebx + 0x18], 0xffffffff
mov dword [ebx + 8], eax
mov ax, word [ecx + 6]
mov word [ebx + 6], ax
mov edx, dword [ecx + 0x40]
mov ecx, dword [esp + 0xc]
call fcn.0047089d
mov dword [ebx + 0x40], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x14]
mov dword [esp + 0x1c], ebx
mov dword [eax], ebx
mov eax, dword [esp + 0xc]
mov esi, dword [esi + 0x30]
mov dword [esp + 0x14], esi
test esi, esi
jne 0x470cd6
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004c233c
mov esp, ebp
pop ebp
ret
Function at 0x4a548d
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [0x631040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x118], 1
push 0x41
pop ecx
mov dword [ebp - 0x114], ebx
lea esi, [ebp - 0x118]
lea edi, [ebp - 0x21c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
rep movsd dword es:[edi], dword [esi]
push 0x41
pop ecx
lea esi, [ebp - 0x118]
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x320]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 1]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x118]
push eax
push edi
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jns 0x4a5519
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
je 0x4a54e6
test esi, esi
jne 0x4a551f
push 0xd
jmp 0x4a557c
test esi, esi
jle 0x4a557a
mov esi, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
lea eax, [ebp - 0x118]
push eax
push ebx
call esi
test eax, eax
jne 0x4a5545
lea eax, [ebp - 0x21c]
push eax
push ebx
call esi
test eax, eax
je 0x4a557a
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
xor esi, esi
push eax
push 0x1007
push 0xffff
push ebx
mov dword [ebp - 8], esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
js 0x4a5573
cmp dword [ebp - 8], esi
je 0x4a5576
push 2
pop esi
mov eax, esi
jmp 0x4a557d
push 2
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c233c
leave
ret

Function at 0x4a558c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x631040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov ebx, ecx
push edi
push eax
push eax
push eax
push eax
call fcn.004a53b7
add esp, 0x10
test eax, eax
jne 0x4a55b5
mov al, 1
jmp 0x4a55ee
jns 0x4a55c6
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 9
jne 0x4a55c6
xor al, al
jmp 0x4a55ee
lea eax, [ebp - 5]
push 2
push 1
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jns 0x4a55eb
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
lea eax, [ebp - 5]
je 0x4a55c9
test edi, edi
setg al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004c233c
leave
ret
Function at 0x4a5728
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x631040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 8]
push edi
push eax
push 0x8004667e
push dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 8], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push dword [esi + 0x10]
lea edi, [ebx + 4]
push dword [esi + 0x18]
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x4a57b0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4a578b
mov eax, dword [edi]
mov dword [eax], 2
xor al, al
jmp 0x4a5841
mov eax, dword [ebx + 0xc]
mov ecx, esi
push dword [eax + 4]
push dword [eax]
mov eax, dword [ebx + 8]
push dword [eax + 4]
push dword [eax]
call fcn.004a548d
mov ecx, dword [edi]
add esp, 0x10
mov dword [ecx], eax
mov eax, dword [edi]
cmp dword [eax], 0
jne 0x4a5784
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebx + 0x14]
push 0
push 0x3e8
push dword [eax + 4]
push dword [eax]
call fcn.005b7520
mov ecx, eax
mov eax, dword [ebx + 0x10]
push 4
imul eax, dword [eax], 0x3e8
add ecx, eax
lea eax, [ebp - 8]
push eax
push 0x1006
push 0xffff
push esi
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 8], ecx
call esi
mov eax, dword [ebx + 0x1c]
push 0
push 0x3e8
push dword [eax + 4]
push dword [eax]
call fcn.005b7520
mov ecx, eax
mov eax, dword [ebx + 0x18]
push 4
imul eax, dword [eax], 0x3e8
add ecx, eax
mov dword [ebp - 8], ecx
lea ecx, [ebp - 8]
push ecx
push 0x1005
push 0xffff
push dword [ebp + 8]
call esi
mov ecx, dword [edi]
mov al, 1
and dword [ecx], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c233c
leave
ret 8

Function at 0x4a5852
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x631040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x40c], eax
push 2
pop ecx
mov edi, edx
movzx eax, word [esi]
cmp ax, cx
je 0x4a5888
cmp eax, 0x17
jne 0x4a58f7
movzx eax, word [esi + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
movzx eax, ax
mov dword [ebx], eax
xor ebx, ebx
push 0x401
lea eax, [ebp - 0x408]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x408]
push 2
push ebx
push ebx
push 0x401
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x4a58f7
lea edx, [ebp - 0x408]
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4a58d7
mov ecx, dword [ebp - 0x40c]
lea eax, [ebp - 0x408]
sub edx, esi
push edx
push eax
call fcn.004a1528
mov al, 1
jmp 0x4a58f9
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c233c
leave
ret
Function at 0x4a7967
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov eax, SysReAllocString
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp edi, eax
mov ebx, dword [esi + 0x38]
cmova edi, eax
mov dword [ebp - 0x10], esi
mov eax, dword [esi + 0x34]
mov dword [ebp - 4], ecx
mov dword [ebp + 0xc], edi
cmp eax, ebx
jae 0x4a79ca
mov edx, dword [esi + 0x28]
sub ebx, eax
add eax, edx
cmp edi, ebx
ja 0x4a79b5
push edi
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [esi + 0x34], edi
mov eax, edi
jmp 0x4a7a59
push ebx
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [esi + 0x34], ebx
mov eax, ebx
jmp 0x4a7a59
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
test al, al
jne 0x4a79da
or eax, 0xffffffff
jmp 0x4a7a59
and dword [esi + 0x34], 0
and dword [esi + 0x38], 0
mov ecx, dword [esi + 4]
cmp edi, 0x1000
jae 0x4a7a4c
mov eax, dword [esi + 0x28]
mov edi, ecx
mov esi, eax
push 0
push 0x1000
push esi
push edi
call dword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test ebx, ebx
jns 0x4a7a16
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
je 0x4a79f4
test ebx, ebx
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 0xc]
jle 0x4a79c3
mov eax, dword [esi + 0x28]
cmp ebx, edi
jg 0x4a7a34
push ebx
push eax
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x4a79c3
push edi
push eax
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], ebx
jmp 0x4a79ae
mov edx, dword [ebp - 4]
push 0
push edi
call fcn.004a5387
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4ab6c5
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x631040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
lea esi, [ecx + 8]
mov dword [ebp - 0x20], eax
xor ebx, ebx
mov dword [ebp - 0x30], ecx
cmp dword [esi + 0x14], 0xf
mov eax, esi
push edi
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x28], ebx
jbe 0x4ab6fa
mov eax, dword [esi]
mov edi, dword [sym.imp.WS2_32.dll_inet_pton]
lea ecx, [ebp - 0x18]
push ecx
push eax
push 0x17
call edi
test eax, eax
je 0x4ab716
mov dword [ebp - 0x28], 0x10
jmp 0x4ab732
cmp dword [esi + 0x14], 0xf
jbe 0x4ab71e
mov esi, dword [esi]
lea eax, [ebp - 8]
push eax
push esi
push 2
call edi
test eax, eax
je 0x4ab739
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x24], 7
push ebx
push ebx
push 0x55
push dword [ebp - 0x20]
call fcn.004c3f40
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4ab817
push esi
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x1a], bl
call fcn.004c5370
mov dword [ebp - 0x34], eax
mov edi, ebx
pop ecx
test eax, eax
jle 0x4ab817
mov al, bl
test al, al
jne 0x4ab815
push edi
push esi
call fcn.004c5530
pop ecx
pop ecx
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
cmp dword [eax], ecx
jne 0x4ab7f5
push dword [eax + 4]
call fcn.004c4310
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
push dword [eax + 4]
call fcn.004c4320
pop ecx
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x24]
dec eax
sub eax, 1
je 0x4ab7e4
sub eax, 5
jne 0x4ab7fd
push dword [ebp - 0x28]
lea eax, [ebp - 0x18]
push dword [ebp - 0x20]
push eax
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x4ab7dd
push dword [ebp - 0x28]
lea eax, [ebp - 8]
push dword [ebp - 0x20]
push eax
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x4ab7fd
mov cl, 1
mov byte [ebp - 0x1a], cl
jmp 0x4ab800
push ecx
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x30]
call fcn.004ab831
mov byte [ebp - 0x19], al
jmp 0x4ab7f8
mov al, byte [ebp - 0x19]
mov cl, byte [ebp - 0x1a]
jmp 0x4ab803
mov cl, byte [ebp - 0x1a]
mov al, byte [ebp - 0x19]
inc edi
cmp edi, dword [ebp - 0x34]
jl 0x4ab76e
test al, al
jne 0x4ab815
test cl, cl
je 0x4ab817
mov bl, 1
push esi
call fcn.004c56b0
pop ecx
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c233c
leave
ret 4