joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480990
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x61194c]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x4809a3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x4809e4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x6119f4]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x480a16
mov bl, byte [esp + ecx + 0x4c]
jmp 0x480a1a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x480a0b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x480a38
mov bl, byte [esp + ecx + 0x4c]
jmp 0x480a3c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x480a2d
xor ecx, ecx
mov eax, 0x61195c
xor ebx, ebx
mov bl, byte [ecx + 0x611a04]
cmp byte [esp + ebx + 0x14], 0
je 0x480a67
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x611a1c]
cmp byte [esp + ebx + 0x14], 0
je 0x480a7e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x480a4e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x4809d7
lea edx, [esp + 0x84]
push edx
call fcn.00480ac0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x499c39
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x499c71
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00497cc6
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00497c9e
jmp 0x499c7d
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x49b32a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x49b36c
call fcn.004a10a9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x49b36c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x49b363
xor eax, eax
jmp 0x49b374
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0049b37a
pop edi
pop esi
pop ebx
ret 4

Function at 0x4a15d9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a1607
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a1625
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a153f
jmp 0x4a1625
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a1625
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a153f
test edi, edi
mov eax, edi
jne 0x4a160f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x405650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, dword [ebp + 0x1c]
cmp dword [esi + 0x34], 0
push edi
mov edi, eax
je 0x4056f9
cmp dword [esi + 0x28], 0
je 0x405722
sub edi, dword [ebp + 0x10]
mov eax, dword [esi + 0x28]
cmp edi, eax
jae 0x43a6c2
sub eax, dword [esi + 0x30]
push ebx
mov ebx, edi
cmp eax, edi
jbe 0x4056bd
mov ecx, dword [ebp + 0xc]
mov edx, dword [esi + 0x34]
add edx, dword [esi + 0x30]
push ebx
sub ecx, edi
push ecx
push edx
call fcn.0041b050
add esp, 0xc
sub edi, ebx
jne 0x4056c1
add dword [esi + 0x30], ebx
mov ecx, dword [esi + 0x30]
mov eax, dword [esi + 0x28]
cmp ecx, eax
je 0x4056e4
mov ecx, dword [esi + 0x2c]
cmp ecx, eax
jb 0x4056ed
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
ret
mov ebx, eax
jmp 0x405688
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi + 0x34]
push edi
sub eax, edi
push eax
push ecx
call fcn.0041b050
mov edx, dword [esi + 0x28]
add esp, 0xc
pop ebx
mov dword [esi + 0x30], edi
pop edi
mov dword [esi + 0x2c], edx
pop esi
xor eax, eax
pop ebp
ret
mov dword [esi + 0x30], 0
jmp 0x4056af
add ecx, ebx
pop ebx
pop edi
mov dword [esi + 0x2c], ecx
pop esi
xor eax, eax
pop ebp
ret
mov ecx, dword [esi + 0x24]
mov edx, dword [ebp + 0x20]
mov eax, 1
shl eax, cl
mov ecx, dword [ebp + 0x28]
push 1
push eax
push ecx
call edx
add esp, 0xc
mov dword [esi + 0x34], eax
test eax, eax
jne 0x405666
jmp 0x43a6b9
mov ecx, dword [esi + 0x24]
mov eax, 1
shl eax, cl
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], eax
jmp 0x405670
lds esi, [edi + 0xe91605]
push ebx
mov ecx, dword [0x5300e91c]
dec eax
push eax
push ebp
push ecx
call 0xe841d9db
pop edi
les ecx, [ebx + esi]
adc al, 0
out dx, eax
insb byte es:[edi], dx
sahf
insb byte es:[edi], dx
and al, 0x18
mov eax, dword [ebx - 0x2c6f74ff]
je 0x413932
jae 0x41394c
xor ecx, dword [ecx - 0x6bf98af9]
sub ecx, eax
mov eax, dword [ebx + eax*8 + 0x33]
rol bl, 0x89
mov dword [ecx + 0x28282444], ecx
sub byte [eax], ch
dec esp
add dword [eax], eax
dec ebx
add byte [edi], cl
mov bh, 0xd
adc al, 0xe9
dec ebx
add byte [edi], cl
mov bh, 0xc0
movzx eax, ax
inc eax
cmp eax, ecx
jl 0x43a6cc
mov eax, ecx
mov word [0x4be910], ax
mov edx, dword [0x4be910]
dec edx
movzx esi, dx
mov dh, 0xcc
jbe 0x413908
movzx edi, si
movzx eax, word [0x4be916]
mov ecx, dword [0x4be91c]
lea edx, [edi - 1]
imul edx, eax
add edx, ecx
push edx
mov edx, edi
imul edx, eax
add edx, ecx
push edx
call dword [0x8b57c320]
add esi, 0xc3000000
dec edi
mov dh, 0xcc
ja 0x43a6e8
jmp 0x413908

Function at 0x405750
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
not eax
test esi, esi
je 0x405769
lea esp, [esp]
test cl, 3
jne 0x43abbc
push ebx
push edi
cmp esi, 0x20
jb 0x40599b
mov edi, esi
shr edi, 5
lea esp, [esp]
popfd
std
inc dword [eax + 0x1febb]
ret

Function at 0x414f2c
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1024547c], 0x24
lds ecx, [ebx + 0x57000c3d]
mov esi, dword [ebx + eax*2 - 0x5f]
adc byte [esp + 0x10], 0x56
je 0xc14c6017
test eax, eax
je 0x414f35
push 0xffffffffffffffff
Function at 0x44795c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
lea eax, [ebp - 0x1c]
push eax
call dword [0x8b57c2f4]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [0x8b57c2fc]
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
shr eax, 0x10
shl esi, 0x10
or esi, eax
call dword [0x8b57c2f8]
xor esi, eax
push esi
call fcn.0041d84a
pop ecx
xor esi, esi
call fcn.0041d85c
movzx eax, ax
mov ecx, eax
shr ecx, 8
xor cl, al
mov eax, dword [ebp + 8]
mov byte [esi + eax], cl
inc esi
cmp esi, 0x10
jl 0x44799a
pop esi
leave
ret

Function at 0x44a98e
Capabilities:
Unmount volume via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov bl, byte [ebp + 8]
push esi
push edi
mov ecx, 0x4a5264
mov esi, ecx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
lea edi, [ebp - 9]
stosb byte es:[edi], al
push ecx
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 8], 0xc3000001
call dword [0x8b57c320]
mov edi, dword [ebp + 0xc]
xor esi, esi
push esi
push 0x20008400
push 3
push esi
push 3
push 0xc0008400
lea eax, [ebp - 0x10]
add bl, 0x61
push eax
mov byte [ebp - 0xc], bl
mov dword [edi], esi
call dword [0x8b57c31c]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x44a9fe
call dword [0x49c314]
mov dword [edi], eax
xor eax, eax
jmp 0xc8aa96
mov ebx, dword [0x8b57c104]
push esi
lea ecx, [ebp - 4]
push ecx
push esi
push esi
push esi
push esi
push 0x90018
push eax
call ebx
test eax, eax
jne 0x44aa1c
mov dword [ebp - 8], esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push esi
push 0x8000e004
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x44aa46
call dword [0x49c314]
push dword [ebp + 8]
mov dword [edi], eax
call dword [0x8b57c30c]
jmp 0x44a9f7
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push esi
push 0x90020
push dword [ebp + 8]
call ebx
test eax, eax
je 0x44aa33
cmp dword [ebp - 8], esi
je 0x44aa75
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push esi
push 0x9001c
push dword [ebp + 8]
call ebx
push dword [ebp + 8]
call dword [0x8b57c30c]
push esi
lea eax, [ebp - 0xc]
push eax
push 2
call dword [0x49c138]
test eax, eax
je 0x44a9ef
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44e62b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
lea eax, [ebp - 0x18]
push eax
xor edi, edi
call dword [0x8b57c2f4]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [0x8b57c2fc]
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 8]
shr eax, 0x10
shl esi, 0x10
or esi, eax
call dword [0x8b57c2f8]
xor esi, eax
push esi
call fcn.0041d84a
pop ecx
push 4
pop esi
call fcn.0041d85c
movzx eax, ax
mov ecx, eax
shr ecx, 8
movzx ecx, cl
movzx eax, al
xor ecx, eax
shl edi, 8
add edi, ecx
dec esi
jne 0x44e66d
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x4cf55b]
shl eax, 2
mov dword [0x4cf55f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004bb290
pop edx
call fcn.004bb1f4
call fcn.004bb2d0
push 0
call fcn.004bc4f4
pop ecx
push 0x4cf504
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4cf563], eax
push 0
jmp fcn.004c1780

Function at 0x408784
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, edx
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
mov eax, dword [0x4f0650]
mov eax, dword [eax]
call fcn.0047bbb0
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp esi, eax
jge 0x40878f
pop esi
pop ebx
ret
Function at 0x43811c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x438258
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x438270
mov dl, 4
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_TimerOn_qqrv
xor edx, edx
push ebp
push 0x43823b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
jne 0x4381da
test si, si
jne 0x43818c
mov eax, dword [ebp - 8]
call fcn.004b132c
mov esi, eax
cmp esi, 0xffff
jbe 0x43818c
call fcn.004b7aa0
movzx ebx, si
push 0
push ebx
movzx eax, si
sub eax, ebx
mov edx, dword [ebp - 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.WSOCK32.DLL_send
test eax, eax
je 0x4381da
cmp eax, 0xffffffff
jle 0x4381bb
sub ebx, eax
jmp 0x4381ca
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_ErrorManager_qqrus
test ebx, ebx
je 0x4381da
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x43818f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x438225
mov eax, dword [ebp - 4]
mov byte [eax + 0x10088], 0
mov ecx, 0x438288
mov dl, 1
mov eax, dword [sym.RouletteGroup.exe__Psock_EAbortError_]
call fcn.004b35b8
call fcn.004b82b8
mov eax, dword [ebp - 4]
cmp word [eax + 0x10282], 0
je 0x438225
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438242
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_TimerOff_qqrv
ret
Function at 0x43839c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x438532
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x438548
lea edx, [ebp - 0xc]
movzx eax, si
call fcn.004b0f6c
push dword [ebp - 0xc]
push 0x438558
lea eax, [ebp - 8]
mov edx, 3
call fcn.004b8afc
mov ecx, dword [ebp - 8]
mov dl, 8
mov eax, ebx
call sym.RouletteGroup.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
test si, si
jne 0x43843d
push 2
push 0x10000
lea eax, [ebx + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.WSOCK32.DLL_recv
cmp eax, 0xffffffff
jne 0x43842c
lea ecx, [ebp - 0x10]
mov dx, 0x2733
mov eax, ebx
call sym.RouletteGroup.exe__Psock_TPowersock_ErrorManager_qqrus
mov eax, dword [ebp - 4]
call fcn.004b87bc
jmp 0x438493
mov esi, eax
cmp esi, 0xffff
jbe 0x438493
call fcn.004b7aa0
jmp 0x438493
push 2
push 0x10000
lea eax, [ebx + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.WSOCK32.DLL_recv
movzx edx, si
cmp eax, edx
jge 0x438493
test eax, eax
jne 0x43846d
mov eax, dword [ebp - 4]
call fcn.004b87bc
jmp 0x438517
inc eax
jne 0x43847e
lea ecx, [ebp - 0x14]
mov dx, 0x2733
mov eax, ebx
call sym.RouletteGroup.exe__Psock_TPowersock_ErrorManager_qqrus
mov eax, dword [0x4f0650]
mov eax, dword [eax]
call fcn.0047bbb0
cmp byte [ebx + 0x10088], 0
je 0x43843d
cmp byte [ebx + 0x10088], 0
jne 0x4384e2
movzx edi, si
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004b8d70
push 0
push edi
mov eax, dword [ebp - 4]
call fcn.004b8c0c
mov edx, 1
dec edx
cmp edx, dword [eax - 4]
jb 0x4384c4
call fcn.004b7aa0
inc edx
lea eax, [eax + edx - 1]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.WSOCK32.DLL_recv
mov edx, dword [ebp - 4]
xchg edx, eax
call fcn.004b8d70
jmp 0x438517
mov byte [ebx + 0x10088], 0
mov ecx, 0x438564
mov dl, 1
mov eax, dword [sym.RouletteGroup.exe__Psock_EAbortError_]
call fcn.004b35b8
call fcn.004b82b8
cmp word [ebx + 0x10282], 0
je 0x438517
mov edx, ebx
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438539
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004b87e0
ret
Function at 0x438950
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004b8bf0
xor eax, eax
push ebp
push 0x438b0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x438b24
mov dl, 8
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
push 0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4a2b98]
call fcn.004a61c0
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x438a9d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
jne 0x438a61
mov eax, dword [ebp - 4]
lea edx, [eax + 0x24]
mov ecx, 0x10000
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov esi, eax
mov ebx, esi
push 0
push ebx
mov eax, esi
sub eax, ebx
cmp eax, 0x10000
jbe 0x4389e5
call fcn.004b7aa0
mov edx, dword [ebp - 4]
lea eax, [edx + eax + 0x24]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.WSOCK32.DLL_send
test eax, eax
je 0x438a61
cmp eax, 0xffffffff
jle 0x438a32
sub ebx, eax
mov edx, dword [ebp - 4]
add dword [edx + 0x10084], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0x100c2], 0
je 0x438a41
mov edi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [edi + 0x100c4]
call dword [edi + 0x100c0]
jmp 0x438a41
lea ecx, [ebp - 0x10]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_ErrorManager_qqrus
mov eax, dword [0x4f0650]
mov eax, dword [eax]
call fcn.0047bbb0
test ebx, ebx
je 0x438a61
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x4389d2
mov eax, dword [ebp - 0xc]
call fcn.004a5f0c
mov ebx, eax
mov eax, dword [ebp - 0xc]
call fcn.004a5f28
cmp ebx, eax
je 0x438a87
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x4389ab
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438aa4
mov eax, dword [ebp - 0xc]
call fcn.004b7b60
ret
Function at 0x438b4c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x438ccd
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x438ce4
mov dl, 8
mov eax, ebx
call sym.RouletteGroup.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004a5f1c
cmp byte [ebx + 0x10088], 0
jne 0x438c79
xor eax, eax
mov dword [ebx + 0x10084], eax
mov eax, dword [ebp - 4]
call fcn.004a5f28
mov dword [ebx + 0x100b0], eax
mov eax, dword [ebp - 4]
call fcn.004a5f28
push eax
mov eax, dword [ebp - 4]
call fcn.004a5f0c
pop edx
xchg edx, eax
sub eax, edx
cmp eax, 0x10000
jle 0x438bc8
mov eax, 0x10000
lea edx, [ebx + 0x24]
mov ecx, eax
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 4]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
push 0
push esi
mov eax, dword [ebp - 8]
sub eax, esi
cmp eax, 0x10000
jbe 0x438bef
call fcn.004b7aa0
lea eax, [ebx + eax + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.WSOCK32.DLL_send
test eax, eax
je 0x438cb7
test eax, eax
jle 0x438c2f
sub esi, eax
add dword [ebx + 0x10084], eax
cmp word [ebx + 0x100c2], 0
je 0x438c3d
mov edx, ebx
mov eax, dword [ebx + 0x100c4]
call dword [ebx + 0x100c0]
jmp 0x438c3d
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, ebx
call sym.RouletteGroup.exe__Psock_TPowersock_ErrorManager_qqrus
mov eax, dword [0x4f0650]
mov eax, dword [eax]
call fcn.0047bbb0
test esi, esi
je 0x438c56
cmp byte [ebx + 0x10088], 0
je 0x438bdb
mov eax, dword [ebp - 4]
call fcn.004a5f28
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004a5f0c
cmp esi, eax
je 0x438c79
cmp byte [ebx + 0x10088], 0
je 0x438ba7
cmp byte [ebx + 0x10088], 0
je 0x438cb7
mov byte [ebx + 0x10088], 0
mov ecx, 0x438cf8
mov dl, 1
mov eax, dword [sym.RouletteGroup.exe__Psock_EAbortError_]
call fcn.004b35b8
call fcn.004b82b8
cmp word [ebx + 0x10282], 0
je 0x438cb7
mov edx, ebx
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438cd4
lea eax, [ebp - 0xc]
call fcn.004b87bc
ret
Function at 0x438d0c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004b8bf0
xor eax, eax
push ebp
push 0x438ea2
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x438eb8
mov dl, 8
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x100b4], edx
push 1
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4a2b98]
call fcn.004a61c0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x438e32
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004a5f28
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004a5f1c
jmp 0x438e00
push 0
push 0x10000
mov eax, dword [ebp - 4]
add eax, 0x24
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.WSOCK32.DLL_recv
mov ebx, eax
test ebx, ebx
jle 0x438de2
mov eax, dword [ebp - 4]
lea edx, [eax + 0x24]
mov ecx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004a5f98
mov eax, dword [ebp - 4]
add dword [eax + 0x100b4], ebx
mov eax, dword [ebp - 4]
cmp word [eax + 0x100ba], 0
je 0x438df4
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x100bc]
call dword [ebx + 0x100b8]
jmp 0x438df4
inc ebx
jne 0x438df4
lea ecx, [ebp - 0x10]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_ErrorManager_qqrus
mov eax, dword [0x4f0650]
mov eax, dword [eax]
call fcn.0047bbb0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10290], 0
je 0x438e1c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x438d84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438e39
mov eax, dword [ebp - 0xc]
call fcn.004b7b60
ret
Function at 0x438ee0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004b8bf0
xor eax, eax
push ebp
push 0x4390b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x4390cc
mov dl, 8
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x100b4], edx
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_TimerOn_qqrv
xor eax, eax
push ebp
push 0x439091
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4a2b98]
call fcn.004a61c0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x439029
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x439003
push 0
push 0x10000
mov eax, dword [ebp - 4]
add eax, 0x24
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.WSOCK32.DLL_recv
mov ebx, eax
test ebx, ebx
jle 0x438fc7
mov eax, dword [ebp - 4]
lea edx, [eax + 0x24]
mov ecx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004a5f98
mov eax, dword [ebp - 4]
add dword [eax + 0x100b4], ebx
mov eax, dword [ebp - 4]
cmp word [eax + 0x100ba], 0
je 0x438fbf
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x100bc]
call dword [esi + 0x100b8]
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_TimerOn_qqrv
cmp ebx, 0xffffffff
jne 0x438ff3
call sub.WSOCK32.DLL_WSAGetLastError
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1008c], esi
cmp esi, 0x2749
je 0x439013
lea ecx, [ebp - 0x10]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_ErrorManager_qqrus
test ebx, ebx
je 0x439013
mov eax, dword [0x4f0650]
mov eax, dword [eax]
call fcn.0047bbb0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x438f63
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439030
mov eax, dword [ebp - 0xc]
call fcn.004b7b60
ret